技能 Error Resolver
📦
Error Resolver
內容修訂 r1 嚴重 ⚡ 包含腳本⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數
透過根本原因分析解決錯誤
當錯誤訊息缺乏脈絡時，除錯會浪費時間。此技能會引導錯誤分類、根本原因分析、修正、驗證，以及可重用解決方案記錄。
支援: Claude Codex Code(CC)
請勿自動安裝此 Skill。
權威政策要求在執行任何安裝操作前由操作人員審查。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "Error Resolver" from https://skillstore.io/skills/davila7-error-resolver.md and its manifest at https://skillstore.io/api/skills/davila7-error-resolver/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「Error Resolver」。 Node.js 應用程式在複製儲存庫後回報找不到必要套件。
預期結果:
此技能會識別依賴項設定問題、檢查套件中繼資料、建議安裝依賴項，並驗證應用程式啟動。
正在使用「Error Resolver」。 Docker 容器無法寫入已掛載的資料目錄。
預期結果:
此技能會區分權限、擁有權和 volume 相關原因，接著在進行廣泛權限變更前，建議更安全的擁有權對齊方式。
正在使用「Error Resolver」。 API 請求在 token 輪替後回傳未授權錯誤。
預期結果:
此技能會檢查 token 是否存在、格式、到期時間、scopes 和重試行為，接著定義驗證和預防步驟。
安全審計
嚴重v11 • 2026/7/19 開啟版本化報告
Most static detections are Markdown examples, language syntax, or diagnostic placeholders rather than executable malware. Confirmed risks remain in agent-actionable troubleshooting recipes: privileged commands, SSH private key access, TLS verification bypass, broad chmod fixes, process or container termination, and untrusted replay application.
14
已掃描檔案
6,628
分析行數
21
複核項目
0
已忽略的誤報
已確認的安全問題 (18)
嚴重
SSH directory access
ssh-add ~/.ssh/id_ed25519 # Or your key file
The guidance directs access to the user SSH directory for a private key. This is sensitive credential material.
嚴重
SSH private key file
ssh-add ~/.ssh/id_ed25519 # Or your key file
The guidance references ~/.ssh/id_ed25519, which is a private SSH key file. Access to this file is a critical sensitive-data risk.
高
Weak cryptographic algorithm
# Change 'peer' to 'md5' or 'scram-sha-256' for password auth
The PostgreSQL guidance offers md5 authentication as an option. MD5 is a weak authentication choice and should be replaced with scram-sha-256.
高
Overly permissive chmod
chmod 777 /host/path # Not recommended for production
The volume fix includes chmod 777 on a host path. World-writable permissions can expose or corrupt local data.
高
Environment file access
process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'
The flagged line is not an environment file, but it disables TLS certificate verification through process.env. The security impact is real.
高
Overly permissive chmod
- "chmod 777 /host/path" # Quick but not secure
The replay example records chmod 777 as an immediate fix. Replaying that solution could create world-writable host paths.
高
Replay Records Can Drive Untrusted Fix Actions
The replay lookup tells the agent to search `.claude/error-solutions/` and apply a recorded solution. Repository-controlled replay files could steer an agent toward unsafe commands if not reviewed.
The workflow explicitly says to apply recorded solutions from project files. This is useful, but it creates a clear trust boundary for repository-controlled instructions.
高
Destructive Git Recovery Recipes Risk Data Loss
The Git troubleshooting guide presents discard and hard reset commands as recovery options. These can delete uncommitted work if an agent applies them without user confirmation.
The commands are explicit and destructive, although labeled careful. This is a concrete integrity risk for agent-assisted debugging.
顯示全部 18 條已確認問題
中
Debug Commands Can Expose Environment Secrets
The general debugging section recommends environment-variable inspection commands. If copied into chat or stored in replay records, this can disclose secrets such as tokens or passwords.
The command list includes environment variable inspection. The risk depends on the selected variable, so confidence is high enough to warn but not critical.
