技能 momentic-maintain
📦

momentic-maintain

内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量

Maintain and Repair Momentic Tests

Failing Momentic tests can hide the earliest broken state and waste repair time. This skill investigates evidence, classifies causes, and guides verified repairs.

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "momentic-maintain" from https://skillstore.io/skills/momentic-ai-momentic-maintain.md and its manifest at https://skillstore.io/api/skills/momentic-ai-momentic-maintain/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/momentic-ai-momentic-maintain.md 已签名 manifest GET /api/skills/momentic-ai-momentic-maintain/manifest 已签名 lockfile GET /api/skills/momentic-ai-momentic-maintain/lockfile

测试它

正在使用“momentic-maintain”。 Why did run 7f2 fail after the setup module passed?

预期结果:

The setup module ended on the parent page instead of the editor. The later title step failed because its required field never appeared.

正在使用“momentic-maintain”。 Which quarantined test should we repair first?

预期结果:

  • Prioritize checkout-address because three recent runs failed at the same locator before recovery.
  • Review the failed child step, tighten the locator, and replay the test before removing quarantine.

正在使用“momentic-maintain”。 Can this timeout be fixed by increasing the wait?

预期结果:

The evidence shows a slow application response, not an unstable test action. Classify it as infrastructure and keep the assertion unchanged.

安全审计

高风险
v1 • 2026/8/22 打开版本化报告

Most static alerts are false positives caused by Markdown backticks, documentation examples, and test-run inspection language. Two API examples can disclose MOMENTIC_API_KEY when MOMENTIC_SERVER is untrusted. Unpinned npx execution and temporary storage of sensitive artifacts also require safeguards.

1
已扫描文件
499
分析行数
4
复核项
0
已忽略误报

已确认安全问题 (2)

高
SKILL.md:51-56SKILL.md:301-306
Credential Forwarding to Configurable Server
The examples send MOMENTIC_API_KEY to MOMENTIC_SERVER without validating the destination. A poisoned environment variable could redirect the bearer token to an attacker-controlled host.
Both command blocks combine a secret-bearing Authorization header with an environment-controlled base URL. The data flow is explicit in adjacent lines.
中
SKILL.md:151-155SKILL.md:211-220SKILL.md:236-251SKILL.md:276-282
Unpinned Package Execution Through npx
The workflow repeatedly executes npx momentic without a pinned package version. Package resolution may run newly downloaded or project-local code before classification or repository edits.
The commands explicitly use npx without a version in several executable examples. Resolution behavior depends on the local project and package registry state.
能力复核项 (4)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高
SKILL.md:55
Generic API/secret keys
-H "Authorization: Bearer ${MOMENTIC_API_KEY:?Set MOMENTIC_API_KEY}" \
The command places MOMENTIC_API_KEY in an Authorization header sent to a URL controlled by MOMENTIC_SERVER. An untrusted override could receive the bearer token.
高
SKILL.md:305
Generic API/secret keys
-H "Authorization: Bearer ${MOMENTIC_API_KEY:?Set MOMENTIC_API_KEY}" \
The command places MOMENTIC_API_KEY in an Authorization header sent to a URL controlled by MOMENTIC_SERVER. An untrusted override could receive the bearer token.
低
SKILL.md:52
Temp file creation
RUN_INSPECTION_DIR="$(mktemp -d)"
The command creates a temporary directory for sensitive run metadata or artifacts. The document requests manual removal but provides no automatic cleanup on failure or interruption.
低
SKILL.md:302
Temp file creation
RUN_INSPECTION_DIR="$(mktemp -d)"
The command creates a temporary directory for sensitive run metadata or artifacts. The document requests manual removal but provides no automatic cleanup on failure or interruption.

