技能 blocklet-converter

📦

blocklet-converter

Name: blocklet-converter
Author: ArcBlock

內容修訂 r1 中風險 🔑 環境變數⚙️ 外部命令🌐 網路存取

將 Web 專案轉換為 Blocklet

為 ArcBlock 部署準備 Web 專案需要正確的中繼資料、資產和打包設定。此技能會引導 Claude、Codex 或 Claude Code 完成轉換與驗證步驟。

支援: Claude Codex Code(CC)

⚠️ 50 差

Maintain this Skill? Claim it ⚠️ 50 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "blocklet-converter" from https://skillstore.io/skills/arcblock-blocklet-converter.md and its manifest at https://skillstore.io/api/skills/arcblock-blocklet-converter/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/arcblock-blocklet-converter.md 已簽名 manifest GET /api/skills/arcblock-blocklet-converter/manifest 已簽名 lockfile GET /api/skills/arcblock-blocklet-converter/lockfile

測試它

正在使用「blocklet-converter」。使用有效的 Blocklet DID 轉換 Vite React 專案。

預期結果:

此技能會識別靜態 Web 應用程式、建置專案、找到 dist 輸出、建立 Blocklet 中繼資料，並驗證套件。

正在使用「blocklet-converter」。轉換沒有 package.json 的純 HTML 專案。

預期結果:

此技能會偵測 index.html、略過依賴安裝、建立缺少的資產，並設定 Blocklet main 路徑。

正在使用「blocklet-converter」。轉換含有 TypeScript 建置錯誤的專案。

預期結果:

此技能會在建置失敗後停止，並回報錯誤，而不是建立不完整的 Blocklet 檔案。

安全審計

中風險

v12 • 2026/7/9 開啟版本化報告

Most static findings are false positives caused by Markdown backticks, documented Blocklet runtime environment variables, and normal deployment metadata. The confirmed risk is intended external command execution: the skill installs dependencies, runs build commands, and invokes the Blocklet CLI in the target project.

已掃描檔案

398

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

中

SKILL.md:57-63

Dependency Installation and Build Script Execution

The skill directs the agent to run dependency installation and project build commands. This can execute package lifecycle scripts from the target project and may run untrusted code if the project is not trusted.

The workflow explicitly includes dependency installation and build execution. This is expected for conversion, but it creates a real local execution risk in untrusted repositories.

能力複核項目 (8)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

中

SKILL.md:59-61

Ruby/shell backtick execution

```bash

The workflow instructs the agent to run dependency installation and a build command. This can execute project package scripts and should require user awareness.

中

SKILL.md:61-67

Ruby/shell backtick execution

```

This code block contains the build workflow that executes local package manager commands. Such commands are expected but can run arbitrary package lifecycle scripts.

中

SKILL.md:95-97

Ruby/shell backtick execution

```bash

The workflow directs execution of the Blocklet CLI for metadata validation. This is intended behavior, but it is still an external command run in the user project.

中

SKILL.md:97-101

Ruby/shell backtick execution

```

The surrounding command block invokes the Blocklet CLI. The operation is legitimate but should be treated as external command execution.

中

SKILL.md:101-103

Ruby/shell backtick execution

```bash

The workflow directs bundling a Next.js blocklet with the Blocklet CLI. This is legitimate deployment tooling but executes an external command.

中

SKILL.md:103-107

Ruby/shell backtick execution

```

The surrounding command block invokes blocklet bundle for Next.js projects. It is intended but remains external command execution.

中

SKILL.md:107-109

Ruby/shell backtick execution

```bash

The workflow directs bundling a static webapp with the Blocklet CLI. This is legitimate deployment tooling but executes an external command.

中

SKILL.md:109-119

Ruby/shell backtick execution

```

The surrounding command block invokes blocklet bundle for static projects. It is intended but remains external command execution.

風險因素

🔑 環境變數 (6)

assets/nextjs-entry.txt:3 assets/nextjs-entry.txt:8 assets/nextjs-entry.txt:11 assets/nextjs-entry.txt:3 assets/nextjs-entry.txt:8 assets/nextjs-entry.txt:11

⚙️ 外部命令 (44)

🌐 網路存取 (1)

templates/static-blocklet.yml:34

審計單位: claude 檢視審計紀錄 →

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/arcblock-blocklet-converter/audits/12?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/arcblock-blocklet-converter/security.svg)](https://skillstore.io/skills/arcblock-blocklet-converter?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/arcblock-blocklet-converter?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/arcblock-blocklet-converter/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/arcblock-blocklet-converter.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

ArcBlock. (2026). blocklet-converter security audit report (audit version 12) [Author version unspecified]. Skillstore. https://skillstore.io/skills/arcblock-blocklet-converter/audits/12

BibTeX 引用

@techreport{arcblock-arcblock-blocklet-converter-2026,
  author = {ArcBlock},
  title = {blocklet-converter security audit report (audit version 12)},
  institution = {Skillstore},
  year = {2026},
  number = {12},
  url = {https://skillstore.io/skills/arcblock-blocklet-converter/audits/12},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "blocklet-converter security audit report (audit version 12)"
version: "unspecified"
type: report
authors:
  - name: "ArcBlock"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/arcblock-blocklet-converter/audits/12"
identifiers:
  - type: other
    value: "skillstore:arcblock-blocklet-converter:audit:12"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

為 ArcBlock 封裝 React 網站

將 Vite 或 React 靜態網站轉換為包含已產生中繼資料和部署檔案的 Blocklet。

準備 Next.js 專案以進行 Blocklet 打包

為生產環境 Next.js 應用程式加入必要的 Blocklet 進入點和設定。

驗證部署準備狀態

在建立發行套件前，檢查建置輸出、資產和 Blocklet 中繼資料是否存在。

試試這些提示

轉換簡單的 Web 應用程式

Convert this project to an ArcBlock blocklet using DID z8iaExampleDidValue. Stop if the project is not a supported web app.

轉換並說明必要變更

Review this project for Blocklet conversion using DID z8iaExampleDidValue. Tell me what files you will create or update before running commands.

準備 Next.js Blocklet

Convert this Next.js project into a Blocklet with DID z8iaExampleDidValue. Verify the production entry point and blocklet.yml settings.

稽核轉換準備狀態

Check this project for Blocklet readiness using DID z8iaExampleDidValue. Validate metadata, output paths, assets, and bundle commands before creating a release.