Skills environment-setup-guide

📦

environment-setup-guide

Name: environment-setup-guide
Author: sickn33

Content revision r2 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Set Up Reliable Development Environments

New machines and project onboarding often fail because required tools, versions, and configuration steps are unclear. This skill creates platform-specific setup, verification, and troubleshooting guidance.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "environment-setup-guide" from https://skillstore.io/skills/sickn33-environment-setup-guide.md and its manifest at https://skillstore.io/api/skills/sickn33-environment-setup-guide/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-environment-setup-guide.md Signed manifest GET /api/skills/sickn33-environment-setup-guide/manifest Signed lockfile GET /api/skills/sickn33-environment-setup-guide/lockfile

Test it

Using "environment-setup-guide". Prepare an Ubuntu setup plan for a Node.js service using PostgreSQL and Docker.

Expected outcome:

The plan starts with operating system, architecture, disk, and existing version checks.
Installation steps separate package changes from project dependency installation.
Database and Docker steps use local bindings, unique credentials, and explicit approval.
Verification covers tool versions, container health, database connectivity, and application startup.

Using "environment-setup-guide". Help a new contributor diagnose a Python project that cannot find its dependencies.

Expected outcome:

The guide checks the active interpreter, virtual environment, and package manager.
It compares installed dependencies with the project requirements.
It explains PATH and activation problems before recommending reinstallation.

Using "environment-setup-guide". Turn our incomplete workstation notes into a cross-platform onboarding guide.

Expected outcome:

The result organizes prerequisites, platform-specific installation, project configuration, verification, and troubleshooting into a repeatable onboarding sequence.

Security Audit

High Risk

v5 • 7/23/2026 Open versioned report

Most static findings are false positives caused by Markdown fences, placeholders, local addresses, and ordinary setup references. Confirmed risks include mutable remote installers, root execution, Docker group privileges, and exposed default database credentials. No prompt injection or data-exfiltration intent was found.

Files scanned

493

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

SKILL.md:300-314

Default Database Credentials Exposed on Host Port

The Docker Compose example publishes PostgreSQL on port 5432 while assigning the password "password". Other local users or reachable hosts could authenticate.

The configuration directly combines predictable credentials with a published database port. The risk is clear unless the host network is fully isolated.

Medium

SKILL.md:446-463

Setup Template Runs Project-Defined Code Without Confirmation

The setup template runs npm installation, migrations, and setup tests automatically. Dependency lifecycle hooks or project scripts can execute arbitrary code and alter data.

The listed commands execute dependency and project-controlled scripts without a review or confirmation boundary. Their exact behavior depends on the target repository.

Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:106

sudo privilege escalation

sudo -E bash "$tmpdir/nodesource-setup.sh"

This runs a downloaded NodeSource script with root privileges and preserves the environment. A compromised response or dependency could modify the entire system.

High

SKILL.md:271

sudo privilege escalation

sudo sh get-docker.sh

This executes the mutable get.docker.com script as root without an integrity check or review step. Compromise of the download path would yield system control.

High

SKILL.md:274

sudo privilege escalation

sudo usermod -aG docker $USER

Adding a user to the docker group grants control of the Docker daemon. That access is commonly equivalent to root privileges on the host.

High

SKILL.md:300

Database connection strings

- DATABASE_URL=postgresql://postgres:password@db:5432/mydb

The example embeds the predictable database password "password" and publishes PostgreSQL on the host. Reuse outside an isolated machine could expose the database.

Medium

SKILL.md:90

Unix shell invocation

/bin/bash "$tmpdir/homebrew-install.sh"

This command executes a script downloaded from a mutable URL. Manual review reduces risk, but remote shell code can still compromise the user account.

Low

SKILL.md:88

Hardcoded URL

curl -fsSLo "$tmpdir/homebrew-install.sh" https://raw.githubusercontent.com/Homebrew/install/HEAD/in

The command downloads a mutable installer from GitHub for later execution. The official host lowers suspicion, but no version pin or checksum protects integrity.

