Skills rivet-actors

📦

rivet-actors

Name: rivet-actors
Author: rivet-dev

Content revision r1 High Risk 🌐 Network access⚙️ External commands🔑 Env variables📁 Filesystem access

Build Applications with Rivet Actors

Stateful distributed applications require careful coordination, persistence, and realtime communication. This skill provides Rivet Actors guidance and runnable TypeScript examples.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "rivet-actors" from https://skillstore.io/skills/rivet-dev-rivet-actors.md and its manifest at https://skillstore.io/api/skills/rivet-dev-rivet-actors/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/rivet-dev-rivet-actors.md Signed manifest GET /api/skills/rivet-dev-rivet-actors/manifest Signed lockfile GET /api/skills/rivet-dev-rivet-actors/lockfile

Test it

Using "rivet-actors". How should I model a chat room?

Expected outcome:

Use one actor per room. Store room state in the actor, identify rooms with keys, and authorize each connection before publishing events.

Using "rivet-actors". How can a React client receive updates?

Expected outcome:

Create the typed React client with the trusted actor endpoint.
Resolve the actor by its stable key.
Subscribe to events and remove listeners during cleanup.

Using "rivet-actors". What should a durable order workflow include?

Expected outcome:

Use queued work, idempotent workflow steps, explicit error handling, persisted state, and versioned SQLite migrations. Validate every external destination before requests.

Security Audit

High Risk

v1 • 8/28/2026 Open versioned report

The review confirmed an unsigned JWT authorization bypass and a user-controlled outbound request that can enable SSRF. It also found multiple placeholder token validators that accept any nonempty value. The remaining static matches are documentation links, local endpoints, template strings, actor keys, or normal configuration patterns.

291

Files scanned

8,263

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

examples/docs/actors-authentication/jwt.ts:24

Base64 decode

const payload = JSON.parse(atob(parts[1])) as JwtPayload;

The authentication function only decodes the JWT payload and never verifies its signature. An attacker can forge role and permission claims to bypass authorization.

Medium

examples/docs/actors-authentication/on-before-connect.ts:7-10 examples/docs/actors-connections/params-actor.ts:13-18 examples/docs/actors-lifecycle/on-before-connect.ts:3-4

Placeholder Token Validators Accept Any Nonempty Value

Several runnable authentication examples treat any nonempty token as valid. Copying these validators into a deployed actor would allow unauthorized connections.

Each cited validator directly returns success based only on token length. The educational context is clear, but the authentication behavior is definitively incomplete.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

examples/docs/actors-crash-course/workflows.ts:22

Fetch API call

const res = await fetch(url, { method: "POST" });

The workflow fetches a URL supplied through a queue message without scheme, host, or private-network validation. A caller able to enqueue tasks could trigger SSRF.

Risk Factors

🌐 Network access (50)

⚙️ External commands (41)

🔑 Env variables (5)

examples/docs/actors-authentication/external-auth-provider.ts:22 examples/docs/actors-authentication/jwt.ts:33 examples/docs/actors-authentication/jwt.ts:33 examples/docs/general-registry-configuration/config.ts:8 examples/docs/general-registry-configuration/config.ts:8

📁 Filesystem access (2)

examples/workflow-sdk/package.json:10 examples/workflow-sdk/src/server.ts:4

Audited by: codex

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/rivet-dev-rivet-actors/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/rivet-dev-rivet-actors/security.svg)](https://skillstore.io/skills/rivet-dev-rivet-actors?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/rivet-dev-rivet-actors?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/rivet-dev-rivet-actors/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/rivet-dev-rivet-actors.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

rivet-dev. (2026). rivet-actors security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/rivet-dev-rivet-actors/audits/1

BibTeX citation

@techreport{rivet-dev-rivet-dev-rivet-actors-2026,
  author = {rivet-dev},
  title = {rivet-actors security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/rivet-dev-rivet-actors/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "rivet-actors security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "rivet-dev"
date-released: "2026-08-28"
url: "https://skillstore.io/skills/rivet-dev-rivet-actors/audits/1"
identifiers:
  - type: other
    value: "skillstore:rivet-dev-rivet-actors:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a Stateful Service

Design actor state, actions, keys, and lifecycle behavior for a new TypeScript service.

Add Realtime React Features

Connect a React interface to actors, subscribe to events, and manage connection parameters.

Design Durable Orchestration

Combine queues, workflows, SQLite, and actor communication for resilient background processing.

