技能 astrale-cli

📦

astrale-cli

Name: astrale-cli
Author: astrale-os

内容修订 r1 中风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问

Manage Astrale Kernels with CLI Workflows

Astrale operations require precise paths, identity selection, and command options. This reference guides assistants through Kernel operations, graph workflows, diagnostics, and local UI setup.

支持: Claude Codex Code(CC)

📊 69 合格

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "astrale-cli" from https://skillstore.io/skills/astrale-os-astrale-cli.md and its manifest at https://skillstore.io/api/skills/astrale-os-astrale-cli/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/astrale-os-astrale-cli.md 已签名 manifest GET /api/skills/astrale-os-astrale-cli/manifest 已签名 lockfile GET /api/skills/astrale-os-astrale-cli/lockfile

测试它

正在使用“astrale-cli”。 Explain how to read notes from staging without changing data.

预期结果:

Select staging explicitly and use an identity authorized to read notes.
Query the Note class with a finite limit and structured output.
Resume with each returned cursor until no continuation remains.

正在使用“astrale-cli”。 Explain how to review a mutation before sending it.

预期结果:

Use mutation dry mode to admit and display the canonical document without connecting to a Kernel.
Review the operations and preconditions against the intended instance.
Require approval before executing the atomic transition.

正在使用“astrale-cli”。 Explain how to protect locally edited Astrale UI components.

预期结果:

Ordinary component addition refuses to replace locally edited installed files.
Preview proposed changes with dry-run mode.
Use overwrite and confirmation flags only after reviewing the intended replacement.

安全审计

中风险

v1 • 2026/10/10 打开版本化报告

All 269 static findings are documentation false positives, including Markdown delimiters, example URLs, and descriptions of owner-private credential caches. Token examples introduce one semantic risk by passing bearer credentials through command-line arguments. No evidence found of prompt injection, malicious exfiltration, or unauthorized execution; external CLI implementation was not included.

已扫描文件

631

分析行数

复核项

已忽略误报

已确认安全问题 (1)

中

SKILL.md:373-374 SKILL.md:387

Bearer Credentials Exposed Through Command Arguments

The examples pass minted bearer credentials using --creds "$TOKEN" and --creds "$(astrale token --raw)". Shell expansion places credentials in process arguments, potentially exposing them to process inspection or execution logging while tokens remain valid.

The examples directly expand bearer credentials into argv. Exposure depends on local process visibility and logging; short token lifetimes reduce the exploitation window.

风险因素

⚙️ 外部命令 (50)

🌐 网络访问 (6)

SKILL.md:60 SKILL.md:158 SKILL.md:228 SKILL.md:274 SKILL.md:275 SKILL.md:277

📁 文件系统访问 (2)

SKILL.md:592 SKILL.md:592

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/astrale-os-astrale-cli/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/astrale-os-astrale-cli/security.svg)](https://skillstore.io/skills/astrale-os-astrale-cli?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/astrale-os-astrale-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/astrale-os-astrale-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/astrale-os-astrale-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

astrale-os. (2026). astrale-cli security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/astrale-os-astrale-cli/audits/1

BibTeX 引用

@techreport{astrale-os-astrale-os-astrale-cli-2026,
  author = {astrale-os},
  title = {astrale-cli security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/astrale-os-astrale-cli/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "astrale-cli security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "astrale-os"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/astrale-os-astrale-cli/audits/1"
identifiers:
  - type: other
    value: "skillstore:astrale-os-astrale-cli:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Inspect Application Graph Data

Read nodes, inspect callable schemas, and paginate bounded graph queries on an explicitly selected instance.

Plan Domain Updates

Review installed releases, dependency compatibility, and issuer changes before approving a grouped domain installation.

Configure Local UI Projects

Initialize React and Tailwind CSS projects, search available patterns, and review source changes before adding components.

试试这些提示

Check Connection and Identity

Use astrale-cli to explain read-only connection and identity checks for staging. Do not print tokens or change configuration.

Prepare a Paginated Graph Query

Prepare a bounded query for /:notes.example:class.Note on staging using identity reader. Explain cursor pagination without running mutations.

Review a Mutation Before Execution

Review mutation.v3.json and prepare an Astrale mutation dry run. Explain preconditions and atomicity; require approval before execution.

Plan an Authorized Domain Upgrade

Plan a grouped domain upgrade on staging. Review release pins, compatibility, and issuer consent using an authorized identity; require approval before installation.

最佳实践

Select the instance and least-privileged identity explicitly, and verify current command help before remote operations.
Review dry runs and release pins; approve mutations, issuer changes, root recovery, and destructive uninstalls explicitly.
Prefer identity selection over bearer arguments; keep secret payloads in protected files or stdin, and redact shared diagnostics.

避免

Relying on an ambient active instance or root identity for unattended production changes.
Placing bearer credentials or secret payloads in command arguments, logs, or issue reports.
Treating partial domain inventory or authorization-masked reads as proof that data is missing.

常见问题

What does this skill provide?

It provides an Astrale CLI reference for assistants. It does not include the CLI binary or verify its implementation.

Which assistants can use it?

The marketplace lists Claude, Codex, and Claude Code. Executing commands also requires a local CLI installation and authorized credentials.

Can it deploy domains?

No. The CLI connects to existing Kernels and installs published releases. Building, deploying, and publishing use the separate astrale-domain binary.

Can I inspect changes without applying them?

Mutations support --dry, while calls and UI additions support --dry-run. These previews do not replace permission checks during execution.

How should I handle credentials?

Prefer identity selection. Bearer arguments can expose tokens; use protected files or stdin for secret call payloads and avoid logging credentials.

Why is a domain absent from the installed list?

The list omits built-in, local, and unreadable domains. An absent origin does not prove that the domain is not installed.

开发者详情

作者

astrale-os

许可证

MIT

Skillstore 修订

版本提示

作者未声明版本。

仓库

https://github.com/astrale-os/cli/tree/db2fc39650aa2fbd37e8439804d5e627ac83bcb0/skills/astrale-cli

引用

e406bf64b5db6e514879399e87b346fa7ff7c2fb

维护新鲜度

2026/10/11

使用量

0 次下载 · 0 次浏览

文件结构

📄 SKILL.md

astrale-os 的更多技能

查看全部

📦

astrale-domain

Build and Maintain Astrale Domains

Astrale Domain development spans Schema, authorization, runtime, and deployment, which can become inconsistent. This skill guides focused changes and phased creation with explicit verification boundaries.

编码与开发查看

查看全部

📦