技能 insforge

📦

insforge

Name: insforge
Author: insforge

内容修订 r1 高风险 🔑 环境变量⚙️ 外部命令🌐 网络访问📁 文件系统访问

Build Secure InsForge App Integrations

Building InsForge features requires correct SDK, authentication, storage, AI, and payment patterns. This skill provides focused implementation guidance and production-oriented examples.

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "insforge" from https://skillstore.io/skills/insforge-insforge.md and its manifest at https://skillstore.io/api/skills/insforge-insforge/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/insforge-insforge.md 已签名 manifest GET /api/skills/insforge-insforge/manifest 已签名 lockfile GET /api/skills/insforge-insforge/lockfile

测试它

正在使用“insforge”。 Add email and password authentication to a Next.js application.

预期结果:

A server and browser client structure using InsForge SSR helpers.
Sign-up, sign-in, callback, refresh, and sign-out flow guidance.
Cookie, redirect, error handling, and session security notes.

正在使用“insforge”。 Create a user-owned image upload feature.

预期结果:

An upload workflow that stores both the public URL and object key.
Authentication and storage policy requirements for user ownership.
Download, replacement, and deletion behavior with error states.

正在使用“insforge”。 Add subscription billing with Stripe.

预期结果:

Checkout and customer portal flow guidance.
Required payment table policies and subject ownership rules.
Webhook-based fulfillment and idempotency requirements.

安全审计

高风险

v2 • 2026/8/31 打开版本化报告

Most static findings are scanner noise from Markdown, placeholders, environment configuration, relative links, and documented provider endpoints. Confirmed risks include dynamic URL fetching and outbound email capability. Semantic review found unsafe RAG trust placement, consentless feedback, browser email abuse, unpinned package execution, and payment fulfillment flaws.

已扫描文件

3,958

分析行数

复核项

已忽略误报

已确认安全问题 (6)

高

ai/embeddings-and-rag.md:101-110

Retrieved RAG Content Receives System-Role Authority

The RAG example concatenates retrieved document text into a system message. Malicious document instructions can override application behavior or redirect model output.

The example directly places retrieved document content in a system-role message without trust boundaries or prompt-injection handling.

高

SKILL.md:228

Feedback Submission Lacks Explicit User Consent

The skill directs the agent to report InsForge problems and continue. The feedback command can transmit project-specific titles and details without first showing the payload.

The instruction explicitly says to report issues through a networked CLI and does not require user confirmation before submission.

高

payments/stripe.md:95-103 payments/stripe.md:195-208 payments/razorpay.md:113-120 payments/razorpay.md:240-248

Payment Fulfillment Does Not Validate Purchased Value

Browser-controlled checkout terms are accepted, while webhook fulfillment marks an order paid using only its identifier. A modified request could pay less or select another item.

The checkout examples submit price or amount from browser code, but the fulfillment SQL never compares verified payment values with server-owned order expectations.

高

payments/stripe.md:119-126 payments/stripe.md:232-268 payments/razorpay.md:151-156 payments/razorpay.md:270-301

Subscription Entitlements Ignore the Purchased Plan

Browser code selects a price or plan, but every successful subscription event grants the fixed pro entitlement. A cheaper product could receive higher access.

Both fulfillment functions set plan to pro without checking the verified provider product, price, plan, amount, currency, or expected application purchase.

中

email/sdk-integration.md:24 email/sdk-integration.md:41-57

Authenticated Browser Users Can Send Arbitrary Email

The guide allows any signed-in browser client to send custom HTML email. Applications following this example may expose a spam and billing primitive without role checks.

The guide states that authentication is sufficient and demonstrates sending directly from the same client, with no application authorization or recipient restriction.

中

SKILL.md:17 SKILL.md:27 ai/overview.md:21

Unpinned Packages Are Downloaded and Executed

Setup examples install the latest SDK and run the CLI through npx with automatic confirmation. Upstream compromise or an incompatible release would execute immediately.

The cited commands explicitly use the latest SDK or npx -y without a pinned CLI version.

能力复核项 (3)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中

ai/image-generation.md:73

Fetch API call

const imageResponse = await fetch(imageUrl)

The example fetches a URL supplied by an external model response without validating its scheme or host. A manipulated response could make server-side code request an internal or otherwise unintended resource.

中

email/sdk-integration.md:5

Email sending capability

> **🛑 No SMTP, no third-party packages.** `insforge.emails.send()` works on every paid project — no

The guide explicitly enables outbound email through insforge.emails.send. Sending messages is an external side effect that can incur cost or support abuse if application authorization is weak.

中

email/sdk-integration.md:7

Email sending capability

> **Scope.** This module sends **custom** transactional emails (welcome, receipt, newsletter, alerts

The documented module sends welcome, receipt, newsletter, and alert messages to external recipients. This is a real network capability with spam, privacy, and billing impact.

