技能 astrale-domain

📦

astrale-domain

Name: astrale-domain
Author: astrale-os

内容修订 r1 安全 📁 文件系统访问🌐 网络访问⚙️ 外部命令

Build and Maintain Astrale Domains

Astrale Domain development spans Schema, authorization, runtime, and deployment, which can become inconsistent. This skill guides focused changes and phased creation with explicit verification boundaries.

支持: Claude Codex Code(CC)

📊 76 合格

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "astrale-domain" from https://skillstore.io/skills/astrale-os-astrale-domain.md and its manifest at https://skillstore.io/api/skills/astrale-os-astrale-domain/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/astrale-os-astrale-domain.md 已签名 manifest GET /api/skills/astrale-os-astrale-domain/manifest 已签名 lockfile GET /api/skills/astrale-os-astrale-domain/lockfile

测试它

正在使用“astrale-domain”。 Review a proposed Issue.close callable.

预期结果:

Declare the callable input, output, authentication mode, and Policy in Schema.
Implement the admitted operation as a Workflow with named read and mutation steps.
Guard the state transition atomically rather than trusting the earlier read.
Test an allowed call, a Policy refusal, and a stale-state refusal.

正在使用“astrale-domain”。 Plan an upgrade where employees depends on agencies.

预期结果:

Rebuild employees against the candidate agencies Schema revision.
Deploy both candidates and verify their served release metadata.
Install both as explicit roots in one grouped operation after approval.
Inspect installed revisions and retained behavior; preserve operation identity if the outcome is unknown.

正在使用“astrale-domain”。 Diagnose a callable that works as Root but fails for a user.

预期结果:

Confirm the installed release, callable key, and registered caller identity.
Inspect the authenticated principal ceiling separately from caller Policy admission.
Verify the intended caller or self session and exact Domain requirements.
Repeat allowed and refused calls, then independently verify that refusal caused no effects.

安全审计

安全

v1 • 2026/10/10 打开版本化报告

All 61 static findings are false positives in their documented context, including Markdown backticks, public discovery paths, and authorized deployment examples. Secret references configure deployment environments, and identity guidance explicitly prohibits private-key disclosure and unauthorized registration. No evidence found of prompt injection, credential exfiltration, or malicious intent in the reviewed files.

已扫描文件

1,978

分析行数

复核项

已忽略误报

风险因素

最新一次完成的静态与语义审计未检测到已确认的安全发现。这并不能证明该 Skill 没有副作用。

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/astrale-os-astrale-domain/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/astrale-os-astrale-domain/security.svg)](https://skillstore.io/skills/astrale-os-astrale-domain?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/astrale-os-astrale-domain?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/astrale-os-astrale-domain/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/astrale-os-astrale-domain.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

astrale-os. (2026). astrale-domain security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/astrale-os-astrale-domain/audits/1

BibTeX 引用

@techreport{astrale-os-astrale-os-astrale-domain-2026,
  author = {astrale-os},
  title = {astrale-domain security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/astrale-os-astrale-domain/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "astrale-domain security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "astrale-os"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/astrale-os-astrale-domain/audits/1"
identifiers:
  - type: other
    value: "skillstore:astrale-os-astrale-domain:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Create a Business Domain

Guide an application developer through project inspection, Schema design, callable implementation, sample data, and verification.

Review Authorization Boundaries

Help a security engineer examine callable admission, caller and principal authority, group membership, and refusal evidence.

Qualify a Coordinated Release

Help a release engineer plan coherent dependency upgrades, grouped installs, rollback constraints, and installed-behavior checks.

试试这些提示

Inspect an Existing Domain

Inspect this Astrale Domain project. Identify its Schema, runtime, environments, and verification commands. Explain missing prerequisites without deploying or changing secrets.

Add a Protected Callable

Add [operation] to [Class] using the installed SDK. Declare Schema-owned authorization and runtime behavior. Add allowed and refused tests without deploying.

Implement an External Integration

Implement [provider operation] through an Integration and Provider. Keep secrets environment-owned. Validate responses and test effects and failure behavior without claiming exactly-once delivery.

Plan a Dependency Migration

Plan [Schema change] across affected Domains. Inspect installed revisions, design staged data migration, and specify grouped installs and rollback checks. Require approval before mutations.

最佳实践

Inspect current source and installed public SDK exports before choosing API syntax.
Keep authorization in Schema, secrets in deployment environments, and tests focused on allowed and refused behavior.
Verify build, served release, installed revision, and live invocation separately before reporting deployment success.

避免

Do not weaken authentication or add handler authorization substitutes to make a failing test pass.
Do not put secrets in Schema, logs, test snapshots, source files, or command arguments.
Do not install coherent dependencies sequentially or treat deployment as installation.

常见问题

What does this skill provide?

It provides task-routed guidance for Astrale Domain authoring, authorization, runtime, Views, testing, migration, deployment, and debugging.

Which AI tools are supported?

The marketplace lists Claude, Codex, and Claude Code. Project execution still depends on your installed Astrale tools and permissions.

Does it include the Astrale SDK or CLI?

No. It contains Markdown instructions and references. Install compatible public SDK, CLI, and adapter packages for implementation and live verification.

Does deployment update an instance?

No. Deployment creates a release endpoint. Installation separately changes the release pinned on the chosen instance.

How should secrets be handled?

Keep secrets in their owning deployment environment. Avoid source, logs, test evidence, and command arguments. Use private files or secret-manager input.

Can it guarantee safe migrations or exactly-once delivery?

No. Migration support depends on public SDK contracts, and the inline Workflow runner does not provide durable replay or exactly-once execution.