Skills gen-paylink-govilo

📦

gen-paylink-govilo

Name: gen-paylink-govilo
Author: hau823823

v1.0 Content revision r1 Critical ⚙️ External commands🔑 Env variables🌐 Network access📁 Filesystem access

Create Govilo Paid Unlock Links

Selling a file through Govilo requires packaging, upload, and item creation. This skill automates those steps and returns a paid unlock link.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "gen-paylink-govilo" from https://skillstore.io/skills/hau823823-gen-paylink-govilo.md and its manifest at https://skillstore.io/api/skills/hau823823-gen-paylink-govilo/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/hau823823-gen-paylink-govilo.md Signed manifest GET /api/skills/hau823823-gen-paylink-govilo/manifest Signed lockfile GET /api/skills/hau823823-gen-paylink-govilo/lockfile

Test it

Using "gen-paylink-govilo". A creator asks for a paid link for a prepared course archive priced at 15 USDC.

Expected outcome:

The skill confirms the file, title, price, and seller address, then returns the new Govilo unlock link.

Using "gen-paylink-govilo". A freelancer provides a delivery folder and wants a paid client access link.

Expected outcome:

The skill packages the folder, uploads the archive, creates the Govilo item, and reports the link and file count.

Using "gen-paylink-govilo". A user is missing the Govilo API key or seller address.

Expected outcome:

The skill explains which required value is missing and points the user to the setup guide.

Security Audit

Critical

v4 • 7/21/2026 Open versioned report

The skill intentionally packages user-selected files, reads Govilo-specific credentials, and uploads the archive to the documented Govilo workflow. Most static matches are capability or documentation false positives, but the setup guide executes remotely downloaded installers and the packager uses race-prone temporary paths. No prompt-injection text, covert data collection, or undeclared exfiltration intent was found.

Files scanned

498

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

Critical

references/setup-guide.md:10

Pipe to shell pattern

curl -LsSf https://astral.sh/uv/install.sh | sh

The setup guide downloads a remote installer and immediately executes it through a shell. A compromised or substituted installer would execute arbitrary code on the user system.

Low

references/setup-guide.md:13

Network reconnaissance

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

The command retrieves a remote script and executes it through PowerShell. This is remote code execution exposure, not network reconnaissance.

Capability review items (3)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/setup-guide.md:13

PowerShell invocation

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

The Windows setup command downloads remote content and executes it with PowerShell while bypassing the execution policy. A compromised installer endpoint would execute arbitrary code.

Low

scripts/packager.py:44

Temp file creation

dest = Path(tempfile.mktemp(suffix=".zip"))

tempfile.mktemp creates a predictable path without atomically reserving it. A local attacker can race the later archive write and redirect or replace the file.

Low

scripts/packager.py:54

Temp file creation

dest = Path(tempfile.mktemp(suffix=".zip"))

tempfile.mktemp creates a predictable path without atomically reserving it. A local attacker can race the later archive write and redirect or replace the file.

Risk Factors

⚙️ External commands (20)

🔑 Env variables (21)

🌐 Network access (10)

scripts/api_client.py:20 scripts/api_client.py:27 scripts/api_client.py:36 scripts/api_client.py:51 scripts/config.py:5 scripts/config.py:27 SKILL.md:9 SKILL.md:19 SKILL.md:36 SKILL.md:93

📁 Filesystem access (8)

scripts/packager.py:1 scripts/packager.py:44 scripts/packager.py:54 scripts/packager.py:2 scripts/packager.py:16 scripts/packager.py:22 scripts/packager.py:45 SKILL.md:42

Detected Patterns

Pipe to shell patternNetwork reconnaissance

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/hau823823-gen-paylink-govilo/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/hau823823-gen-paylink-govilo/security.svg)](https://skillstore.io/skills/hau823823-gen-paylink-govilo?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/hau823823-gen-paylink-govilo?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/hau823823-gen-paylink-govilo/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/hau823823-gen-paylink-govilo.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

hau823823. (2026). gen-paylink-govilo security audit report (audit version 4) [Author version 1.0]. Skillstore. https://skillstore.io/skills/hau823823-gen-paylink-govilo/audits/4

BibTeX citation

@techreport{hau823823-hau823823-gen-paylink-govilo-2026,
  author = {hau823823},
  title = {gen-paylink-govilo security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/hau823823-gen-paylink-govilo/audits/4},
  note = {Author version 1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gen-paylink-govilo security audit report (audit version 4)"
version: "1.0"
type: report
authors:
  - name: "hau823823"
date-released: "2026-07-21"
url: "https://skillstore.io/skills/hau823823-gen-paylink-govilo/audits/4"
identifiers:
  - type: other
    value: "skillstore:hau823823-gen-paylink-govilo:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Sell a digital download

Package a finished file and create a Govilo unlock link with a USDC price.

Prepare client delivery

Bundle approved project files and publish a paid delivery link for a client.

Automate repeat uploads

Use the CLI workflow to create consistent Govilo items from prepared release folders.

Try These Prompts

Create a simple link

Create a Govilo unlock link for this ZIP. Ask me for the title, USDC price, description, and seller address before running anything.

Package a folder

Package this folder and create a Govilo paid link. Confirm the folder path and list the files before upload.

Use an existing seller address

Create a Govilo link using my dedicated Govilo environment file. Confirm the title, price, description, and input path first.

Review before monetizing

Review the selected files, confirm they should be uploaded to Govilo, then create the paid unlock link with the agreed price.

Best Practices

Use a dedicated Govilo environment file that contains only Govilo credentials.
Review every file path before upload because the archive leaves the local machine.
Confirm the seller address, title, price, and description before creating the item.

Avoid

Do not use a shared project environment file with unrelated secrets.
Do not upload private, unlicensed, or unapproved files to create a paid link.
Do not run remote installer commands without reviewing a safer installation path.