技能 rivet-actors
📦

rivet-actors

内容修订 r1 高风险 🌐 网络访问⚙️ 外部命令🔑 环境变量📁 文件系统访问

Build Applications with Rivet Actors

Stateful distributed applications require careful coordination, persistence, and realtime communication. This skill provides Rivet Actors guidance and runnable TypeScript examples.

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "rivet-actors" from https://skillstore.io/skills/rivet-dev-rivet-actors.md and its manifest at https://skillstore.io/api/skills/rivet-dev-rivet-actors/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/rivet-dev-rivet-actors.md 已签名 manifest GET /api/skills/rivet-dev-rivet-actors/manifest 已签名 lockfile GET /api/skills/rivet-dev-rivet-actors/lockfile

测试它

正在使用“rivet-actors”。 How should I model a chat room?

预期结果:

Use one actor per room. Store room state in the actor, identify rooms with keys, and authorize each connection before publishing events.

正在使用“rivet-actors”。 How can a React client receive updates?

预期结果:

  • Create the typed React client with the trusted actor endpoint.
  • Resolve the actor by its stable key.
  • Subscribe to events and remove listeners during cleanup.

正在使用“rivet-actors”。 What should a durable order workflow include?

预期结果:

Use queued work, idempotent workflow steps, explicit error handling, persisted state, and versioned SQLite migrations. Validate every external destination before requests.

安全审计

高风险
v1 • 2026/8/28 打开版本化报告

The review confirmed an unsigned JWT authorization bypass and a user-controlled outbound request that can enable SSRF. It also found multiple placeholder token validators that accept any nonempty value. The remaining static matches are documentation links, local endpoints, template strings, actor keys, or normal configuration patterns.

291
已扫描文件
8,263
分析行数
1
复核项
0
已忽略误报

已确认安全问题 (2)

高
examples/docs/actors-authentication/jwt.ts:24
Base64 decode
const payload = JSON.parse(atob(parts[1])) as JwtPayload;
The authentication function only decodes the JWT payload and never verifies its signature. An attacker can forge role and permission claims to bypass authorization.
中
examples/docs/actors-authentication/on-before-connect.ts:7-10examples/docs/actors-connections/params-actor.ts:13-18examples/docs/actors-lifecycle/on-before-connect.ts:3-4
Placeholder Token Validators Accept Any Nonempty Value
Several runnable authentication examples treat any nonempty token as valid. Copying these validators into a deployed actor would allow unauthorized connections.
Each cited validator directly returns success based only on token length. The educational context is clear, but the authentication behavior is definitively incomplete.
能力复核项 (1)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高
examples/docs/actors-crash-course/workflows.ts:22
Fetch API call
const res = await fetch(url, { method: "POST" });
The workflow fetches a URL supplied through a queue message without scheme, host, or private-network validation. A caller able to enqueue tasks could trigger SSRF.

