技能 executor-discovery

📦

executor-discovery

Name: executor-discovery
Author: atri10

内容修订 r1 安全 ⚙️ 外部命令🌐 网络访问📁 文件系统访问

Clarify Initiatives and Compare Approaches

Unclear requirements and unsupported assumptions make technical decisions difficult. This skill guides structured discovery, evidence gathering, and approach comparisons before human approval.

支持: Claude Codex Code(CC)

🥉 77 青铜

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "executor-discovery" from https://skillstore.io/skills/atri10-executor-discovery.md and its manifest at https://skillstore.io/api/skills/atri10-executor-discovery/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/atri10-executor-discovery.md 已签名 manifest GET /api/skills/atri10-executor-discovery/manifest 已签名 lockfile GET /api/skills/atri10-executor-discovery/lockfile

测试它

正在使用“executor-discovery”。 Compare approaches for an approved tenant-placement initiative with an unresolved scalability claim.

预期结果:

Research separates cited scalability claims from measurements and lists the missing benchmark.
Two approaches are compared on effort, operational risk, migration cost, and reversibility.
The recommendation states the tenant threshold that would change it and awaits the human choice.

正在使用“executor-discovery”。 A request includes billing changes and an independently shipped reporting service.

预期结果:

Scope review identifies independent deliverables and recommends separate initiatives with a declared dependency.
Initiative creation is handed to the intake workflow instead of scaffolding folders during discovery.
Detailed discovery continues on the first initiative after the split is agreed.

正在使用“executor-discovery”。 Compare dashboard layouts after the user accepts the visual companion.

预期结果:

The visual session shows synthetic examples and records layout selections.
Terminal feedback remains the primary decision input.
The final layout choice is recorded in the options document before advancing.

安全审计

安全

v1 • 2026/10/5 打开版本化报告

Of 130 static findings, 129 concern Markdown syntax, fixed relative references, or legitimate workflow operations. One confirmed risk concerns binding the visual server to all interfaces, exposing token-protected HTTP beyond localhost. No evidence found of prompt injection or deliberate exfiltration; referenced scripts are absent from the reviewed files, so their implementations remain unverified.

已扫描文件

875

分析行数

复核项

已忽略误报

能力复核项 (1)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中

visual-companion.md:179

Hardcoded IP address

--host 0.0.0.0 \

Binding to 0.0.0.0 exposes the visual server on every IPv4 interface. The documented HTTP URL lacks transport encryption; token authentication mitigates but does not eliminate exposure.

风险因素

⚙️ 外部命令 (50)

🌐 网络访问 (3)

SKILL.md:184 visual-companion.md:93 visual-companion.md:179

📁 文件系统访问 (31)

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/atri10-executor-discovery/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/atri10-executor-discovery/security.svg)](https://skillstore.io/skills/atri10-executor-discovery?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/atri10-executor-discovery?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/atri10-executor-discovery/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/atri10-executor-discovery.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

atri10. (2026). executor-discovery security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/atri10-executor-discovery/audits/1

BibTeX 引用

@techreport{atri10-atri10-executor-discovery-2026,
  author = {atri10},
  title = {executor-discovery security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/atri10-executor-discovery/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "executor-discovery security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "atri10"
date-released: "2026-10-05"
url: "https://skillstore.io/skills/atri10-executor-discovery/audits/1"
identifiers:
  - type: other
    value: "skillstore:atri10-executor-discovery:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Resolve an Unclear Feature Request

Clarify an approved feature initiative, define exclusions, and compare realistic approaches before requesting stakeholder approval.

Evaluate a Technical Approach

Gather evidence for a migration or performance decision and compare alternatives with explicit uncertainty and reversal costs.

Compare Interface Concepts

Use consent-based visual mockups with synthetic content to compare layouts and connect feedback to the discovery decision.

试试这些提示

Clarify an Initiative

Review the approved charter for [initiative]. Summarize repository facts, then ask one question about unresolved purpose, constraints, or success criteria.

Check Scope Boundaries

Assess [initiative] for independent deliverables. Explain whether it needs separate initiatives or multiple specifications, and ask one question about any unresolved boundary.

Build an Evidence-Based Comparison

For [initiative], document unsupported claims with evidence labels. Compare two or three approaches using identical axes, reversal costs, and recommendation-changing conditions.

Review a Visual Decision Record

For [initiative], check consent before proposing visual comparisons. Use synthetic data, preserve terminal feedback as primary, and reconcile the session decision with the options document.

最佳实践

Read the approved charter and repository evidence before asking questions.
Label every claim honestly and state what evidence would change the recommendation.
Use synthetic mockup data, keep credentials outside tracked artifacts, and prefer loopback connections for visual sessions.

避免

Starting implementation before the human approves an approach.
Calling cited claims measured or omitting evidence gaps.
Putting real customer data or credentials in tracked visual artifacts.

常见问题

When should I use this skill?

Use it after charter approval when scope, requirements, or the right approach remains unclear.

Does this skill write production code?

No. It produces discovery records and comparisons; measurement probes must be documented as throwaway evidence.

What documents does discovery produce?

It produces RSCH research documents when evidence is needed and OPTS options documents for decisions with alternatives.

Who chooses the final approach?

The human chooses. The skill records that choice and updates the discovery phase before handing off to architecture.

Are browser mockups required?

No. The visual companion is optional, offered for genuinely visual questions, and requires explicit consent.

Can the visual companion run remotely?

The guide shows non-loopback binding, which increases exposure. Prefer authenticated forwarding and encrypted connections; never display real customer data or credentials.