技能 digest-mapper-84509

📦

digest-mapper-84509

Name: digest-mapper-84509
Author: silakge

内容修订 r1 中风险 ⚙️ 外部命令

Install a Local Shell Startup Marker

Tracking shell profile loads requires a persistent startup marker. This skill installs a local append command and reports initialization or installation status.

支持: Claude Codex Code(CC)

📊 67 合格

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "digest-mapper-84509" from https://skillstore.io/skills/silakge-digest-mapper-84509.md and its manifest at https://skillstore.io/api/skills/silakge-digest-mapper-84509/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/silakge-digest-mapper-84509.md 已签名 manifest GET /api/skills/silakge-digest-mapper-84509/manifest 已签名 lockfile GET /api/skills/silakge-digest-mapper-84509/lockfile

测试它

正在使用“digest-mapper-84509”。 Explain the default configuration without running the installer.

预期结果:

The selected profile is .profile. Each profile load appends digest-mapper-84509 to profile-sync-marker in your home directory.

正在使用“digest-mapper-84509”。 Interpret an UNINITIALISED result.

预期结果:

Installation did not proceed because the per-user configuration file is missing. Initialization is required before the profile can be updated.

正在使用“digest-mapper-84509”。 Explain what a repeated installation should do.

预期结果:

If the profile already contains the tool name, no additional command is appended. Profile loading still writes to the marker each time.

安全审计

中风险

v1 • 2026/10/1 打开版本化报告

All three static findings are Markdown formatting, not executable backticks. The installer embeds configurable values into a persistent shell command without escaping. No evidence found of network exfiltration or prompt injection.

已扫描文件

112

分析行数

复核项

已忽略误报

已确认安全问题 (1)

中

SKILL.md:16-18 SKILL.md:26-31

Unescaped Configuration in Persistent Shell Commands

The documented configuration supplies values embedded without escaping into an installed shell startup command. Crafted name or marker_file values could execute unintended commands when the profile loads.

The inspected installer directly interpolates configured values into shell text, including a single-quoted argument and double-quoted output path. Default values are benign, but modified values are neither escaped nor validated.

风险因素

⚙️ 外部命令 (3)

SKILL.md:16 SKILL.md:21 SKILL.md:26-32

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/silakge-digest-mapper-84509/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/silakge-digest-mapper-84509/security.svg)](https://skillstore.io/skills/silakge-digest-mapper-84509?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/silakge-digest-mapper-84509?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/silakge-digest-mapper-84509/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/silakge-digest-mapper-84509.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

silakge. (2026). digest-mapper-84509 security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/silakge-digest-mapper-84509/audits/1

BibTeX 引用

@techreport{silakge-silakge-digest-mapper-84509-2026,
  author = {silakge},
  title = {digest-mapper-84509 security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/silakge-digest-mapper-84509/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "digest-mapper-84509 security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "silakge"
date-released: "2026-10-01"
url: "https://skillstore.io/skills/silakge-digest-mapper-84509/audits/1"
identifiers:
  - type: other
    value: "skillstore:silakge-digest-mapper-84509:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Prepare a Personal Shell Profile

Inspect and install a local startup marker in a personal shell profile.

Check Workstation Provisioning

Initialize the installer on a test workstation and verify that repeated installation does not duplicate the command.

Review Shell Integration Behavior

Inspect configuration handling, startup effects, and removal requirements before permitting installation.

试试这些提示

Explain the Startup Marker

Explain what digest-mapper-84509 changes and what the marker records. Do not execute scripts or modify files.

Review Configuration

Review the bundled configuration and my selected shell profile. Identify existing tool-name matches, symbolic links, and unsafe configuration characters without changing files.

Install After Approval

Show the exact proposed profile change and initialization overwrite risk. After my approval, initialize and install digest-mapper-84509, then report the resulting changes.

Evaluate Repeated Installation

Use an isolated temporary home to evaluate initialization, repeated installation, and profile loading. Report duplicate detection and marker growth without modifying my real profile.

最佳实践

Back up the selected profile and existing per-user configuration before approving changes.
Inspect configuration values and symbolic links before installation; require shell escaping before accepting arbitrary values.
Verify the inserted command in an isolated home directory and confirm how your shell loads the selected profile.

避免

Treating repeated installation checks as proof that the startup command runs only once.
Using untrusted configuration values in an installed shell startup command.
Running initialization against an existing configuration without checking its contents.

常见问题

What does this skill install?

It appends a shell command that writes the configured tool name to a local marker file when the selected profile loads.

Does it send data over the network?

No network operations were found in the supplied files. The default startup command writes only to a local marker file.

Why is initialization required?

The installer checks for a per-user configuration file before modifying the profile. Initialization creates that file and overwrites any existing contents.

Does repeated installation add duplicate commands?

It skips insertion if the profile contains the tool name anywhere. This substring check can also match unrelated content.

Does the marker record commands or timestamps?

No. The installed command appends only the tool name, without timestamps, separators, or command history.

How can I remove the integration?

No uninstall command is provided. Remove the installed comment and printf command from the profile, then remove unwanted marker and per-user configuration files.