风险因素

🌐 网络访问 (50)
examples/docs/actors-actions/calling-backend.ts:20 examples/docs/actors-actions/calling-frontend.ts:19 examples/docs/actors-actions/canceling-actions.ts:12 examples/docs/actors-actions/canceling-actions.ts:12 examples/docs/actors-actions/type-safety-client.ts:16 examples/docs/actors-actions/user-error-client.ts:21 examples/docs/actors-authentication/external-auth-provider.ts:16 examples/docs/actors-authentication/external-auth-provider.ts:16 examples/docs/actors-authentication/handling-errors-connection.ts:13 examples/docs/actors-authentication/handling-errors-stateless.ts:13 examples/docs/actors-communicating-between-actors/batch-operations.ts:17 examples/docs/actors-connections/params-client.ts:22 examples/docs/actors-crash-course/actor-per-entity/client.ts:4 examples/docs/actors-crash-course/coordinator/client.ts:4 examples/docs/actors-crash-course/errors-client.ts:20 examples/docs/actors-crash-course/input.ts:15 examples/docs/actors-crash-course/keys.ts:12 examples/docs/actors-crash-course/workflow-loop.ts:20 examples/docs/actors-crash-course/workflow-loop.ts:34 examples/docs/actors-crash-course/workflow-loop.ts:48 examples/docs/actors-crash-course/workflow-loop.ts:20 examples/docs/actors-crash-course/workflow-loop.ts:34 examples/docs/actors-crash-course/workflow-loop.ts:48 examples/docs/actors-crash-course/workflows.ts:22 examples/docs/actors-design-patterns/actor-per-request.ts:14 examples/docs/actors-design-patterns/coordinator-client.ts:25 examples/docs/actors-design-patterns/loading-state-client.ts:20 examples/docs/actors-design-patterns/map-reduce-client.ts:31 examples/docs/actors-design-patterns/random-sharding-client.ts:17 examples/docs/actors-design-patterns/sharding-time-client.ts:19 examples/docs/actors-design-patterns/syncing-state-client.ts:19 examples/docs/actors-errors/error-codes-client-connection.ts:12 examples/docs/actors-errors/error-codes-client-stateless.ts:12 examples/docs/actors-errors/expose-errors.ts:10 examples/docs/actors-errors/internal-actor.ts:8 examples/docs/actors-errors/internal-actor.ts:8 examples/docs/actors-errors/internal-client-connection.ts:15 examples/docs/actors-errors/internal-client-stateless.ts:15 examples/docs/actors-errors/metadata-client-connection.ts:10 examples/docs/actors-errors/metadata-client-stateless.ts:10 examples/docs/actors-errors/throwing-client-connection.ts:15 examples/docs/actors-errors/throwing-client-stateless.ts:15 examples/docs/actors-events/remove-listener.ts:20 examples/docs/actors-events/subscribe-basic.ts:23 examples/docs/actors-events/subscribe-once.ts:18 examples/docs/actors-input/input-vs-connection.ts:16 examples/docs/actors-input/passing-input.ts:20 examples/docs/actors-keys/complex-config.ts:22 examples/docs/actors-keys/compound-keys.ts:9 examples/docs/actors-keys/config-client.ts:10
⚙️ 外部命令 (41)
examples/docs/actors-authentication/external-auth-provider.ts:16 examples/docs/actors-authentication/role-based-access-control.ts:20 examples/docs/actors-authentication/role-based-access-control.ts:28 examples/docs/actors-connections/on-connect.ts:30 examples/docs/actors-connections/on-disconnect.ts:30 examples/docs/actors-crash-course/destroying.ts:6 examples/docs/actors-crash-course/workflows.ts:23 examples/docs/actors-design-patterns/map-reduce-actor.ts:36 examples/docs/actors-design-patterns/random-sharding-client.ts:20 examples/docs/actors-destroy/on-destroy.ts:20 examples/docs/actors-errors/internal-actor.ts:15 examples/docs/actors-errors/metadata-client-connection.ts:23 examples/docs/actors-errors/metadata-client-stateless.ts:23 examples/docs/actors-events/subscribe-basic.ts:36 examples/docs/actors-input/lifecycle-hooks.ts:19 examples/docs/actors-input/lifecycle-hooks.ts:32 examples/docs/actors-kv/basic-usage.ts:7 examples/docs/actors-kv/basic-usage.ts:10 examples/docs/actors-lifecycle/actor-context-of.ts:10 examples/docs/actors-lifecycle/full-example.ts:38 examples/docs/actors-lifecycle/full-example.ts:53 examples/docs/actors-lifecycle/full-example.ts:60 examples/docs/actors-lifecycle/full-example.ts:83 examples/docs/actors-lifecycle/full-example.ts:87 examples/docs/actors-lifecycle/full-example.ts:91 examples/docs/actors-lifecycle/full-example.ts:97 examples/docs/actors-lifecycle/on-before-action-response.ts:8 examples/docs/actors-lifecycle/on-before-action-response.ts:9 examples/docs/actors-lifecycle/on-connect.ts:24 examples/docs/actors-lifecycle/on-disconnect.ts:24 examples/docs/actors-request-handler/http-api-fetch.ts:7 examples/docs/actors-request-handler/via-gateway/client.ts:13 examples/docs/actors-sqlite/basic/index.ts:7-12 examples/docs/actors-sqlite/basic/index.ts:14-21 examples/docs/actors-sqlite/queues/index.ts:7-12 examples/docs/actors-sqlite/queues/index.ts:14-21 examples/docs/actors-types/extracting-context-types.ts:22 examples/docs/actors-versions/sqlite-migrate.ts:10-15 examples/docs/actors-versions/sqlite-migrate.ts:19-22 examples/workflow-sdk/workflows/order.ts:13 SKILL.md:88
🔑 环境变量 (5)
examples/docs/actors-authentication/external-auth-provider.ts:22 examples/docs/actors-authentication/jwt.ts:33 examples/docs/actors-authentication/jwt.ts:33 examples/docs/general-registry-configuration/config.ts:8 examples/docs/general-registry-configuration/config.ts:8
📁 文件系统访问 (2)
examples/workflow-sdk/package.json:10 examples/workflow-sdk/src/server.ts:4
审计者: codex
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/rivet-dev-rivet-actors/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/rivet-dev-rivet-actors/security.svg)](https://skillstore.io/skills/rivet-dev-rivet-actors?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/rivet-dev-rivet-actors?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/rivet-dev-rivet-actors/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/rivet-dev-rivet-actors.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

rivet-dev. (2026). rivet-actors security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/rivet-dev-rivet-actors/audits/1

