技能 executor

📦

executor

Name: executor
Author: atri10

内容修订 r1 高风险 ⚙️ 外部命令📁 文件系统访问🔑 环境变量⚡ 包含脚本🌐 网络访问

Coordinate Coding Initiatives with Executor

Long coding projects lose context, decisions, and review evidence across sessions. Executor records initiative state and coordinates phase routing, task dispatch, and approval gates.

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "executor" from https://skillstore.io/skills/atri10-executor.md and its manifest at https://skillstore.io/api/skills/atri10-executor/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/atri10-executor.md 已签名 manifest GET /api/skills/atri10-executor/manifest 已签名 lockfile GET /api/skills/atri10-executor/lockfile

测试它

正在使用“executor”。 Resume the initiative after its planning session.

预期结果:

Current phase: planning.
Last recorded event: the plan was drafted; execution mode remains undecided.
Next action: present the recorded options for human approval before dispatching implementation.

正在使用“executor”。 Check whether the plan is ready for handoff.

预期结果:

Handoff is blocked.
A completed task has no clean review verdict.
Record the missing review and verify the cumulative final-review range before requesting handoff approval.

正在使用“executor”。 Scan initiative artifacts without exposing credentials.

预期结果:

Credential-shaped content was detected in an artifact.
The scan reports the file, line, and credential category without printing its value.
Handoff remains blocked until the human resolves the finding and rotates committed credentials where necessary.

安全审计

高风险

v1 • 2026/10/5 打开版本化报告

Reviewed all 400 presented findings; most are documentation, secret-hygiene checks, or scoped local tooling. Confirmed shell injection and identified unsafe rollback guidance, empty final-review ranges, untrusted prompt content, and plaintext remote authentication. No evidence found of intentional exfiltration; 1,468 omitted static matches still require manual review before publication. Static review was capped at 400/1868 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

已扫描文件

12,235

分析行数

复核项

已忽略误报

已确认安全问题 (5)

高

scripts/visual-companion/server.cjs:496

Environment file access

try { cp.exec(process.env.BRAINSTORM_OPEN_CMD + ' ' + JSON.stringify(url), () => {}); } catch (e) {

The custom launcher passes a URL to a shell using JSON.stringify, which leaves shell substitutions active. A crafted URL hostname can execute commands.

高

scripts/exec-dispatch:161-171

Final Review Can Inspect an Empty Commit Range

Without an explicit base, final review defaults both revisions to the current HEAD. The required whole-branch review can therefore omit every implementation change.

The script never initializes plan_branch, so the normal fallback selects HEAD for both revisions. It then dispatches a final reviewer with that range.

高

scripts/exec-dispatch:124-135 scripts/exec-prompt:149-170

Review Findings Enter Worker Instructions Without a Trust Boundary

Review findings are inserted verbatim into worker prompts. A manipulated verdict can supply behavioral instructions instead of evidence unless the worker preserves instruction hierarchy.

The dispatcher copies editable verdict prose into FINDINGS, and the renderer inserts replacement text unchanged. No evidence found of an embedded attack payload.

中

SKILL.md:253-257

Recovery Guidance Can Discard Uncommitted User Work

Drift Recovery recommends "git checkout -- <paths>" for uncommitted edits without requiring approval or isolating agent-owned changes. Mixed user edits can be lost.

The recovery instruction explicitly recommends reverting paths without an ownership check. A broader destructive-action stop exists, but this recovery step omits it.

中

scripts/visual-companion/start-server.sh:12-14 scripts/visual-companion/server.cjs:243-244 scripts/visual-companion/helper.js:32-35

Remote Companion Authentication Uses Plaintext Transport

Non-loopback binding is supported, but companion HTTP and WebSocket URLs use plaintext transport. Direct remote access exposes session keys and screen data to interception.

The displayed session URL uses http and the browser connection uses ws. Loopback is the default, but direct remote binding has no transport encryption.

能力复核项 (4)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高

scripts/visual-companion/server.cjs:496

Process exec

try { cp.exec(process.env.BRAINSTORM_OPEN_CMD + ' ' + JSON.stringify(url), () => {}); } catch (e) {

The custom launcher passes a URL to a shell using JSON.stringify, which leaves shell substitutions active. A crafted URL hostname can execute commands.

高

scripts/exec-graph:157

Ruby/PHP system() call

stray=$(awk -F'|' '/^\|[ \t]*INIT-[0-9]+-P[0-9]+/ { c=$8; gsub(/[ `]/,"",c); gsub(/\/$/,"",c); if (c

An editable registry cell is concatenated into awk system() without shell quoting. Shell metacharacters in that cell can execute arbitrary local commands.

低

scripts/visual-companion/server.cjs:496

Environment variable access (dot notation)

try { cp.exec(process.env.BRAINSTORM_OPEN_CMD + ' ' + JSON.stringify(url), () => {}); } catch (e) {

The custom launcher passes a URL to a shell using JSON.stringify, which leaves shell substitutions active. A crafted URL hostname can execute commands.

低

scripts/visual-companion/server.cjs:496

Environment variable object

try { cp.exec(process.env.BRAINSTORM_OPEN_CMD + ' ' + JSON.stringify(url), () => {}); } catch (e) {

The custom launcher passes a URL to a shell using JSON.stringify, which leaves shell substitutions active. A crafted URL hostname can execute commands.