Try These Prompts

Explain an Actor

Explain Rivet Actor state, actions, and keys for a beginner. Include one simple application example.

Plan a Realtime Feature

Plan a Rivet Actors chat room with React clients, connection state, events, and access control. Identify the relevant examples.

Review an Actor Design

Review my actor design for lifecycle, input validation, error handling, persistence, and client usage. Recommend changes supported by this skill.

Design Durable Processing

Design a multi-actor workflow using queues, retries, SQLite, and orchestration. Include security boundaries, failure handling, and migration considerations.

Best Practices

Use stable actor keys that match domain ownership and access boundaries.
Validate connection parameters, action inputs, external URLs, and permissions before processing.
Use production authentication libraries, trusted endpoints, and environment-managed secrets.

Avoid

Do not accept unsigned tokens or placeholder validators in production.
Do not fetch user-controlled URLs without an allowlist and network restrictions.
Do not embed production tokens or private endpoints in client examples.

Frequently Asked Questions

What does this skill cover?

It covers Rivet Actors concepts, TypeScript clients, lifecycle, realtime events, workflows, storage, authentication, configuration, and deployment guidance.

Does it deploy an application?

No. It provides implementation guidance and examples, while deployment still requires your Rivet environment and tooling.

Can I use the examples in production?

Treat them as learning templates. Replace placeholders, validate inputs, review security, and test behavior before production use.

Which client environments are documented?

The material includes JavaScript, React, HTTP, WebSocket, Cloudflare, backend, and other framework integration examples.

Does it include persistence patterns?

Yes. It includes in-memory state, KV storage, SQLite operations, queues, synchronization, and migration examples.

Are authentication examples production ready?

No. Some validators are intentionally simplified, so use proven libraries and complete signature, issuer, audience, expiry, and permission checks.

Developer Details

Author

rivet-dev

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/rivet-dev/skills/tree/1b41bfb0a8e367d39ab08ad695adc48222ef5250/rivet-actors