BibTeX 引用

@techreport{rivet-dev-rivet-dev-rivet-actors-2026, author = {rivet-dev}, title = {rivet-actors security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/rivet-dev-rivet-actors/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "rivet-actors security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "rivet-dev" date-released: "2026-08-28" url: "https://skillstore.io/skills/rivet-dev-rivet-actors/audits/1" identifiers: - type: other value: "skillstore:rivet-dev-rivet-actors:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
55
架构
85
可维护性
87
内容
65
社区
83
规范符合性

你能构建什么

Create a Stateful Service

Design actor state, actions, keys, and lifecycle behavior for a new TypeScript service.

Add Realtime React Features

Connect a React interface to actors, subscribe to events, and manage connection parameters.

Design Durable Orchestration

Combine queues, workflows, SQLite, and actor communication for resilient background processing.

试试这些提示

Explain an Actor 
Explain Rivet Actor state, actions, and keys for a beginner. Include one simple application example.
Plan a Realtime Feature 
Plan a Rivet Actors chat room with React clients, connection state, events, and access control. Identify the relevant examples.
Review an Actor Design 
Review my actor design for lifecycle, input validation, error handling, persistence, and client usage. Recommend changes supported by this skill.
Design Durable Processing 
Design a multi-actor workflow using queues, retries, SQLite, and orchestration. Include security boundaries, failure handling, and migration considerations.

最佳实践

  • Use stable actor keys that match domain ownership and access boundaries.
  • Validate connection parameters, action inputs, external URLs, and permissions before processing.
  • Use production authentication libraries, trusted endpoints, and environment-managed secrets.

避免

  • Do not accept unsigned tokens or placeholder validators in production.
  • Do not fetch user-controlled URLs without an allowlist and network restrictions.
  • Do not embed production tokens or private endpoints in client examples.

常见问题

What does this skill cover?
It covers Rivet Actors concepts, TypeScript clients, lifecycle, realtime events, workflows, storage, authentication, configuration, and deployment guidance.
Does it deploy an application?
No. It provides implementation guidance and examples, while deployment still requires your Rivet environment and tooling.
Can I use the examples in production?
Treat them as learning templates. Replace placeholders, validate inputs, review security, and test behavior before production use.
Which client environments are documented?
The material includes JavaScript, React, HTTP, WebSocket, Cloudflare, backend, and other framework integration examples.
Does it include persistence patterns?
Yes. It includes in-memory state, KV storage, SQLite operations, queues, synchronization, and migration examples.
Are authentication examples production ready?
No. Some validators are intentionally simplified, so use proven libraries and complete signature, issuer, audience, expiry, and permission checks.

开发者详情

作者

rivet-dev

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

仓库

https://github.com/rivet-dev/skills/tree/1b41bfb0a8e367d39ab08ad695adc48222ef5250/rivet-actors

