📦

revise

Name: revise
Author: rarexlabs

Content revision r1 High Risk ⚙️ External commands

Revise p11 Documents From Review Comments

Reviewer comments can be hard to turn into a clean published revision. This skill finds the p11 target, applies clear decisions, and shares a new version.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "revise" from https://skillstore.io/skills/rarexlabs-revise.md and its manifest at https://skillstore.io/api/skills/rarexlabs-revise/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/rarexlabs-revise.md Signed manifest GET /api/skills/rarexlabs-revise/manifest Signed lockfile GET /api/skills/rarexlabs-revise/lockfile

Test it

Using "revise". A reviewer asks to shorten the introduction and replace one term across the document.

Expected outcome:

The response lists the applied edits, notes that all visible threads were clear, and provides the updated read link.

Using "revise". One thread asks for a wording change, and another thread contains disagreement between reviewers.

Expected outcome:

The response applies the wording change, asks whether to clarify or skip the disputed thread, and waits before publishing.

Using "revise". A user gives an edit URL and asks to publish a revised proposal after comments are resolved.

Expected outcome:

The response confirms the target, summarizes resolved comments, publishes the new revision, and handles the edit link carefully.

Security Audit

High Risk

v4 • 7/5/2026 Open versioned report

Most Markdown backtick detections are false positives for filenames, component names, skill names, or fenced formatting. Confirmed risks are actual p11 CLI execution, unpinned global npm installation, and publishing through bearer edit URLs. No prompt injection attempt was found in the reviewed skill files.

Files scanned

158

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:29 SKILL.md:33

Unpinned Global Package Installation

The skill instructs global installation or npx execution of @p11-core/cli@latest. This can execute remote package code and leave a persistent global tool outside the project.

The install and npx guidance is explicit and uses the latest npm package without pinning or user confirmation. This is a clear supply-chain and persistence risk.

Medium

SKILL.md:90

Bearer Edit URL Exposure Risk

The skill says to return the updated edit URL when available and also states that edit URLs are bearer credentials. Sharing edit URLs in chat can expose document write access through logs or transcripts.

The same line recognizes the credential risk, which partially mitigates the issue. The instruction to return edit URLs still creates a credible exposure path.

Capability review items (6)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:29

Ruby/shell backtick execution

Prefer the global `p11` CLI. If missing, install `@p11-core/cli` globally. Use `npx -y @p11-core/cli

The line directs global installation of @p11-core/cli and fallback use of npx -y with the latest package. This executes remote package code and may persist changes outside the project.

High

SKILL.md:33

Ruby/shell backtick execution

Install or upgrade with `npm install -g @p11-core/cli@latest` when the command is missing or any `p1

The skill instructs npm install -g @p11-core/cli@latest when missing or outdated. Unpinned global package installation is a supply-chain and persistence risk.

High

SKILL.md:86-88

Ruby/shell backtick execution

```bash

The fenced block instructs p11 share <page.tsx> --edit-url <editUrl>. This publishes local document content using a bearer edit URL, so misuse could change shared material.

Medium

SKILL.md:16

Ruby/shell backtick execution

3. Only if the current chat has no usable p11 target, run `p11 history` and use the most recent rele

The skill explicitly instructs the agent to run p11 history when no target is available. That command can reveal recent p11 document history from the local environment.

Medium

SKILL.md:39-41

Ruby/shell backtick execution

```bash

The fenced block contains p11 comments <target>, which runs an external CLI against a user-resolved target. This is intended behavior, but it can access reviewer data and should validate targets.

Medium

SKILL.md:69-73

Ruby/shell backtick execution

```bash

The fenced block includes p11 docs, p11 docs components, and p11 example all-components. These are external CLI commands that may read bundled or remote CLI documentation.

Risk Factors

⚙️ External commands (19)

SKILL.md:14 SKILL.md:16 SKILL.md:18 SKILL.md:22 SKILL.md:29 SKILL.md:31 SKILL.md:33 SKILL.md:39-41 SKILL.md:41-43 SKILL.md:43 SKILL.md:54-57 SKILL.md:57-59 SKILL.md:59-67 SKILL.md:67-69 SKILL.md:69-73 SKILL.md:73-77 SKILL.md:77-79 SKILL.md:79 SKILL.md:86-88

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/rarexlabs-revise/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/rarexlabs-revise/security.svg)](https://skillstore.io/skills/rarexlabs-revise?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/rarexlabs-revise?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/rarexlabs-revise/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/rarexlabs-revise.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

rarexlabs. (2026). revise security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/rarexlabs-revise/audits/4

BibTeX citation

@techreport{rarexlabs-rarexlabs-revise-2026,
  author = {rarexlabs},
  title = {revise security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/rarexlabs-revise/audits/4},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "revise security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
  - name: "rarexlabs"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/rarexlabs-revise/audits/4"
identifiers:
  - type: other
    value: "skillstore:rarexlabs-revise:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Apply review decisions before a stakeholder update

Turn approved comments into a revised p11 document and publish the new version for reviewers.

Prepare a clean product review artifact

Resolve comments on a proposal or launch plan while keeping unresolved questions separate.

Maintain technical design documents

Update a p11 technical document from reviewer feedback while preserving supported document components.

Try These Prompts

Revise the latest document

Use p11:revise on the latest p11 document from this chat. Apply clear reviewer comments and ask me about unclear threads.

Revise a specific target

Use p11:revise for this p11 read or edit URL: [paste URL]. Apply clear comments and summarize any skipped threads.

Handle clarification first

Use p11:revise for [document target]. If a thread is unclear, draft clarification replies and wait before publishing.

Revise with publish approval

Use p11:revise for [document target] from version [number]. Show the planned changes first, then publish only after I approve.

Best Practices

Provide the p11 read or edit URL and the source TSX file when possible.
Resolve unclear reviewer threads before asking the skill to publish a revision.
Review the planned changes and protect edit URLs as document write credentials.

Avoid

Running the skill without a target when the latest p11 history item may be unrelated.
Publishing while reviewer comments still contain disagreement or open questions.
Posting p11 edit URLs in public channels or long-lived shared transcripts.