技能 astrale-cli

📦

astrale-cli

Name: astrale-cli
Author: astrale-os

內容修訂 r1 中風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取

Manage Astrale Kernels with CLI Workflows

Astrale operations require precise paths, identity selection, and command options. This reference guides assistants through Kernel operations, graph workflows, diagnostics, and local UI setup.

支援: Claude Codex Code(CC)

📊 69 尚可

Maintain this Skill? Claim it 📊 69 尚可

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "astrale-cli" from https://skillstore.io/skills/astrale-os-astrale-cli.md and its manifest at https://skillstore.io/api/skills/astrale-os-astrale-cli/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/astrale-os-astrale-cli.md 已簽名 manifest GET /api/skills/astrale-os-astrale-cli/manifest 已簽名 lockfile GET /api/skills/astrale-os-astrale-cli/lockfile

測試它

正在使用「astrale-cli」。 Explain how to read notes from staging without changing data.

預期結果:

Select staging explicitly and use an identity authorized to read notes.
Query the Note class with a finite limit and structured output.
Resume with each returned cursor until no continuation remains.

正在使用「astrale-cli」。 Explain how to review a mutation before sending it.

預期結果:

Use mutation dry mode to admit and display the canonical document without connecting to a Kernel.
Review the operations and preconditions against the intended instance.
Require approval before executing the atomic transition.

正在使用「astrale-cli」。 Explain how to protect locally edited Astrale UI components.

預期結果:

Ordinary component addition refuses to replace locally edited installed files.
Preview proposed changes with dry-run mode.
Use overwrite and confirmation flags only after reviewing the intended replacement.

安全審計

中風險

v1 • 2026/10/10 開啟版本化報告

All 269 static findings are documentation false positives, including Markdown delimiters, example URLs, and descriptions of owner-private credential caches. Token examples introduce one semantic risk by passing bearer credentials through command-line arguments. No evidence found of prompt injection, malicious exfiltration, or unauthorized execution; external CLI implementation was not included.

已掃描檔案

631

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

中

SKILL.md:373-374 SKILL.md:387

Bearer Credentials Exposed Through Command Arguments

The examples pass minted bearer credentials using --creds "$TOKEN" and --creds "$(astrale token --raw)". Shell expansion places credentials in process arguments, potentially exposing them to process inspection or execution logging while tokens remain valid.

The examples directly expand bearer credentials into argv. Exposure depends on local process visibility and logging; short token lifetimes reduce the exploitation window.

風險因素

⚙️ 外部命令 (50)

🌐 網路存取 (6)

SKILL.md:60 SKILL.md:158 SKILL.md:228 SKILL.md:274 SKILL.md:275 SKILL.md:277

📁 檔案系統存取 (2)

SKILL.md:592 SKILL.md:592

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/astrale-os-astrale-cli/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/astrale-os-astrale-cli/security.svg)](https://skillstore.io/skills/astrale-os-astrale-cli?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/astrale-os-astrale-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/astrale-os-astrale-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/astrale-os-astrale-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

astrale-os. (2026). astrale-cli security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/astrale-os-astrale-cli/audits/1

BibTeX 引用

@techreport{astrale-os-astrale-os-astrale-cli-2026,
  author = {astrale-os},
  title = {astrale-cli security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/astrale-os-astrale-cli/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "astrale-cli security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "astrale-os"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/astrale-os-astrale-cli/audits/1"
identifiers:
  - type: other
    value: "skillstore:astrale-os-astrale-cli:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Inspect Application Graph Data

Read nodes, inspect callable schemas, and paginate bounded graph queries on an explicitly selected instance.

Plan Domain Updates

Review installed releases, dependency compatibility, and issuer changes before approving a grouped domain installation.

Configure Local UI Projects

Initialize React and Tailwind CSS projects, search available patterns, and review source changes before adding components.

試試這些提示

Check Connection and Identity

Use astrale-cli to explain read-only connection and identity checks for staging. Do not print tokens or change configuration.

Prepare a Paginated Graph Query

Prepare a bounded query for /:notes.example:class.Note on staging using identity reader. Explain cursor pagination without running mutations.

Review a Mutation Before Execution

Review mutation.v3.json and prepare an Astrale mutation dry run. Explain preconditions and atomicity; require approval before execution.

Plan an Authorized Domain Upgrade

Plan a grouped domain upgrade on staging. Review release pins, compatibility, and issuer consent using an authorized identity; require approval before installation.

最佳實務

Select the instance and least-privileged identity explicitly, and verify current command help before remote operations.
Review dry runs and release pins; approve mutations, issuer changes, root recovery, and destructive uninstalls explicitly.
Prefer identity selection over bearer arguments; keep secret payloads in protected files or stdin, and redact shared diagnostics.

避免

Relying on an ambient active instance or root identity for unattended production changes.
Placing bearer credentials or secret payloads in command arguments, logs, or issue reports.
Treating partial domain inventory or authorization-masked reads as proof that data is missing.

常見問題

What does this skill provide?

It provides an Astrale CLI reference for assistants. It does not include the CLI binary or verify its implementation.

Which assistants can use it?

The marketplace lists Claude, Codex, and Claude Code. Executing commands also requires a local CLI installation and authorized credentials.

Can it deploy domains?

No. The CLI connects to existing Kernels and installs published releases. Building, deploying, and publishing use the separate astrale-domain binary.

Can I inspect changes without applying them?

Mutations support --dry, while calls and UI additions support --dry-run. These previews do not replace permission checks during execution.

How should I handle credentials?

Prefer identity selection. Bearer arguments can expose tokens; use protected files or stdin for secret call payloads and avoid logging credentials.

Why is a domain absent from the installed list?

The list omits built-in, local, and unreadable domains. An absent origin does not prove that the domain is not installed.

開發者詳細資訊

作者

astrale-os

授權

MIT

Skillstore 修訂

版本提示

作者未聲明版本。

儲存庫

https://github.com/astrale-os/cli/tree/db2fc39650aa2fbd37e8439804d5e627ac83bcb0/skills/astrale-cli

引用

e406bf64b5db6e514879399e87b346fa7ff7c2fb

維護新鮮度

2026/10/11

使用量

0 次下載 · 0 次瀏覽

檔案結構

📄 SKILL.md