风险因素

⚙️ 外部命令 (50)

author-prompt.md:46-58 author-prompt.md:58-82 author-prompt.md:82-86 author-prompt.md:86-89 author-prompt.md:89-94 author-prompt.md:94 author-prompt.md:98-100 author-prompt.md:100-105 author-prompt.md:105-116 author-prompt.md:116-121 author-prompt.md:121-122 author-prompt.md:122-130 author-prompt.md:130-131 author-prompt.md:131-134 author-prompt.md:134-144 author-prompt.md:144-150 author-prompt.md:150-159 author-prompt.md:159-168 author-prompt.md:168 author-prompt.md:171-174 author-prompt.md:174-183 author-prompt.md:183-184 author-prompt.md:184 author-prompt.md:185-186 author-prompt.md:186 author-prompt.md:187-188 author-prompt.md:188-189 author-prompt.md:189 decide-prompt.md:51-55 decide-prompt.md:55-57 decide-prompt.md:57-61 decide-prompt.md:61 decide-prompt.md:117-118 decide-prompt.md:118-123 decide-prompt.md:123-131 decide-prompt.md:131-132 decide-prompt.md:132-133 decide-prompt.md:133-160 decide-prompt.md:160-161 decide-prompt.md:161 decide-prompt.md:177-180 decide-prompt.md:180-190 decide-prompt.md:198 decide-prompt.md:210-211 decide-prompt.md:211-214 decide-prompt.md:214-222 decide-prompt.md:222 decide-prompt.md:227-231 references/frontmatter.md:230-231 references/indexes.md:16-17

📁 文件系统访问 (50)

🔑 环境变量 (32)

⚡ 包含脚本 (2)

scripts/visual-companion/helper.js:70 scripts/visual-companion/server.cjs:496

🌐 网络访问 (8)

scripts/visual-companion/helper.js:80 scripts/visual-companion/server.cjs:101 scripts/visual-companion/server.cjs:102 scripts/visual-companion/server.cjs:490 scripts/visual-companion/start-server.sh:12 scripts/visual-companion/start-server.sh:13 scripts/visual-companion/start-server.sh:27 scripts/visual-companion/start-server.sh:82

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/atri10-executor/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/atri10-executor/security.svg)](https://skillstore.io/skills/atri10-executor?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/atri10-executor?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/atri10-executor/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/atri10-executor.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

atri10. (2026). executor security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/atri10-executor/audits/1

BibTeX 引用

@techreport{atri10-atri10-executor-2026,
  author = {atri10},
  title = {executor security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/atri10-executor/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "executor security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "atri10"
date-released: "2026-10-05"
url: "https://skillstore.io/skills/atri10-executor/audits/1"
identifiers:
  - type: other
    value: "skillstore:atri10-executor:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Resume a Multi-Component Feature

Recover the recorded initiative phase, outstanding tasks, and required approvals before continuing a feature across sessions.

Coordinate Reviewed Migration Work

Organize migration requirements, task branches, review rounds, and decision records within one initiative.

Inspect Initiative Readiness

Check recorded phase gates, artifact references, task outcomes, and verification evidence before preparing a handoff.

试试这些提示

Choose the Right Workflow

Assess whether [request] needs an Executor initiative. Identify its lasting deliverable and suggest the appropriate starting phase without changing files.

Resume an Initiative

Inspect the repository and recorded indexes for [initiative ID]. Report the current phase, last recorded event, and next required approval.

Prepare a Reviewed Plan

Check the artifacts for [initiative ID] before planning. Identify missing specifications, unresolved decisions, and required plan-regression checks before any task dispatch.

Coordinate an Approved Execution

Coordinate [approved plan path] using registered workers and recorded rulings. Preserve user edits and stop for destructive operations, security-sensitive actions, or missing approvals.

最佳实践

Read current repository state and recorded indexes before resuming an initiative.
Use registered scripts for identifiers and transitions, and obtain explicit approval at phase boundaries.
Use synthetic mockup data, review the security concerns, and scan both artifact stores before handoff.

避免

Creating initiative records for questions, typos, or other work without a lasting deliverable.
Treating generated artifacts, recorded approvals, or a secret scan as proof that unattended execution is safe.
Discarding uncommitted edits, exposing the companion directly over plaintext networks, or accepting untrusted prompt instructions.

常见问题

What is an Executor initiative?

An initiative groups a lasting coding deliverable with its identifiers, phase records, design documents, plans, and execution evidence.

Should I use it for a small fix?

Not for a typo, one-line fix, or question. Use it when the work needs durable planning and review records.

Does this package include every phase skill?

No. The router and dispatch registry reference additional Executor phase skills and worker templates that must be available separately.

How does session recovery work?

Repository state, initiative indexes, execution records, and worker heartbeat files identify the recorded phase and appropriate next action.

Can I commit the execution records?

The execution store is ignored by default. Commit it only after explicit user approval and a review for secrets and personal data.

Is unattended execution cleared by this audit?

No. Command-injection risks, review integrity concerns, and omitted static matches require remediation or manual review before relying on unattended execution.