Skills code-craft

📦

code-craft

Name: code-craft
Author: jssblck

Content revision r1 Critical 📁 Filesystem access🔑 Env variables⚙️ External commands

Build Reliable Code with Durable Principles

Inconsistent engineering choices make code harder to review and maintain. This skill applies clear design, testing, error, and tooling defaults across common languages.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "code-craft" from https://skillstore.io/skills/jssblck-code-craft.md and its manifest at https://skillstore.io/api/skills/jssblck-code-craft/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/jssblck-code-craft.md Signed manifest GET /api/skills/jssblck-code-craft/manifest Signed lockfile GET /api/skills/jssblck-code-craft/lockfile

Test it

Using "code-craft". Review a TypeScript checkout function that accepts untyped request data and throws generic errors.

Expected outcome:

Parse request data once at the boundary into explicit checkout types.
Represent expected failures with a typed result instead of generic exceptions.
Add behavior tests for invalid items, missing payment data, and declined payments.

Using "code-craft". Recommend a Python project quality baseline for a small command-line application.

Expected outcome:

Use Ruff for formatting and linting, plus strict static type checking.
Run formatting, linting, typing, and tests through one shared command.
Call the same command from local pre-commit checks and continuous integration.

Security Audit

Critical

v1 • 8/23/2026 Open versioned report

Most static detections are false positives caused by Markdown links, inline code formatting, or explanatory engineering prose. Two installer examples genuinely recommend immediate execution of remote scripts through Bash or PowerShell.

Files scanned

1,583

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Critical

principles/new-project-defaults.md:191

Pipe to shell pattern

- `curl -sSfL .../install.sh | bash` (macOS/Linux)

The guide explicitly recommends piping a remotely downloaded installer into Bash. This executes unverified script content before users can inspect or authenticate it, creating a supply-chain execution risk.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

principles/new-project-defaults.md:192

PowerShell invocation

- `irm .../install.ps1 | iex` (Windows PowerShell)

The guide explicitly recommends piping a remote PowerShell response into Invoke-Expression. This directly executes downloaded content without authenticating the installer script first.

Risk Factors

Detected Patterns

Pipe to shell pattern

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/jssblck-code-craft/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/jssblck-code-craft/security.svg)](https://skillstore.io/skills/jssblck-code-craft?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/jssblck-code-craft?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/jssblck-code-craft/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/jssblck-code-craft.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

jssblck. (2026). code-craft security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/jssblck-code-craft/audits/1

BibTeX citation

@techreport{jssblck-jssblck-code-craft-2026,
  author = {jssblck},
  title = {code-craft security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/jssblck-code-craft/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "code-craft security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "jssblck"
date-released: "2026-08-23"
url: "https://skillstore.io/skills/jssblck-code-craft/audits/1"
identifiers:
  - type: other
    value: "skillstore:jssblck-code-craft:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Low

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Review a Pull Request

Identify design, error-handling, testing, and maintainability issues with language-specific recommendations.

Refactor a Legacy Module

Replace weak boundaries and primitive values with parsed, explicit domain types.

Bootstrap Project Standards

Select consistent formatting, linting, testing, CI, and governance defaults for a new repository.

Try These Prompts

Check a Function

Review this [language] function for clear errors, strong types, and simple control flow. Explain the most important changes.

Improve Test Design

Review these [language] tests. Focus on observable behavior, realistic boundaries, deterministic execution, and unnecessary mocking. Propose specific improvements.

Refactor a Module

Refactor this [language] module using parsed boundaries, explicit domain types, and errors as values. Preserve behavior and follow existing repository conventions.

Design a Project Baseline

Design standards for a new [language] project. Include formatting, linting, type checks, tests, CI, pre-commit checks, architecture notes, and release safeguards.

Best Practices

Provide the target language, repository conventions, and relevant code or diff.
Ask for behavior preservation and require formatter, type-checker, linter, and test verification.
Apply recommendations selectively when established project rules require a different approach.

Avoid

Do not request broad rewrites without defining behavior and scope.
Do not apply new abstractions before identifying real callers and duplicated needs.
Do not treat generated advice as proof that tests, security, or performance are correct.