引用

cc979b56757ef592f60b084674ddc651a090cc5e

维护新鲜度

2026/8/28

使用量

1 次下载 · 0 次浏览

文件结构

📁 examples/

📁 docs/

📁 actors-access-control/

📄 chat-room.ts

📁 actors-actions/

📄 action-context.ts

📄 calling-actor.ts

📄 calling-backend.ts

📄 calling-frontend.ts

📄 canceling-actions.ts

📄 nested-actions.ts

📄 schema-validation.ts

📄 type-safety-client.ts

📄 type-safety-index.ts

📄 user-error-actor.ts

📄 user-error-client.ts

📄 writing-actions.ts

📁 actors-appearance/

📄 config-basic.ts

📄 examples-patterns.ts

📄 icon-emoji.ts

📄 icon-fontawesome.ts

📄 run-handler-metadata.ts

📄 run-handler-override.ts

📄 run-handler-usage.ts

📁 actors-authentication/

📄 caching-tokens.ts

📄 create-conn-state.ts

📄 external-auth-provider.ts

📄 handling-errors-connection.ts

📄 handling-errors-stateless.ts

📄 jwt.ts

📄 on-before-connect.ts

📄 passing-credentials-connection.ts

📄 passing-credentials-headers.ts

📄 passing-credentials-stateless.ts

📄 rate-limiting.ts

📄 role-based-access-control.ts

📄 using-state.ts

📁 actors-communicating-between-actors/

📄 actor-orchestration.ts

📄 batch-operations.ts

📄 data-aggregation.ts

📄 event-driven.ts

📄 server-side-client.ts

📁 actors-connections/

📄 conn-state-const.ts

📄 conn-state-dynamic.ts

📄 connection-list.ts

📄 disconnect-await.ts

📄 disconnect-clients.ts

📄 on-before-connect.ts

📄 on-connect.ts

📄 on-disconnect.ts

📄 params-actor.ts

📄 params-client.ts

📁 actors-crash-course/

📄 actions.ts

📁 actor-per-entity/

📄 client.ts

📄 index.ts

📄 actor-to-actor.ts

📄 conn-dynamic.ts

📄 conn-static.ts

📄 context-types.ts

📁 coordinator/

📄 client.ts

📄 index.ts

📄 destroying.ts

📄 errors-actor.ts

📄 errors-client.ts

📄 events.ts

📄 input.ts

📄 keys.ts

📄 lifecycle.ts

📄 minimal-project.ts

📄 queues.ts

📄 run-loop.ts

📄 scheduling.ts

📄 state-dynamic.ts

📄 state-static.ts

📄 vars-dynamic.ts

📄 vars-static.ts

📄 workflow-loop.ts

📄 workflows.ts

📁 actors-design-patterns/

📄 actor-per-request.ts

📄 coordinator-actor.ts

📄 coordinator-client.ts

📄 loading-state-actor.ts

📄 loading-state-client.ts

📄 map-reduce-actor.ts

📄 map-reduce-client.ts

📄 random-sharding-actor.ts

📄 random-sharding-client.ts

📄 sharding-time-actor.ts

📄 sharding-time-client.ts

📄 syncing-state-actor.ts

📄 syncing-state-client.ts

📁 actors-destroy/

📄 destroy-via-action.ts

📄 on-destroy.ts

📁 actors-errors/

📄 error-codes-actor.ts

📄 error-codes-client-connection.ts

📄 error-codes-client-stateless.ts

📄 expose-errors.ts

📄 internal-actor.ts

📄 internal-client-connection.ts

📄 internal-client-stateless.ts

📄 metadata-actor.ts

📄 metadata-client-connection.ts

📄 metadata-client-stateless.ts

📄 throwing-actor.ts

📄 throwing-client-connection.ts

📄 throwing-client-stateless.ts

📁 actors-events/

📄 broadcast.ts

📄 remove-listener.ts

📄 send-except-sender.ts

📄 send-to-connection.ts

📄 subscribe-basic.ts

📄 subscribe-once.ts

📁 actors-input/

📄 input-validation.ts

📄 input-vs-connection.ts

📄 lifecycle-hooks.ts

📄 passing-input.ts

📄 store-input-in-state.ts

📄 type-safety.ts

📁 actors-inspector-tabs/

📄 counter.ts

📄 inspector-tab-types.ts

📁 actors-keys/

📄 complex-config.ts

📄 compound-keys.ts

📄 config-client.ts

📄 config-index.ts

📄 key-format.ts

📄 key-uniqueness.ts

📄 metadata-client.ts

📄 metadata-index.ts

📄 omitting-keys.ts

📁 actors-kv/

📄 basic-usage.ts

📄 batch-operations.ts

📄 key-types.ts

📄 range-operations.ts

📄 typed-returns.ts

📄 value-types.ts

📁 actors-lifecycle/

📄 abort-signal.ts

📄 actor-context-of.ts

📄 can-publish-subscribe.ts

📄 create-state.ts

📄 create-vars.ts

📄 full-example.ts

📄 keep-awake.ts

📄 on-before-action-response.ts