风险因素

⚙️ 外部命令 (50)
SKILL.md:15 SKILL.md:16 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:30 SKILL.md:31 SKILL.md:32 SKILL.md:49-68 SKILL.md:68-75 SKILL.md:75-82 SKILL.md:82-87 SKILL.md:87-88 SKILL.md:88-90 SKILL.md:90-91 SKILL.md:91-92 SKILL.md:92-94 SKILL.md:94-97 SKILL.md:97-98 SKILL.md:98-99 SKILL.md:99-102 SKILL.md:102-106 SKILL.md:106-108 SKILL.md:108-115 SKILL.md:115 SKILL.md:131-144 SKILL.md:144-151 SKILL.md:151-155 SKILL.md:155-157 SKILL.md:157 SKILL.md:160-162 SKILL.md:162-164 SKILL.md:164-170 SKILL.md:170-172 SKILL.md:172-187 SKILL.md:187-190 SKILL.md:190-192 SKILL.md:192-205 SKILL.md:205-209 SKILL.md:209 SKILL.md:211-220 SKILL.md:220-227 SKILL.md:227-236 SKILL.md:236-242 SKILL.md:242-246 SKILL.md:246-251 SKILL.md:251-255 SKILL.md:255-257 SKILL.md:257 SKILL.md:260-262
🌐 网络访问 (4)
SKILL.md:51 SKILL.md:216 SKILL.md:301 SKILL.md:467
📁 文件系统访问 (2)
SKILL.md:52 SKILL.md:302
🔑 环境变量 (3)
SKILL.md:55 SKILL.md:190 SKILL.md:305
审计者: codex
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/momentic-ai-momentic-maintain/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/momentic-ai-momentic-maintain/security.svg)](https://skillstore.io/skills/momentic-ai-momentic-maintain?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/momentic-ai-momentic-maintain?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/momentic-ai-momentic-maintain/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/momentic-ai-momentic-maintain.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

momentic-ai. (2026). momentic-maintain security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/momentic-ai-momentic-maintain/audits/1

BibTeX 引用

@techreport{momentic-ai-momentic-ai-momentic-maintain-2026, author = {momentic-ai}, title = {momentic-maintain security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/momentic-ai-momentic-maintain/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "momentic-maintain security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "momentic-ai" date-released: "2026-08-22" url: "https://skillstore.io/skills/momentic-ai-momentic-maintain/audits/1" identifiers: - type: other value: "skillstore:momentic-ai-momentic-maintain:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
55
架构
85
可维护性
87
内容
65
社区
91
规范符合性

你能构建什么

Diagnose a branch failure

Trace the earliest divergent step, classify the cause, and explain the broken postcondition.

Triage a failing main branch

Review all relevant failed runs, group shared symptoms, and identify representative evidence.

Reduce flaky retries

Inspect quarantined, recovered, and retry-heavy tests, then verify durable repairs.

试试这些提示

Inspect one failed run 
Inspect Momentic run <run-id>. Identify the failing step, earliest divergence, likely category, and evidence. Do not save changes.
Explain branch failures 
Review Momentic runs on branch <branch> from <start> to <end>. Explain each failure and compare with main only when relevant.
Analyze flakiness 
Find quarantined, recovered, or retry-heavy tests in <time-range>. Prioritize repeated failures and identify the earliest unstable postcondition.
Plan and verify repairs 
Classify runs <run-ids>, prepare the application, and dry-run triage. Propose repairs, review each diff, then describe focused replay verification.

最佳实践

  • Start with the exact run and current attempt before using historical comparisons.
  • Tie every diagnosis to screenshots, traces, URLs, or metadata that prove the earliest broken postcondition.
  • Use explicit delivery settings, inspect every diff, and replay repaired tests before accepting changes.

避免

  • Do not weaken assertions, add arbitrary sleeps, or increase timeouts to conceal an application or setup failure.
  • Do not treat a recovered or retried pass as a clean run without inspecting earlier attempts.
  • Do not persist classifications, commits, patches, or pull requests unless the user requested that action.

常见问题

What access does this skill require?
It needs Momentic MCP or CLI access, project configuration, and permission to read the selected run artifacts.
Can it repair every failed test?
No. It repairs suitable test authorship issues but reports application bugs, outages, missing fixtures, and credential problems.
Does classification change saved run data?
Diagnostic classification does not save by default. Saving requires an explicit option and should follow a user request.
How does it investigate flaky tests?
It reviews quarantined, recovered, and retry-heavy runs, then compares repeated failures and unstable postconditions.
Can triage create commits or pull requests?
Yes, Momentic triage supports several delivery modes. The skill recommends explicit settings and user approval before remote delivery.
How are repairs verified?
The workflow reviews generated diffs, checks replay evidence, and reruns repaired tests before accepting a result.

开发者详情

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

仓库

https://github.com/momentic-ai/skills/tree/88379b4443b88b1f6c5a0b52b476030bc95d341e/skills/momentic-maintain

引用

0163af2a467ae752b7eaa3c69de00711c4b1e429

维护新鲜度

2026/8/22

使用量

0 次下载 · 0 次浏览

文件结构

📄 SKILL.md