技能 astrale-domain

📦

astrale-domain

Name: astrale-domain
Author: astrale-os

內容修訂 r1 安全 📁 檔案系統存取🌐 網路存取⚙️ 外部命令

Build and Maintain Astrale Domains

Astrale Domain development spans Schema, authorization, runtime, and deployment, which can become inconsistent. This skill guides focused changes and phased creation with explicit verification boundaries.

支援: Claude Codex Code(CC)

📊 76 尚可

Maintain this Skill? Claim it 📊 76 尚可

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "astrale-domain" from https://skillstore.io/skills/astrale-os-astrale-domain.md and its manifest at https://skillstore.io/api/skills/astrale-os-astrale-domain/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/astrale-os-astrale-domain.md 已簽名 manifest GET /api/skills/astrale-os-astrale-domain/manifest 已簽名 lockfile GET /api/skills/astrale-os-astrale-domain/lockfile

測試它

正在使用「astrale-domain」。 Review a proposed Issue.close callable.

預期結果:

Declare the callable input, output, authentication mode, and Policy in Schema.
Implement the admitted operation as a Workflow with named read and mutation steps.
Guard the state transition atomically rather than trusting the earlier read.
Test an allowed call, a Policy refusal, and a stale-state refusal.

正在使用「astrale-domain」。 Plan an upgrade where employees depends on agencies.

預期結果:

Rebuild employees against the candidate agencies Schema revision.
Deploy both candidates and verify their served release metadata.
Install both as explicit roots in one grouped operation after approval.
Inspect installed revisions and retained behavior; preserve operation identity if the outcome is unknown.

正在使用「astrale-domain」。 Diagnose a callable that works as Root but fails for a user.

預期結果:

Confirm the installed release, callable key, and registered caller identity.
Inspect the authenticated principal ceiling separately from caller Policy admission.
Verify the intended caller or self session and exact Domain requirements.
Repeat allowed and refused calls, then independently verify that refusal caused no effects.

安全審計

安全

v1 • 2026/10/10 開啟版本化報告

All 61 static findings are false positives in their documented context, including Markdown backticks, public discovery paths, and authorized deployment examples. Secret references configure deployment environments, and identity guidance explicitly prohibits private-key disclosure and unauthorized registration. No evidence found of prompt injection, credential exfiltration, or malicious intent in the reviewed files.

已掃描檔案

1,978

分析行數

複核項目

已忽略的誤報

風險因素

最近一次完成的靜態與語意稽核未偵測到已確認的安全發現。這並不能證明該 Skill 沒有副作用。

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/astrale-os-astrale-domain/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/astrale-os-astrale-domain/security.svg)](https://skillstore.io/skills/astrale-os-astrale-domain?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/astrale-os-astrale-domain?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/astrale-os-astrale-domain/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/astrale-os-astrale-domain.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

astrale-os. (2026). astrale-domain security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/astrale-os-astrale-domain/audits/1

BibTeX 引用

@techreport{astrale-os-astrale-os-astrale-domain-2026,
  author = {astrale-os},
  title = {astrale-domain security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/astrale-os-astrale-domain/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "astrale-domain security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "astrale-os"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/astrale-os-astrale-domain/audits/1"
identifiers:
  - type: other
    value: "skillstore:astrale-os-astrale-domain:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Create a Business Domain

Guide an application developer through project inspection, Schema design, callable implementation, sample data, and verification.

Review Authorization Boundaries

Help a security engineer examine callable admission, caller and principal authority, group membership, and refusal evidence.

Qualify a Coordinated Release

Help a release engineer plan coherent dependency upgrades, grouped installs, rollback constraints, and installed-behavior checks.

試試這些提示

Inspect an Existing Domain

Inspect this Astrale Domain project. Identify its Schema, runtime, environments, and verification commands. Explain missing prerequisites without deploying or changing secrets.

Add a Protected Callable

Add [operation] to [Class] using the installed SDK. Declare Schema-owned authorization and runtime behavior. Add allowed and refused tests without deploying.

Implement an External Integration

Implement [provider operation] through an Integration and Provider. Keep secrets environment-owned. Validate responses and test effects and failure behavior without claiming exactly-once delivery.

Plan a Dependency Migration

Plan [Schema change] across affected Domains. Inspect installed revisions, design staged data migration, and specify grouped installs and rollback checks. Require approval before mutations.

最佳實務

Inspect current source and installed public SDK exports before choosing API syntax.
Keep authorization in Schema, secrets in deployment environments, and tests focused on allowed and refused behavior.
Verify build, served release, installed revision, and live invocation separately before reporting deployment success.

避免

Do not weaken authentication or add handler authorization substitutes to make a failing test pass.
Do not put secrets in Schema, logs, test snapshots, source files, or command arguments.
Do not install coherent dependencies sequentially or treat deployment as installation.

常見問題

What does this skill provide?

It provides task-routed guidance for Astrale Domain authoring, authorization, runtime, Views, testing, migration, deployment, and debugging.

Which AI tools are supported?

The marketplace lists Claude, Codex, and Claude Code. Project execution still depends on your installed Astrale tools and permissions.

Does it include the Astrale SDK or CLI?

No. It contains Markdown instructions and references. Install compatible public SDK, CLI, and adapter packages for implementation and live verification.

Does deployment update an instance?

No. Deployment creates a release endpoint. Installation separately changes the release pinned on the chosen instance.

How should secrets be handled?

Keep secrets in their owning deployment environment. Avoid source, logs, test evidence, and command arguments. Use private files or secret-manager input.

Can it guarantee safe migrations or exactly-once delivery?

No. Migration support depends on public SDK contracts, and the inline Workflow runner does not provide durable replay or exactly-once execution.