Ref

cc979b56757ef592f60b084674ddc651a090cc5e

Maintenance freshness

8/28/2026

Usage

1 downloads · 0 views

File structure

📁 examples/

📁 docs/

📁 actors-access-control/

📄 chat-room.ts

📁 actors-actions/

📄 action-context.ts

📄 calling-actor.ts

📄 calling-backend.ts

📄 calling-frontend.ts

📄 canceling-actions.ts

📄 nested-actions.ts

📄 schema-validation.ts

📄 type-safety-client.ts

📄 type-safety-index.ts

📄 user-error-actor.ts

📄 user-error-client.ts

📄 writing-actions.ts

📁 actors-appearance/

📄 config-basic.ts

📄 examples-patterns.ts

📄 icon-emoji.ts

📄 icon-fontawesome.ts

📄 run-handler-metadata.ts

📄 run-handler-override.ts

📄 run-handler-usage.ts

📁 actors-authentication/

📄 caching-tokens.ts

📄 create-conn-state.ts

📄 external-auth-provider.ts

📄 handling-errors-connection.ts

📄 handling-errors-stateless.ts

📄 jwt.ts

📄 on-before-connect.ts

📄 passing-credentials-connection.ts

📄 passing-credentials-headers.ts

📄 passing-credentials-stateless.ts

📄 rate-limiting.ts

📄 role-based-access-control.ts

📄 using-state.ts

📁 actors-communicating-between-actors/

📄 actor-orchestration.ts

📄 batch-operations.ts

📄 data-aggregation.ts

📄 event-driven.ts

📄 server-side-client.ts

📁 actors-connections/

📄 conn-state-const.ts

📄 conn-state-dynamic.ts

📄 connection-list.ts

📄 disconnect-await.ts

📄 disconnect-clients.ts

📄 on-before-connect.ts

📄 on-connect.ts

📄 on-disconnect.ts

📄 params-actor.ts

📄 params-client.ts

📁 actors-crash-course/

📄 actions.ts

📁 actor-per-entity/

📄 client.ts

📄 index.ts

📄 actor-to-actor.ts

📄 conn-dynamic.ts

📄 conn-static.ts

📄 context-types.ts

📁 coordinator/

📄 client.ts

📄 index.ts

📄 destroying.ts

📄 errors-actor.ts

📄 errors-client.ts

📄 events.ts

📄 input.ts

📄 keys.ts

📄 lifecycle.ts

📄 minimal-project.ts

📄 queues.ts

📄 run-loop.ts

📄 scheduling.ts

📄 state-dynamic.ts

📄 state-static.ts

📄 vars-dynamic.ts

📄 vars-static.ts

📄 workflow-loop.ts

📄 workflows.ts

📁 actors-design-patterns/

📄 actor-per-request.ts

📄 coordinator-actor.ts

📄 coordinator-client.ts

📄 loading-state-actor.ts

📄 loading-state-client.ts

📄 map-reduce-actor.ts

📄 map-reduce-client.ts

📄 random-sharding-actor.ts

📄 random-sharding-client.ts

📄 sharding-time-actor.ts

📄 sharding-time-client.ts

📄 syncing-state-actor.ts

📄 syncing-state-client.ts

📁 actors-destroy/

📄 destroy-via-action.ts

📄 on-destroy.ts

📁 actors-errors/

📄 error-codes-actor.ts

📄 error-codes-client-connection.ts

📄 error-codes-client-stateless.ts

📄 expose-errors.ts

📄 internal-actor.ts

📄 internal-client-connection.ts

📄 internal-client-stateless.ts

📄 metadata-actor.ts

📄 metadata-client-connection.ts

📄 metadata-client-stateless.ts

📄 throwing-actor.ts

📄 throwing-client-connection.ts

📄 throwing-client-stateless.ts

📁 actors-events/

📄 broadcast.ts

📄 remove-listener.ts

📄 send-except-sender.ts

📄 send-to-connection.ts

📄 subscribe-basic.ts

📄 subscribe-once.ts

📁 actors-input/

📄 input-validation.ts

📄 input-vs-connection.ts

📄 lifecycle-hooks.ts

📄 passing-input.ts

📄 store-input-in-state.ts

📄 type-safety.ts

📁 actors-inspector-tabs/

📄 counter.ts

📄 inspector-tab-types.ts

📁 actors-keys/

📄 complex-config.ts

📄 compound-keys.ts

📄 config-client.ts

📄 config-index.ts

📄 key-format.ts

📄 key-uniqueness.ts

📄 metadata-client.ts

📄 metadata-index.ts

📄 omitting-keys.ts

📁 actors-kv/

📄 basic-usage.ts

📄 batch-operations.ts

📄 key-types.ts

📄 range-operations.ts

📄 typed-returns.ts

📄 value-types.ts

📁 actors-lifecycle/

📄 abort-signal.ts

📄 actor-context-of.ts

📄 can-publish-subscribe.ts

📄 create-state.ts

📄 create-vars.ts

📄 full-example.ts

📄 keep-awake.ts

📄 on-before-action-response.ts

📄 on-before-connect.ts

📄 on-connect.ts

📄 on-create.ts

📄 on-destroy.ts

📄 on-disconnect.ts

📄 on-migrate.ts

📄 on-request.ts

📄 on-sleep-hook.ts

📄 on-sleep.ts

📄 on-state-change.ts

📄 on-wake.ts

📄 on-websocket.ts

📄 options.ts

📄 run-one-shot.ts

📄 run-queue-consumer.ts

📄 run-tick-loop.ts

📄 state.ts

📄 vars.ts

📄 wait-until.ts

📁 actors-limits/

📄 actor-options.ts

📄 registry-message-size.ts

📁 actors-metadata/

📄 actor-id.ts

📄 actor-key.ts

