技能 rivet-dynamic-apps

📦

rivet-dynamic-apps

Name: rivet-dynamic-apps
Author: rivet-dev

内容修订 r1 中风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问

Deploy AI-Generated Rivet Backends

Building a generated backend for each user requires deployment, routing, durable state, and lifecycle patterns. This skill provides Rivet documentation links and runnable TypeScript examples.

支持: Claude Codex Code(CC)

📊 69 合格

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "rivet-dynamic-apps" from https://skillstore.io/skills/rivet-dev-rivet-dynamic-apps.md and its manifest at https://skillstore.io/api/skills/rivet-dev-rivet-dynamic-apps/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/rivet-dev-rivet-dynamic-apps.md 已签名 manifest GET /api/skills/rivet-dev-rivet-dynamic-apps/manifest 已签名 lockfile GET /api/skills/rivet-dev-rivet-dynamic-apps/lockfile

测试它

正在使用“rivet-dynamic-apps”。 Build a generated hello-world backend with one API endpoint.

预期结果:

A deployment plan with generated files, a host router, local run commands, an application URL, and verification steps.

正在使用“rivet-dynamic-apps”。 Add persistent shared notes to a Dynamic App.

预期结果:

A RivetKit actor design using parameterized SQLite statements, typed client actions, migration guidance, input validation, and persistence tests.

正在使用“rivet-dynamic-apps”。 Prepare the deployment example for a shared staging environment.

预期结果:

Require authenticated deployment requests and authorize each application identifier.
Validate identifiers, restrict source inputs, and enforce quotas.
Add audit logs, health checks, rollback procedures, and isolated namespaces.

安全审计

中风险

v1 • 2026/8/28 打开版本化报告

All 41 static findings are false positives caused by template literals, fixed local requests, relative module paths, SQL, and documentation links. The examples expose unauthenticated deployment routes that create deployments under caller-selected identifiers, creating resource-abuse risk outside local development. No prompt injection or malicious intent was found.

已扫描文件

710

分析行数

复核项

已忽略误报

已确认安全问题 (1)

中

examples/apps-multiplayer/src/server.ts:12-17 examples/apps-sqlite/src/server.ts:12-17 examples/apps-workflows/src/server.ts:12-17

Unauthenticated Deployment Routes

Three example POST routes deploy a fixed fixture under caller-selected application identifiers without authentication, authorization, validation, or rate limiting.

The route bodies directly call deployApp with a request parameter and show no access control. Fixed sources limit impact but repeated deployment can consume resources.

风险因素

⚙️ 外部命令 (7)

examples/apps-hello-world/fixtures/app/src/index.ts:7-21 examples/apps-hello-world/src/deploy.ts:18-30 examples/apps-multiplayer/src/client.ts:9 examples/apps-sqlite/fixtures/app/src/index.ts:7-12 examples/apps-sqlite/src/client.ts:9 examples/apps-workflows/src/client.ts:9 SKILL.md:20

🌐 网络访问 (23)

📁 文件系统访问 (6)

examples/apps-multiplayer/src/client.ts:3 examples/apps-multiplayer/src/server.ts:16 examples/apps-sqlite/src/client.ts:3 examples/apps-sqlite/src/server.ts:16 examples/apps-workflows/src/client.ts:3 examples/apps-workflows/src/server.ts:16

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/rivet-dev-rivet-dynamic-apps/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/rivet-dev-rivet-dynamic-apps/security.svg)](https://skillstore.io/skills/rivet-dev-rivet-dynamic-apps?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/rivet-dev-rivet-dynamic-apps?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/rivet-dev-rivet-dynamic-apps/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/rivet-dev-rivet-dynamic-apps.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

rivet-dev. (2026). rivet-dynamic-apps security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/rivet-dev-rivet-dynamic-apps/audits/1

BibTeX 引用

@techreport{rivet-dev-rivet-dev-rivet-dynamic-apps-2026,
  author = {rivet-dev},
  title = {rivet-dynamic-apps security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/rivet-dev-rivet-dynamic-apps/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "rivet-dynamic-apps security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "rivet-dev"
date-released: "2026-08-28"
url: "https://skillstore.io/skills/rivet-dev-rivet-dynamic-apps/audits/1"
identifiers:
  - type: other
    value: "skillstore:rivet-dev-rivet-dynamic-apps:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Prototype Generated Backends

Create a local service that deploys a separate generated HTTP backend for each user or project.

Add Durable Application State

Select actor, SQLite, workflow, or realtime patterns for generated applications that require persistent coordination.

Evaluate Rivet Architecture

Review runnable patterns before adopting Rivet Dynamic Apps for a multi-tenant product.

试试这些提示

Build a Basic Backend

Create a local Rivet Dynamic App that serves an HTML page and one JSON endpoint. Explain how to run and deploy it.

Add Persistent Notes

Design a RivetKit notes actor with parameterized SQLite operations. Include deployment flow, typed client usage, validation, and local test steps.

Create Shared Realtime State

Build a multiplayer room actor for named players and positions. Include broadcasts, typed client calls, authorization boundaries, and cleanup behavior.

Design a Secure Deployment Service

Architect a multi-tenant Dynamic Apps deployment API. Cover authentication, authorization, identifier validation, isolation, quotas, observability, rollback, and failure recovery.

最佳实践

Start with a checked local fixture before accepting generated application files.
Authenticate deployment routes and isolate each tenant with validated identifiers, namespaces, and resource quotas.
Use parameterized database operations and test deployment, routing, persistence, cleanup, and failure recovery.

避免

Do not expose example deployment routes to shared networks without authentication and rate limits.
Do not allow unvalidated request values to select filesystem sources, package inputs, or tenant namespaces.
Do not treat generated backend code as trusted without review, sandboxing, dependency controls, and monitoring.