风险因素

🔑 环境变量 (50)

⚙️ 外部命令 (50)

ai/embeddings-and-rag.md:108-132 ai/image-generation.md:34-50 ai/image-generation.md:50-59 ai/image-generation.md:75-96 database/sdk-integration.md:293-311 payments/razorpay.md:134-139 payments/stripe.md:98-99 payments/stripe.md:99-103 payments/stripe.md:103-110 payments/stripe.md:122-123 payments/stripe.md:123-126 payments/stripe.md:126-133 payments/stripe.md:143-150 realtime/sdk-integration.md:114-139 realtime/sdk-integration.md:200-229 SKILL.md:10 SKILL.md:16-18 SKILL.md:18-22 SKILL.md:22 SKILL.md:26-27 SKILL.md:27 SKILL.md:31-33 SKILL.md:33-35 SKILL.md:35 SKILL.md:37-39 SKILL.md:39-43 SKILL.md:43-45 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:52-54 SKILL.md:54-57 SKILL.md:57-59 SKILL.md:59 SKILL.md:65-72 SKILL.md:72-76 SKILL.md:76-83 SKILL.md:83-87 SKILL.md:87-94 SKILL.md:94-98 SKILL.md:98-105 SKILL.md:105-139 SKILL.md:139-140 SKILL.md:140-141 SKILL.md:141 SKILL.md:142-160 SKILL.md:160-163

🌐 网络访问 (33)

📁 文件系统访问 (28)

审计者: codex 查看审计历史 →

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/insforge-insforge/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/insforge-insforge/security.svg)](https://skillstore.io/skills/insforge-insforge?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/insforge-insforge?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/insforge-insforge/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/insforge-insforge.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

insforge. (2026). insforge security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/insforge-insforge/audits/2

BibTeX 引用

@techreport{insforge-insforge-insforge-2026,
  author = {insforge},
  title = {insforge security audit report (audit version 2)},
  institution = {Skillstore},
  year = {2026},
  number = {2},
  url = {https://skillstore.io/skills/insforge-insforge/audits/2},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "insforge security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
  - name: "insforge"
date-released: "2026-08-31"
url: "https://skillstore.io/skills/insforge-insforge/audits/2"
identifiers:
  - type: other
    value: "skillstore:insforge-insforge:audit:2"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Launch a SaaS Application

Build authentication, database records, uploads, subscriptions, and transactional emails with InsForge services.

Add AI Product Features

Connect OpenRouter models to InsForge storage, vector search, job tracking, and protected application data.

Modernize Existing Integrations

Move existing S3, Stripe, Razorpay, and realtime workflows onto documented InsForge SDK patterns.

试试这些提示

Create a Basic Client

Create an InsForge client for my [framework] application. Use the correct environment variables and explain where each value belongs.

Build Authenticated CRUD

Add sign-in and CRUD for [resource]. Derive ownership from the session, handle errors, and describe the required row-level security.

Implement Paid File Workflows

Build a [Stripe or Razorpay] checkout flow with protected file access. Include webhook fulfillment, storage keys, and user-visible states.

Design a Production RAG System

Design an InsForge RAG pipeline for [content]. Include schema, embeddings, tenant isolation, prompt-injection controls, evaluation, and bounded server processing.

最佳实践

Keep admin and OpenRouter keys in server-only environment variables.
Derive ownership from authenticated sessions and enforce row-level security for every protected table.
Pin dependencies, validate external URLs, and require confirmation before networked administrative actions.

避免

Do not place admin, payment, S3, or OpenRouter secrets in browser bundles.
Do not trust browser-supplied ownership, prices, plan identifiers, or payment status.
Do not fulfill payments from success pages or store temporary media URLs as durable assets.

常见问题

Which InsForge features does this skill cover?

It covers SDK integration for data, auth, storage, functions, AI, realtime, email, Stripe, Razorpay, and S3-compatible tools.

Does this skill manage infrastructure?

No. Use the InsForge CLI workflow for migrations, deployments, secrets, provider configuration, buckets, functions, and schedules.

Can I use it with Next.js SSR?

Yes. The guides cover browser clients, server clients, auth actions, middleware refresh, callbacks, and secure cookie handling.

Can browser code use an InsForge anon key?

Yes. Anon keys support user-scoped clients, but row-level security and authenticated sessions must protect application data.

Does it support AI features?

Yes. It covers OpenRouter chat, images, video, audio, embeddings, model discovery, and RAG with InsForge storage and data.

What must I review before production use?

Review authorization, row-level security, secret placement, package versions, external URL validation, email permissions, payment webhooks, and plan limits.