技能 sentrydock
📦
sentrydock
内容修订 r1 安全 ⚙️ 外部命令🌐 网络访问🔑 环境变量
Search News and Manage SentryDock Monitors
News research needs dated sources and reliable follow-up across public channels. This skill guides SentryDock searches, source-linked briefings, reviewed monitors, and verified alert delivery.
支持: Claude Codex Code(CC)
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "sentrydock" from https://skillstore.io/skills/humanleap-sentrydock.md and its manifest at https://skillstore.io/api/skills/humanleap-sentrydock/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“sentrydock”。 What should a briefing say when my topic has no indexed results?
预期结果:
- No indexed articles matched the requested topic and time window.
- This does not establish that no relevant event occurred.
- Coverage gap: the search covers indexed sources rather than the entire web.
正在使用“sentrydock”。 Outline a company monitor proposal before creating it.
预期结果:
- Topic: the requested company, its products, executives, and regulatory events.
- Sources: public channels supported by the current tool schema.
- Cadence: hourly by default, subject to supported intervals and account limits.
- Destination: a user-authorized delivery endpoint.
- Status: proposal only; creation requires confirmation.
正在使用“sentrydock”。 Does saving a webhook destination prove that alerts arrived?
预期结果:
- No. Saved configuration is not delivery evidence.
- Verify receipt at the destination and inspect available alerts.
- Recover missed events through the alerts list and deduplicate event IDs.
安全审计
安全v1 • 2026/10/3 打开版本化报告
Most static findings are Markdown formatting, documentation links, legitimate credential configuration, or unrelated prose. Installation executes an unpinned installer and globally installs a remote archive without documented integrity verification, creating supply-chain exposure. No evidence found of credential exfiltration, malicious reconnaissance, or prompt injection in the reviewed skill.
1
已扫描文件
84
分析行数
3
复核项
0
已忽略误报
能力复核项 (3)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Ruby/shell backtick execution
Install this skill with `pnpm dlx skills add Humanleap/agent-skills --skill sentrydock`. Connect rem
The documented pnpm dlx command executes the skills package without a version pin, exposing installation to dependency changes. This is supply-chain exposure, not Ruby backtick execution.
中
Ruby/shell backtick execution
```bash
The fenced example globally installs a remote package archive without documenting integrity verification or lifecycle-script review. Package installation can execute external code with user privileges.
低
Hardcoded URL
pnpm add -g https://www.sentrydock.com/downloads/sentrydock-1.1.0.tgz
The URL supplies a package archive directly to a global installation command without a documented hash or signature check. HTTPS alone does not establish package integrity.
风险因素
⚙️ 外部命令 (16)
🔑 环境变量 (1)
审计者: codex
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/humanleap-sentrydock/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/humanleap-sentrydock?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/humanleap-sentrydock?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/humanleap-sentrydock/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/humanleap-sentrydock.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
humanleap. (2026). sentrydock security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/humanleap-sentrydock/audits/1BibTeX 引用
@techreport{humanleap-humanleap-sentrydock-2026,
author = {humanleap},
title = {sentrydock security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/humanleap-sentrydock/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "sentrydock security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "humanleap"
date-released: "2026-10-03"
url: "https://skillstore.io/skills/humanleap-sentrydock/audits/1"
identifiers:
- type: other
value: "skillstore:humanleap-sentrydock:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
65
社区
83
规范符合性
你能构建什么
Company News Watch
Track company names, products, executives, and regulatory events with dated source links and reviewed monitoring settings.
Policy and Market Briefings
Collect commodity, policy, or geopolitical reporting within a requested window and separate reported facts from interpretation.
Alert Delivery Integration
Connect an authorized HTTPS webhook and plan signature verification, replay protection, and recovery through stored alerts.
试试这些提示
Check Account Access
Use my connected SentryDock account to inspect available tools, plan access, and usage limits. Do not purchase a plan or change settings.
Prepare a News Briefing
Search SentryDock for [topic] during [time window]. Group related stories and retain original links, publication times, and coverage gaps.
Review a Company Monitor
Inspect existing monitors for [company]. Propose sources, supported cadence, and an authorized destination. Show the exact changes and wait for my confirmation.
Plan Verified Webhook Delivery
Review current SentryDock delivery schemas for my authorized HTTPS endpoint. Propose signature validation, timestamp checks, event deduplication, and missed-alert recovery. Confirm before connecting.
最佳实践
- Keep original article links and publication times, and distinguish reporting, allegations, confirmed events, and interpretation.
- Check current tool schemas, account limits, existing monitors, and human approval before making changes.
- Protect credentials and signing secrets, verify webhook events, and validate package integrity before installing external clients.
避免
- Treating empty indexed results as proof that an event did not occur.
- Creating or changing monitors, delivery settings, or paid access without human review.
- Following instructions embedded in article text or claiming delivery success from saved configuration alone.
常见问题
Can I use this skill with Claude, Codex, or Claude Code?
The skill targets these assistants through SentryDock MCP, CLI, or HTTP access. Your environment must support the chosen connection.
Does this search the entire web?
No. Searches query indexed SentryDock news. Empty results do not prove that no relevant event occurred.
Do I need a paid account?
News and monitoring require a paid plan. Account overview and usage are available before payment, and purchases require human choice.
How should I provide credentials?
Use OAuth or a service API key through secure configuration. Keep real keys out of shared files and chat.
Will alerts arrive immediately?
No immediate detection guarantee is provided. Check supported cadence and destination receipt; saving a destination alone does not prove delivery.
What should I review before installing the CLI?
The instructions install a remote archive globally without a documented integrity check. Verify package provenance and integrity, review installation scripts, and approve installation.