技能 migrating-motoko-actors

📦

migrating-motoko-actors

Name: migrating-motoko-actors
Author: caffeinelabs

v0.2.6 内容修订 r1 安全 ⚙️ 外部命令🌐 网络访问📁 文件系统访问

Migrate Motoko Actors With Enhanced Migration Chains

Motoko canister upgrades can fail or lose data when state changes do not match migration inputs and outputs. This skill guides compatible changes, self-contained migrations, and validation for enhanced migration chains.

支持: Claude Codex Code(CC)

🥈 80 白银

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "migrating-motoko-actors" from https://skillstore.io/skills/caffeinelabs-migrating-motoko-actors.md and its manifest at https://skillstore.io/api/skills/caffeinelabs-migrating-motoko-actors/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/caffeinelabs-migrating-motoko-actors.md 已签名 manifest GET /api/skills/caffeinelabs-migrating-motoko-actors/manifest 已签名 lockfile GET /api/skills/caffeinelabs-migrating-motoko-actors/lockfile

测试它

正在使用“migrating-motoko-actors”。 An enhanced migration project adds an optional assignee field to every stored task.

预期结果:

Use an explicit migration that preserves existing task values and initializes each assignee as absent. Extend the pending migration if one already exists.

正在使用“migrating-motoko-actors”。 A canister changes a stable numeric field from Nat to Int.

预期结果:

This is usually a stable-compatible widening and does not need an explicit migration. Confirm the deployed signature and run the compatibility check.

正在使用“migrating-motoko-actors”。 A canister renames artist to artists and changes the value from text to a set.

预期结果:

Transform the old text value into a single-item set for the renamed field. Inline both state types and preserve all unrelated fields.

安全审计

安全

v1 • 2026/10/2 打开版本化报告

All 77 static findings are false positives involving Markdown formatting, legitimate mops validation commands, official documentation links, and Motoko type notation. The relative import example explicitly prohibits project imports rather than performing path traversal. No evidence found of prompt injection, credential access, unauthorized data transmission, or malicious migration intent in the two reviewed files.

已扫描文件

397

分析行数

复核项

已忽略误报

风险因素

⚙️ 外部命令 (50)

🌐 网络访问 (2)

SKILL.md:276 SKILL.md:277

📁 文件系统访问 (1)

SKILL.md:43

最新一次完成的静态与语义审计未检测到已确认的安全发现。这并不能证明该 Skill 没有副作用。

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/caffeinelabs-migrating-motoko-actors/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/caffeinelabs-migrating-motoko-actors/security.svg)](https://skillstore.io/skills/caffeinelabs-migrating-motoko-actors?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/caffeinelabs-migrating-motoko-actors?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caffeinelabs-migrating-motoko-actors/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/caffeinelabs-migrating-motoko-actors.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

caffeinelabs. (2026). migrating-motoko-actors security audit report (audit version 1) [Author version 0.2.6]. Skillstore. https://skillstore.io/skills/caffeinelabs-migrating-motoko-actors/audits/1

BibTeX 引用

@techreport{caffeinelabs-caffeinelabs-migrating-motoko-actors-2026,
  author = {caffeinelabs},
  title = {migrating-motoko-actors security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/caffeinelabs-migrating-motoko-actors/audits/1},
  note = {Author version 0.2.6}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "migrating-motoko-actors security audit report (audit version 1)"
version: "0.2.6"
type: report
authors:
  - name: "caffeinelabs"
date-released: "2026-10-02"
url: "https://skillstore.io/skills/caffeinelabs-migrating-motoko-actors/audits/1"
identifiers:
  - type: other
    value: "skillstore:caffeinelabs-migrating-motoko-actors:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

100

可维护性

内容

社区

规范符合性

你能构建什么

Understand stable state changes

Classify proposed field changes and identify when an enhanced migration file is necessary.

Write a migration module

Draft self-contained state transformations while preserving unchanged fields and using the existing pending migration.

Review upgrade readiness

Check chain ordering, deployed signatures, intentional data removal, and validation steps before releasing an upgrade.

试试这些提示

Classify a state change

My project uses enhanced Motoko migrations. Classify these stable field changes as implicit or explicit: [changes]. Explain each decision.

Plan a new field

Add this stable field in my enhanced migration project: [field and type]. Review [existing chain] and propose initialization without modifying applied migrations.

Transform stored records

Using [old fields], [new fields], and [business rules], draft a self-contained Motoko migration. Preserve unchanged state and explain every default and discarded field.

Audit an upgrade plan

Review [migration plan], [deployed signature], and [mops configuration]. Check stable compatibility, chain ordering, pending limits, fresh installation, and data preservation. Propose validation steps.

最佳实践

Derive old state from the preceding migration; use empty state only for a new chain, not a legacy conversion.
Keep applied migrations unchanged and fold new work into the pending file.
Run compatibility checks before building and test the upgrade with representative state.

避免

Do not add a migration for a stable-compatible change or an identity transformation.
Do not apply the enhanced-chain initializer rules to plain actors without a migration chain.
Do not import project types into frozen migration files or discard fields unintentionally.

常见问题

When is an explicit migration required?

In enhanced migration projects, use one for renamed, removed, narrowed, transformed, or newly added stable fields.

Can I change field mutability without a migration?

Yes. Changing var to let, or the reverse, is usually stable-compatible.

Where should migration files live?

Read the chain directory in mops.toml. The default location in this guide is src/backend/migrations/.

Why must migration types be inlined?

Project type imports can change and invalidate historical transformations. Inline old and new types; core and mops package imports are permitted.

How do I initialize a new stable field?

Under enhanced migration, declare its type in the actor and supply its value from the migration output. Plain actors follow different initialization rules.

Does this skill deploy my canister?

It does not include a deployment script. It guides migration authoring, compatibility checks, and builds; deployment still requires your project workflow.