Low

SKILL.md:104

Hardcoded URL

curl -fsSLo "$tmpdir/nodesource-setup.sh" https://deb.nodesource.com/setup_20.x

The command downloads a mutable NodeSource setup script that is later executed as root. No version pin or checksum authenticates the retrieved content.

Low

SKILL.md:270

Hardcoded URL

curl -fsSL https://get.docker.com -o get-docker.sh

The command downloads a mutable Docker installation script that is immediately executed as root. It provides no checksum or content review step.

Risk Factors

⚙️ External commands (50)

🌐 Network access (14)

SKILL.md:88 SKILL.md:104 SKILL.md:127 SKILL.md:159 SKILL.md:250 SKILL.md:270 SKILL.md:477 SKILL.md:478 SKILL.md:479 SKILL.md:480 SKILL.md:481 SKILL.md:482 SKILL.md:483 SKILL.md:250

📁 Filesystem access (20)

🔑 Env variables (6)

SKILL.md:231 SKILL.md:149 SKILL.md:240 SKILL.md:300 SKILL.md:150 SKILL.md:241

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-environment-setup-guide/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-environment-setup-guide/security.svg)](https://skillstore.io/skills/sickn33-environment-setup-guide?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-environment-setup-guide?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-environment-setup-guide/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-environment-setup-guide.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). environment-setup-guide security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-environment-setup-guide/audits/5

BibTeX citation

@techreport{sickn33-sickn33-environment-setup-guide-2026,
  author = {sickn33},
  title = {environment-setup-guide security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/sickn33-environment-setup-guide/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "environment-setup-guide security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-environment-setup-guide/audits/5"
identifiers:
  - type: other
    value: "skillstore:sickn33-environment-setup-guide:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Onboard a New Developer

Create a complete setup checklist with prerequisites, project configuration, verification steps, and common fixes.

Prepare a Replacement Workstation

Rebuild a working development environment on a new operating system while preserving project requirements.

Standardize Project Documentation

Turn informal installation notes into structured, testable environment documentation for contributors.

Try These Prompts

Check My Current Environment

Review my operating system and project requirements. List safe commands that check installed tool versions before suggesting any changes.

Create a Project Setup Guide

Create setup instructions for {project type} on {operating system}. Include prerequisites, pinned versions, dependency installation, environment templates, verification, and troubleshooting.

Adapt Setup Across Platforms

Convert these existing setup notes for macOS, Ubuntu, and Windows. Separate platform commands and identify steps that require administrator approval.

Audit and Harden Setup Automation

Review this setup workflow for remote scripts, elevated commands, lifecycle hooks, weak credentials, network exposure, and destructive changes. Propose safer verified alternatives.

Best Practices

Check existing versions and project requirements before installing or changing anything.
Pin versions and verify checksums or signatures for downloaded installers.
Separate verification from changes and request approval before privileged, destructive, or data-changing commands.

Avoid

Do not execute mutable remote scripts directly with administrator privileges.
Do not place real secrets or reusable passwords in examples, logs, or setup documentation.
Do not run dependency hooks, migrations, or project scripts before reviewing their effects.

Frequently Asked Questions

Which operating systems does this skill cover?

It provides patterns for macOS, common Linux distributions, and Windows. Exact commands still require platform and architecture validation.

Can it install tools automatically?

It can propose commands and setup scripts. Users should review and approve commands, especially downloads, package changes, and elevated operations.

Does it handle environment variables?

It can document required variable names and create placeholder templates. Real secret values should come from an approved secret-management process.

Can it troubleshoot setup failures?

Yes. It covers missing commands, PATH problems, permission errors, occupied ports, dependency issues, and database connection failures.

Does it support Docker environments?

Yes. It can outline Docker installation, Compose services, volumes, ports, verification, and common permission concerns.

How should remote installers be handled?

Use official sources, pin versions, verify signatures or checksums, inspect the downloaded file, and avoid root execution when possible.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/environment-setup-guide

Ref

88a8e9a07f4c54ab105c1c41b6267c287146b07b

Maintenance freshness

7/26/2026

Usage

8 downloads · 159 views

File structure

📄 SKILL.md