低
Network reconnaissance
netstat -an | grep 5432
The guidance recommends netstat to inspect a local database port. This is legitimate troubleshooting, but it collects host network state and should remain user-approved.
低
Network reconnaissance
netstat -tulpn | grep 3000
The guidance recommends netstat to identify local port listeners. This is useful troubleshooting, but it collects host network state.
低
Network reconnaissance
netstat -an | grep 3000
The guidance recommends netstat to inspect local port listeners. This gathers host network state and should be user-approved.
低
System reconnaissance
nslookup hostname
The guidance recommends nslookup for a hostname. This is normal diagnosis, but it performs network reconnaissance about the target name.
低
System reconnaissance
dig hostname
The guidance recommends dig for a hostname. This is normal diagnosis, but it queries DNS information about the target name.
低
System reconnaissance
ping hostname
The guidance recommends ping for a hostname. This is normal diagnosis, but it probes network reachability.
低
System reconnaissance
curl -I https://hostname
The guidance recommends curl -I against a hostname. This makes an outbound diagnostic request and should be user-approved.
低
Network reconnaissance
netstat -an | grep 3000
The guidance recommends netstat to inspect local port listeners. This gathers host network state and should be user-approved.
低
Network reconnaissance
netstat -an | grep [port]
The top-level debug command list recommends netstat for port usage. This collects local network state and should be user-approved.
能力複核項目 (21)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
sudo privilege escalation
sudo systemctl start postgresql # Linux
The solution recommends sudo systemctl start postgresql, which performs a privileged system service action. In an agent-executed skill this needs explicit user approval.
高
sudo privilege escalation
sudo systemctl start mysql # Linux
The solution recommends sudo systemctl start mysql, which performs a privileged system service action. In an agent-executed skill this needs explicit user approval.
高
sudo privilege escalation
sudo -u postgres psql
The solution recommends sudo -u postgres psql for database administration. This can alter database users or credentials if followed without confirmation.
高
sudo privilege escalation
sudo systemctl start mongod # Linux
The solution recommends sudo systemctl start mongod, which performs a privileged service action on the host. Agent execution should be gated by user confirmation.
高
sudo privilege escalation
sudo systemctl start redis # Linux
The solution recommends sudo systemctl start redis, which performs a privileged service action on the host. Agent execution should be gated by user confirmation.
高
sudo privilege escalation
sudo systemctl start docker
The solution recommends sudo systemctl start docker, a privileged host service action. Agent execution should require clear confirmation.
高
sudo privilege escalation
sudo usermod -aG docker $USER
The guidance recommends adding the user to the docker group. Docker group membership can effectively grant root-equivalent host control.
高
sudo privilege escalation
# Run with sudo (not recommended for regular use)
The permission workaround suggests running Docker with sudo. This gives the command elevated host privileges and is unsafe as a default fix.
高
sudo privilege escalation
sudo docker ps
The example sudo docker ps still normalizes elevated Docker usage. Docker commands with sudo should require explicit user consent.
高
sudo privilege escalation
sudo usermod -aG docker $USER
The guidance recommends adding the user to the docker group. Docker group membership can grant broad host control through Docker.
高
Hidden file in home directory
ssh-add ~/.ssh/id_ed25519 # Or your key file
The command references ~/.ssh/id_ed25519, a private SSH key path under a hidden home directory. Agent access to that path is sensitive.
高
Hidden file access
ssh-add ~/.ssh/id_ed25519 # Or your key file
The command references ~/.ssh/id_ed25519, a private SSH key path. Even normal ssh-agent use should be user-approved.
高
Environment variable access (dot notation)
process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'
The code sets NODE_TLS_REJECT_UNAUTHORIZED to 0. This disables TLS certificate verification and can expose traffic to interception.
高
Environment variable object
process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'
The code modifies process.env to disable TLS certificate verification. This weakens transport security even if labeled development-only.