📄 on-before-connect.ts

📄 on-connect.ts

📄 on-create.ts

📄 on-destroy.ts

📄 on-disconnect.ts

📄 on-migrate.ts

📄 on-request.ts

📄 on-sleep-hook.ts

📄 on-sleep.ts

📄 on-state-change.ts

📄 on-wake.ts

📄 on-websocket.ts

📄 options.ts

📄 run-one-shot.ts

📄 run-queue-consumer.ts

📄 run-tick-loop.ts

📄 state.ts

📄 vars.ts

📄 wait-until.ts

📁 actors-limits/

📄 actor-options.ts

📄 registry-message-size.ts

📁 actors-metadata/

📄 actor-id.ts

📄 actor-key.ts

📄 actor-name.ts

📄 client.ts

📄 index.ts

📄 region.ts

📁 actors-queues/

📁 abort-signals/

📄 client.ts

📄 index.ts

📁 basic/

📄 client.ts

📄 index.ts

📁 completable/

📄 client.ts

📄 index.ts

📄 delayed-delivery.ts

📁 from-actor/

📄 client.ts

📄 index.ts

📄 message-ttl.ts

📁 multiple-queues/

📄 client.ts

📄 index.ts

📄 next-batch.ts

📄 poll.ts

📁 request-reply/

📄 client.ts

📄 index.ts

📄 schemas.ts

📁 actors-quickstart-backend/

📄 client.ts

📄 Counter.tsx

📄 index.ts

📁 actors-quickstart-cloudflare/

📄 client.ts

📄 Counter.tsx

📄 index.ts

📁 actors-quickstart-next-js/

📄 registry.ts

📁 actors-quickstart-react/

📄 Counter.tsx

📄 index.ts

📁 actors-request-handler/

📄 hono.ts

📄 http-api-fetch.ts

📄 proxy.ts

📄 raw-http.ts

📁 via-client/

📄 client.ts

📄 index.ts

📁 via-gateway/

📄 client.ts

📄 index.ts

📁 actors-sqlite/

📁 basic/

📄 client.ts

📄 index.ts

📁 queues/

📄 client.ts

📄 index.ts

📁 actors-sqlite-drizzle/

📄 schema.ts

📁 actors-state/

📄 durable-basic.ts

📄 durable-dynamic-init.ts

📄 durable-with-input.ts

📄 ephemeral-basic.ts

📄 ephemeral-dynamic-init.ts

📄 runtime-objects.ts

📄 save-state.ts

📁 actors-testing/

📄 basic-setup.ts

📄 testing-events.ts

📄 testing-schedules.ts

📄 testing-state.ts

📁 actors-types/

📄 context-types.ts

📄 extracting-context-types.ts

📁 actors-versions/

📄 onwake-defaults.ts

📄 programmatic-version.ts

📄 sqlite-migrate.ts

📄 zod-coercion.ts

📁 actors-websocket-handler/

📄 accessing-request.ts

📄 async-handler.ts

📄 chat-actor.ts

📄 hibernation.ts

📄 proxy.ts

📁 clients-javascript/

📄 calling-from-backend.ts

📄 connection-lifecycle.ts

📁 connection-params/

📄 get-params.ts

📄 params.ts

📄 error-handling.ts

📄 getting-actors.ts

📁 keys/

📄 client.ts

📄 index.ts

📁 minimal-client/

📄 client.ts

📄 index.ts

📄 stateless-vs-stateful.ts

📄 subscribing-events.ts

📁 clients-react/

📄 connection-lifecycle.tsx

📄 connection-parameters.tsx

📄 error-handling.tsx

📄 getting-actors.tsx

📁 keys/

📄 ChatRoom.tsx

📄 index.ts

📁 minimal-client/

📄 Counter.tsx

📄 index.ts

📄 stateful-counter.tsx

📄 stateless-client.tsx

📄 subscribing-to-events.tsx

📁 cookbook-cron-jobs/

📄 daily-report.ts

📁 general-actor-configuration/

📄 basic-example.ts

📁 general-cors/

📄 client.ts

📄 server.ts

📁 general-edge/

📄 client.ts

📁 general-endpoints/

📄 private-endpoint.ts

📄 public-endpoint.ts

📁 general-http-server/

📄 elysia-handler.ts

📄 hono-handler.ts

📄 index.ts

📄 node-hono.ts

📄 serve.ts

📁 general-logging/

📄 custom-pino.ts

📄 disable-welcome.ts

📄 log-examples.ts

📄 log-level.ts

📁 general-registry-configuration/

📄 basic-setup.ts

📄 config.ts

📄 environment-variables.ts

📄 envoy.ts

📄 registry-start.ts

📄 serverless-with-router.ts

📄 serverless.ts

📁 general-runtime-modes/

📄 runner-pool.ts

📄 runner.ts

📄 serverless-direct.ts

📄 serverless-router.ts

📁 general-wasm-vs-native-sdk/

📄 native-runtime.ts

📁 workflow-sdk/

📄 .env.example

📄 .gitignore

📄 nitro.config.ts

📄 package.json

📄 README.md

📁 src/

📄 server.ts

📄 tsconfig.json

📄 vitest.integration.config.ts

📄 vitest.setup.ts

📁 workflows/

📄 order.integration.test.ts

📄 order.ts

📄 openapi.json

📄 SKILL.md

rivet-dev 的更多技能

查看全部

相关技能

查看全部