Skills share
📦

share

Content revision r1 Medium Risk ⚙️ External commands

Create Shareable p11 Documents

Teams need polished documents that reviewers can open and comment on. This skill helps Claude, Codex, and Claude Code publish p11 review links.

Supports: Claude Codex Code(CC)
⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "share" from https://skillstore.io/skills/rarexlabs-share.md and its manifest at https://skillstore.io/api/skills/rarexlabs-share/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/rarexlabs-share.md Signed manifest GET /api/skills/rarexlabs-share/manifest Signed lockfile GET /api/skills/rarexlabs-share/lockfile

Test it

Using "share". A product proposal with goals, risks, and open questions.

Expected outcome:

A published p11 proposal with clear sections and read and edit URLs.

Using "share". An engineering spec that needs team comments.

Expected outcome:

  • A structured p11 spec document.
  • A shareable read link for reviewers.
  • A private edit link for future updates.

Using "share". An existing p11 edit URL and revised memo text.

Expected outcome:

An updated p11 memo with the latest content and refreshed links.

Security Audit

Medium Risk
v4 • 7/5/2026 Open versioned report

Most static matches are false positives from Markdown code ticks and component names, not Ruby backtick execution. I confirmed the instructions that install or run external p11 CLI commands, publish documents, allow custom API targets, and handle bearer edit URLs. No prompt injection attempt was found.

3
Files scanned
132
Lines analyzed
8
Review items
0
False positives ignored

Confirmed security concerns (1)

Medium
SKILL.md:41-49SKILL.md:64
Shared Document Publishing Can Expose Private Content
The skill directs agents to run p11 share commands and return full read and edit URLs. This intentionally publishes document content and creates a bearer edit link, so sensitive material could be exposed without explicit user confirmation.
Lines 41-49 describe the share and update commands plus full URL output. Line 64 explicitly states that edit URLs are bearer credentials.
Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:14
Ruby/shell backtick execution
Prefer the globally installed `p11` CLI. If it is missing, install it globally first. Use `npx -y @p
Line 14 directs use of a global p11 CLI and allows an npx fallback using the latest package. Installing or executing package code from npm creates supply-chain and local environment risk.
Medium
SKILL.md:16-19
Ruby/shell backtick execution
```bash
The fenced block spans hardcoded shell commands that discover and run the p11 CLI. The commands are limited to help checks, but they still execute a local external binary.
Medium
SKILL.md:23-25
Ruby/shell backtick execution
```bash
The range includes npm install -g for @p11-core/cli@latest. Global package installation can alter the host environment and execute unpinned package lifecycle behavior.
Medium
SKILL.md:29-34
Ruby/shell backtick execution
```bash
The fenced block invokes p11 help, docs, and example commands. These are hardcoded documentation commands, but they still rely on executing an external CLI.
Medium
SKILL.md:41-42
Ruby/shell backtick execution
4. Run `p11 share <file>` for a new document.
Line 41 directs running p11 share with a document file. This executes an external CLI and publishes local document content to a sharing service.
Medium
SKILL.md:42-47
Ruby/shell backtick execution
5. Run `p11 share <file> --edit-url <editUrl>` only when updating an existing p11 link.
Line 42 directs running p11 share with an edit URL, and the next lines require returning the full URLs. This handles bearer edit links and can expose update authority if mishandled.
Medium
SKILL.md:47-49
Ruby/shell backtick execution
Use `--json` when scripting or when exact fields are needed.
This range includes scripting guidance and custom API targeting. Use of --json is benign, but the adjacent API override increases data-routing risk when sharing documents.
Medium
SKILL.md:49
Ruby/shell backtick execution
Use `--api-url <url>` only when the user targets a non-default p11 API. `p11_API_URL` can also overr
Line 49 allows --api-url and p11_API_URL to route p11 traffic to a non-default API. That can send published document content to an attacker-controlled endpoint if misused.

Risk Factors

⚙️ External commands (16)
SKILL.md:10 SKILL.md:14 SKILL.md:16-19 SKILL.md:19-23 SKILL.md:23-25 SKILL.md:25-29 SKILL.md:29-34 SKILL.md:34-38 SKILL.md:38-39 SKILL.md:39-41 SKILL.md:41-42 SKILL.md:42-47 SKILL.md:47-49 SKILL.md:49 SKILL.md:55-57 SKILL.md:57
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/rarexlabs-share/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/rarexlabs-share/security.svg)](https://skillstore.io/skills/rarexlabs-share?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/rarexlabs-share?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/rarexlabs-share/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/rarexlabs-share.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

rarexlabs. (2026). share security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/rarexlabs-share/audits/4

BibTeX citation

@techreport{rarexlabs-rarexlabs-share-2026, author = {rarexlabs}, title = {share security audit report (audit version 4)}, institution = {Skillstore}, year = {2026}, number = {4}, url = {https://skillstore.io/skills/rarexlabs-share/audits/4}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "share security audit report (audit version 4)" version: "unspecified" type: report authors: - name: "rarexlabs" date-released: "2026-07-05" url: "https://skillstore.io/skills/rarexlabs-share/audits/4" identifiers: - type: other value: "skillstore:rarexlabs-share:audit:4" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
41
Architecture
85
Maintainability
85
Content
65
Community
83
Spec Compliance

What You Can Build

Publish a proposal

Turn a proposal draft into a structured p11 document with a review link.

Share an engineering spec

Create a static spec document that teammates can read and comment on.

Update a review memo

Revise an existing p11 document using its edit URL and return updated links.

Try These Prompts

Create a Review Link 
Use share to turn my draft into a polished p11 document and publish a read link for comments.
Build a Proposal Document 
Use share to create a structured proposal from these notes. Include context, options, recommendation, and next steps.
Update an Existing Document 
Use share to update this p11 document with the provided edit URL. Preserve the core structure and return both links.
Prepare a Board Brief 
Use share to create a concise board brief from this material. Validate supported components before publishing, then summarize any errors.

Best Practices

  • Confirm the document can be shared before running the p11 publish command.
  • Keep sensitive material out of documents unless the user approves publication.
  • Protect edit URLs and send them only to the requesting user.

Avoid

  • Do not use the skill to build interactive app screens or forms.
  • Do not publish confidential drafts without explicit user approval.
  • Do not paste edit URLs into public documents or issue trackers.

Frequently Asked Questions

Does this skill create normal React apps?
No. It creates static p11 documents using document-safe components.
Can it update an existing p11 link?
Yes. Provide the edit URL and revised content to update the document.
Does it require the p11 CLI?
Yes. The workflow depends on the p11 CLI or the approved npm package fallback.
What links does it return?
It returns a read URL for reviewers and an edit URL for future changes.
Can I use custom p11 API endpoints?
Yes, but only when you intentionally target a non-default p11 API.
Is the edit URL sensitive?
Yes. Treat it like a bearer credential because it can update or delete the document.

Developer Details

Author

rarexlabs

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/rarexlabs/p11-public/tree/main/plugins/p11/skills/share

Ref

62e2a730c5cd74eab4c7164309d810de660fcea3

Maintenance freshness

7/22/2026

Usage

0 downloads · 0 views

File structure

📁 agents/

📄 openai.yaml

📁 references/

📄 components.md

📄 SKILL.md