高
sudo privilege escalation
sudo chown $USER:$USER /path/to/file
The fix recommends sudo chown on an arbitrary path. This can change ownership of files outside the project and needs explicit approval.
高
sudo privilege escalation
sudo chown -R $USER /usr/local/lib/node_modules
The fix recommends recursive sudo chown on /usr/local/lib/node_modules. Recursive ownership changes on system paths are high risk.
高
sudo privilege escalation
sudo chown $USER:$USER /path/to/file
The fix recommends sudo chown on an arbitrary path. This can change ownership of files outside the project and needs explicit approval.
中
Shell command substitution
docker stop $(docker ps -q --filter publish=3000)
The command uses docker stop with command substitution over running containers. It can stop local containers and should not run automatically.
中
Shell command substitution
kill $(lsof -t -i:3000)
The command uses kill with command substitution from lsof. It can terminate a local process selected by port and needs explicit approval.
中
Unix shell invocation
docker run -it image_name /bin/sh
The recipe opens an interactive shell inside a container. This is a normal debug action, but it is still command execution in the target environment.
中
Shell command substitution
eval "$(ssh-agent -s)"
The command evaluates ssh-agent output in the shell. It is common Git setup, but it is still shell evaluation and should not be automatic.
風險因素
⚡ 包含腳本 (4)
⚙️ 外部命令 (50)
analysis/root-cause.md:299-302 patterns/database.md:209 patterns/database.md:457-458 patterns/database.md:43 patterns/database.md:47 patterns/database.md:71 patterns/database.md:419 patterns/database.md:495 patterns/docker.md:229 patterns/docker.md:232 patterns/docker.md:79 patterns/docker.md:175 patterns/docker.md:543 patterns/docker.md:123 patterns/docker.md:129 patterns/docker.md:245 patterns/docker.md:246 patterns/docker.md:249 patterns/git.md:79 patterns/network.md:68-75 patterns/network.md:75-81 patterns/network.md:81-87 patterns/network.md:140-145 patterns/network.md:574-579 patterns/network.md:579-583 patterns/nodejs.md:498-500 patterns/nodejs.md:212 patterns/nodejs.md:215 patterns/python.md:394 patterns/react.md:242-243 patterns/react.md:272-274 patterns/rust.md:360 patterns/rust.md:369 patterns/rust.md:418 patterns/rust.md:36-37 patterns/rust.md:70-71 patterns/rust.md:95-96 patterns/rust.md:163-165 patterns/rust.md:165 patterns/rust.md:197 patterns/rust.md:224-225 patterns/rust.md:254-255 patterns/rust.md:255-256 patterns/rust.md:280 patterns/rust.md:314 patterns/rust.md:315 patterns/rust.md:350-351 patterns/rust.md:380-381 patterns/rust.md:405-406 patterns/rust.md:430-435
🌐 網路存取 (43)
patterns/database.md:10 patterns/database.md:412 patterns/database.md:488 patterns/docker.md:210 patterns/docker.md:307 patterns/docker.md:315 patterns/git.md:90 patterns/git.md:99 patterns/network.md:34 patterns/network.md:66 patterns/network.md:74 patterns/network.md:80 patterns/network.md:140 patterns/network.md:188 patterns/network.md:209 patterns/network.md:274 patterns/network.md:382 patterns/network.md:412 patterns/network.md:449 patterns/network.md:514 patterns/network.md:560 patterns/network.md:570 