📦

boost

Name: boost
Author: goldsky-io

内容修订 r1 中风险 ⚙️ 外部命令🌐 网络访问🔑 环境变量

Reduce RPC Provider Calls with Goldsky Boost

Historical blockchain reads can increase RPC provider costs. This skill guides Goldsky Boost setup and cache troubleshooting while keeping your existing upstream provider.

支持: Claude Codex Code(CC)

📊 70 合格

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "boost" from https://skillstore.io/skills/goldsky-io-boost.md and its manifest at https://skillstore.io/api/skills/goldsky-io-boost/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/goldsky-io-boost.md 已签名 manifest GET /api/skills/goldsky-io-boost/manifest 已签名 lockfile GET /api/skills/goldsky-io-boost/lockfile

测试它

正在使用“boost”。 Why do log queries ending at latest always miss the cache?

预期结果:

Block tags always forward to your upstream provider.
For a fixed historical range, use concrete hexadecimal block heights for both bounds.
Repeat the request and inspect cache headers; eligible data can still forward when unavailable.

正在使用“boost”。 My receipt batch has 200 items and reports MISS. Is caching broken?

预期结果:

Batches over 100 items forward without CDN lookups.
Split requests into batches of at most 100 items and assign unique request identifiers.
A mixed batch reports MISS even when some items are served; inspect x-edge-billable for the served-item count.

正在使用“boost”。 Does an organization verification error stop our existing Boost traffic?

预期结果:

The documented verification gate applies to configuration changes, not existing request serving.
Check organization eligibility or contact Goldsky support with your team identifier.
Do not share API keys or provider credentials in chat.

安全审计

中风险

v1 • 2026/9/28 打开版本化报告

All 104 static findings are false positives involving Markdown formatting, intended service URLs, credential placeholders, or provider setup documentation. One semantic finding concerns authentication secrets supplied through CLI arguments, which can expose them locally. No evidence found of prompt injection, malicious execution, or unauthorized exfiltration in the reviewed files.

已扫描文件

323

分析行数

复核项

已忽略误报

已确认安全问题 (1)

中

SKILL.md:157 SKILL.md:167-168 SKILL.md:220

Provider Credentials Exposed Through CLI Arguments

The guide recommends 'provider add --header k:v' for a persistent provider credential. Substituting secrets into command arguments can expose them through shell history and process listings.

Line 220 explicitly recommends CLI header arguments for credentials, while the interactive-input safeguard on line 174 covers only provider connect. Actual exposure depends on execution and host controls.

风险因素

⚙️ 外部命令 (50)

🌐 网络访问 (7)

SKILL.md:23 SKILL.md:51 SKILL.md:60 SKILL.md:196 SKILL.md:222 SKILL.md:271 SKILL.md:272

🔑 环境变量 (1)

SKILL.md:23

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/goldsky-io-boost/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/goldsky-io-boost/security.svg)](https://skillstore.io/skills/goldsky-io-boost?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/goldsky-io-boost?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/goldsky-io-boost/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/goldsky-io-boost.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

goldsky-io. (2026). boost security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/goldsky-io-boost/audits/1

BibTeX 引用

@techreport{goldsky-io-goldsky-io-boost-2026,
  author = {goldsky-io},
  title = {boost security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/goldsky-io-boost/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "boost security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "goldsky-io"
date-released: "2026-09-28"
url: "https://skillstore.io/skills/goldsky-io-boost/audits/1"
identifiers:
  - type: other
    value: "skillstore:goldsky-io-boost:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Reduce Historical Indexing Requests

Plan Boost adoption for Ethereum or Base backfills, using concrete block ranges while retaining an existing provider.

Investigate Cache Misses

Review cache headers, request history, and batch sizes to explain forwarding and identify eligible historical reads.

Connect an Application

Adapt a viem transport and understand authentication, verification, and HTTP subscription boundaries before deployment.

试试这些提示

Understand Boost

Explain whether Goldsky Boost fits our historical Ethereum reads. We want to keep our current RPC provider. Describe prerequisites and limitations.

Plan Provider Setup

Plan Boost setup with QuickNode on Ethereum and Base. Use interactive credential entry, check verification requirements, and request approval before account changes.

Diagnose Forwarded Requests

Our eth_getLogs requests end at latest, and receipt batches contain 200 items. Explain the MISS responses and propose a read-only verification plan.

Review a Production Change

Plan a Boost upstream credential rotation with validation, explicit activation, and rollback. Keep secrets out of chat and command arguments. Require approval before mutations.

最佳实践

Check current CLI help and supported chains before planning changes, and validate the selected upstream against the intended chain.
Use concrete historical block heights, keep batches within 100 items, and interpret served-item counts alongside cache headers.
Keep secrets out of chat, logs, and command arguments; use supported secure credential entry and confirm account changes before execution.

避免

Expecting block tags, state calls, or batches over 100 items to receive CDN caching.
Treating one MISS response or a mixed-batch MISS as proof that Boost cannot serve historical data.
Pasting credentials into chat or treating provider removal and disconnection as harmless diagnostic steps.

常见问题

Does Boost replace my existing RPC provider?

No. Boost serves eligible reads and forwards other requests to your configured provider. Goldsky Edge is the separate managed RPC product.

Does Boost guarantee lower bills?

No. The guide describes Boost as free, but savings depend on served requests, provider pricing, and workload eligibility.

Why does eth_getLogs still forward?

Block-tag bounds always forward. Concrete bounds or a block hash enable eligibility, but unavailable data still forwards.

Can I use WebSocket subscriptions?

No. Boost is HTTP-only. Keep WebSocket subscriptions connected directly to your provider.

Do I need a verified organization?

The guide requires verification for enabling Boost and most configuration changes. Reading configuration and serving existing traffic do not require verification.

How should I provide credentials?

Never paste credentials into chat. Use the interactive prompt for provider connect and a supported secure input method for other secrets.