📄 actor-name.ts

📄 client.ts

📄 index.ts

📄 region.ts

📁 actors-queues/

📁 abort-signals/

📄 client.ts

📄 index.ts

📁 basic/

📄 client.ts

📄 index.ts

📁 completable/

📄 client.ts

📄 index.ts

📄 delayed-delivery.ts

📁 from-actor/

📄 client.ts

📄 index.ts

📄 message-ttl.ts

📁 multiple-queues/

📄 client.ts

📄 index.ts

📄 next-batch.ts

📄 poll.ts

📁 request-reply/

📄 client.ts

📄 index.ts

📄 schemas.ts

📁 actors-quickstart-backend/

📄 client.ts

📄 Counter.tsx

📄 index.ts

📁 actors-quickstart-cloudflare/

📄 client.ts

📄 Counter.tsx

📄 index.ts

📁 actors-quickstart-next-js/

📄 registry.ts

📁 actors-quickstart-react/

📄 Counter.tsx

📄 index.ts

📁 actors-request-handler/

📄 hono.ts

📄 http-api-fetch.ts

📄 proxy.ts

📄 raw-http.ts

📁 via-client/

📄 client.ts

📄 index.ts

📁 via-gateway/

📄 client.ts

📄 index.ts

📁 actors-sqlite/

📁 basic/

📄 client.ts

📄 index.ts

📁 queues/

📄 client.ts

📄 index.ts

📁 actors-sqlite-drizzle/

📄 schema.ts

📁 actors-state/

📄 durable-basic.ts

📄 durable-dynamic-init.ts

📄 durable-with-input.ts

📄 ephemeral-basic.ts

📄 ephemeral-dynamic-init.ts

📄 runtime-objects.ts

📄 save-state.ts

📁 actors-testing/

📄 basic-setup.ts

📄 testing-events.ts

📄 testing-schedules.ts

📄 testing-state.ts

📁 actors-types/

📄 context-types.ts

📄 extracting-context-types.ts

📁 actors-versions/

📄 onwake-defaults.ts

📄 programmatic-version.ts

📄 sqlite-migrate.ts

📄 zod-coercion.ts

📁 actors-websocket-handler/

📄 accessing-request.ts

📄 async-handler.ts

📄 chat-actor.ts

📄 hibernation.ts

📄 proxy.ts

📁 clients-javascript/

📄 calling-from-backend.ts

📄 connection-lifecycle.ts

📁 connection-params/

📄 get-params.ts

📄 params.ts

📄 error-handling.ts

📄 getting-actors.ts

📁 keys/

📄 client.ts

📄 index.ts

📁 minimal-client/

📄 client.ts

📄 index.ts

📄 stateless-vs-stateful.ts

📄 subscribing-events.ts

📁 clients-react/

📄 connection-lifecycle.tsx

📄 connection-parameters.tsx

📄 error-handling.tsx

📄 getting-actors.tsx

📁 keys/

📄 ChatRoom.tsx

📄 index.ts

📁 minimal-client/

📄 Counter.tsx

📄 index.ts

📄 stateful-counter.tsx

📄 stateless-client.tsx

📄 subscribing-to-events.tsx

📁 cookbook-cron-jobs/

📄 daily-report.ts

📁 general-actor-configuration/

📄 basic-example.ts

📁 general-cors/

📄 client.ts

📄 server.ts

📁 general-edge/

📄 client.ts

📁 general-endpoints/

📄 private-endpoint.ts

📄 public-endpoint.ts

📁 general-http-server/

📄 elysia-handler.ts

📄 hono-handler.ts

📄 index.ts

📄 node-hono.ts

📄 serve.ts

📁 general-logging/

📄 custom-pino.ts

📄 disable-welcome.ts

📄 log-examples.ts

📄 log-level.ts

📁 general-registry-configuration/

📄 basic-setup.ts

📄 config.ts

📄 environment-variables.ts

📄 envoy.ts

📄 registry-start.ts

📄 serverless-with-router.ts

📄 serverless.ts

📁 general-runtime-modes/

📄 runner-pool.ts

📄 runner.ts

📄 serverless-direct.ts

📄 serverless-router.ts

📁 general-wasm-vs-native-sdk/

📄 native-runtime.ts

📁 workflow-sdk/

📄 .env.example

📄 .gitignore

📄 nitro.config.ts

📄 package.json

📄 README.md

📁 src/

📄 server.ts

📄 tsconfig.json

📄 vitest.integration.config.ts

📄 vitest.setup.ts

📁 workflows/

📄 order.integration.test.ts

📄 order.ts

📄 openapi.json

📄 SKILL.md

More from rivet-dev

View all

📦

Build Frontend Apps Faster

by davila7

Frontend work often needs consistent React patterns, performance checks, and project scaffolding. This skill gives Claude and compatible agents practical guidance and local helper scripts for modern web application development.

Coding & Development View

rivet-actors

Install with my Agent

Agent-readable resources

Test it

Security Audit

Confirmed security concerns (2)

Risk Factors

Copy report link

Markdown badge

HTML badge

Embed card

APA citation

BibTeX citation

CITATION.cff

Skillstore Score

What You Can Build

Create a Stateful Service

Add Realtime React Features

Design Durable Orchestration

Try These Prompts

Best Practices

Avoid

Frequently Asked Questions

Developer Details

More from rivet-dev

rivet-workflows

rivet-dynamic-apps

Related Skills

playwright-testing

starknet-js

vue-best-practices

react-dev

vue-options-api-best-practices

senior-frontend