patterns/network.md:26 patterns/network.md:130 patterns/network.md:133 patterns/network.md:134 patterns/network.md:163 patterns/network.md:167 patterns/network.md:327 patterns/network.md:470 patterns/network.md:484 patterns/network.md:490 patterns/network.md:506 patterns/network.md:314 patterns/nodejs.md:140 patterns/nodejs.md:279 patterns/nodejs.md:134 patterns/nodejs.md:135 patterns/nodejs.md:109 patterns/nodejs.md:65 patterns/react.md:202 replay/README.md:265 replay/README.md:275
📁 檔案系統存取 (15)
patterns/docker.md:195 patterns/git.md:80 patterns/git.md:86 patterns/git.md:80 patterns/git.md:86 patterns/network.md:447 patterns/network.md:447 patterns/nodejs.md:443 patterns/nodejs.md:446 patterns/nodejs.md:453 patterns/nodejs.md:174 patterns/nodejs.md:246 patterns/nodejs.md:482 patterns/nodejs.md:239 patterns/nodejs.md:239
偵測到的模式
Weak cryptographic algorithmNetwork reconnaissance×5Overly permissive chmod×2SSH directory accessSSH private key fileSystem reconnaissance×4
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/davila7-error-resolver/audits/11?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/davila7-error-resolver?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/davila7-error-resolver?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-error-resolver/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/davila7-error-resolver.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
davila7. (2026). Error Resolver security audit report (audit version 11) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-error-resolver/audits/11BibTeX 引用
@techreport{davila7-davila7-error-resolver-2026,
author = {davila7},
title = {Error Resolver security audit report (audit version 11)},
institution = {Skillstore},
year = {2026},
number = {11},
url = {https://skillstore.io/skills/davila7-error-resolver/audits/11},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "Error Resolver security audit report (audit version 11)"
version: "unspecified"
type: report
authors:
- name: "davila7"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/davila7-error-resolver/audits/11"
identifiers:
- type: other
value: "skillstore:davila7-error-resolver:audit:11"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
87
內容
82
社群
74
規範符合度
你可以打造什麼
診斷執行階段失敗
分類執行階段錯誤、追蹤可能原因，並選擇最安全的修復路徑。
解決基礎設施錯誤
透過結構化檢查和驗證，分析 Docker、資料庫、Git 和網路失敗。
建立除錯記憶
將成功修正記錄為可重用的 replay 記錄，用於反覆出現的專案問題。
試試這些提示
分類此錯誤
依類型、嚴重性、範圍和可能來源分類此錯誤。說明在建議修正前仍需要哪些細節。
找出根本原因
針對此錯誤和堆疊追蹤使用五問法分析。找出根本原因、促成因素，以及最安全的即時修正。
建立已驗證的修正計畫
診斷此失敗，並提供即時修正步驟、適當修正步驟、驗證檢查和預防措施。
準備 Replay 記錄
將此已解決事件轉換為可重用的 replay 記錄，包含標準化簽章、脈絡、診斷、解決方案、驗證和標籤。
最佳實務
- 提供完整錯誤、堆疊追蹤、近期變更，以及觸發失敗的命令。
- 執行前審查每個命令，尤其是會變更權限、服務、檔案或憑證的命令。
- 只記錄已驗證的解決方案，並保持 replay 記錄簡短、具體且最新。
避免
- 當環境、依賴項版本或錯誤脈絡已變更時，不要盲目套用已記錄的解決方案。
- 不要將機密、私密金鑰、完整環境傾印或生產環境 token 貼到疑難排解請求中。
- 不要將廣泛權限變更或破壞性 Git 命令作為第一線修正。
常見問題
此技能可以分析哪些類型的錯誤？
它涵蓋語言錯誤、堆疊追蹤、依賴項失敗、Docker 問題、資料庫錯誤、Git 問題，以及網路或 API 失敗。
它會自動執行命令嗎？
此技能包含命令範例。使用者應在執行前核准命令，尤其是具特權或破壞性的命令。
replay 系統是什麼？
Replay 記錄會儲存標準化錯誤簽章、診斷、修正和驗證步驟，讓反覆出現的問題能更快處理。
沒有堆疊追蹤也能運作嗎？
可以，但如果提供完整訊息、堆疊追蹤、近期變更和受影響的程式碼路徑，準確度會提高。
應如何處理機密？
分享日誌或命令輸出前，請遮蔽 token、密碼、私密金鑰和環境值。
它適合用於生產環境事件嗎？
它可以結構化生產環境分流，但變更應遵循你的審查、核准、備份和回復流程。