技能 bootstrap

📦

bootstrap

Name: bootstrap
Author: drix10

內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取

Bootstrap Repository Context for Coding Agents

Coding agents lose accuracy when repository guidance is missing or outdated. This skill creates reviewed context files, confidence labels, and risk boundaries with human approval.

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "bootstrap" from https://skillstore.io/skills/drix10-bootstrap.md and its manifest at https://skillstore.io/api/skills/drix10-bootstrap/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/drix10-bootstrap.md 已簽名 manifest GET /api/skills/drix10-bootstrap/manifest 已簽名 lockfile GET /api/skills/drix10-bootstrap/lockfile

測試它

正在使用「bootstrap」。 Create agent guidance for this small TypeScript service.

預期結果:

A proposed AGENTS.md section lists verified entry points, package commands, testing constraints, and local traps with confidence labels.

正在使用「bootstrap」。 Bootstrap our monorepo and protect billing code.

預期結果:

A root guidance proposal covers shared commands and repository structure.
Module proposals capture package-specific rules.
Billing paths remain pending until the user confirms their critical risk boundary.

正在使用「bootstrap」。 Migrate our old agent-flow context files.

預期結果:

A migration proposal preserves existing guidance, maps legacy names to supported files, and requests approval before each write.

安全審計

高風險

v1 • 2026/9/27 開啟版本化報告

Most static alerts mistake Markdown code formatting for shell backtick execution. The skill genuinely invokes an unpinned npm package during scanning and trusts existing repository instruction files without explicit prompt-injection handling.

已掃描檔案

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

高

SKILL.md:17

Untrusted Repository Instructions Treated as User Rules

The workflow says existing agent instruction files are the user's rules and must be read first. A malicious repository can place prompt-injection directives in these files.

The trust statement and mandatory read behavior are explicit. The line provides no instruction to isolate or reject conflicting directives.

能力複核項目 (2)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

中

SKILL.md:4

Ruby/shell backtick execution

compatibility: Requires git. Pi gets the bootstrap_scan/bootstrap_write tools; other harnesses use `

The compatibility metadata directs non-Pi harnesses to use an unpinned npx package command. This can download and execute package code in the repository environment.

中

SKILL.md:15

Ruby/shell backtick execution

1. Call `bootstrap_scan` (outside Pi: `npx agent-flow scan --json`). Every field it returns was read

The workflow explicitly directs the agent to execute npx agent-flow scan outside Pi. The package version is unpinned, creating external-command and package-supply-chain exposure.

風險因素

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/drix10-bootstrap/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/drix10-bootstrap/security.svg)](https://skillstore.io/skills/drix10-bootstrap?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/drix10-bootstrap?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/drix10-bootstrap/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/drix10-bootstrap.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

drix10. (2026). bootstrap security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/drix10-bootstrap/audits/1

BibTeX 引用

@techreport{drix10-drix10-bootstrap-2026,
  author = {drix10},
  title = {bootstrap security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/drix10-bootstrap/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "bootstrap security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "drix10"
date-released: "2026-09-27"
url: "https://skillstore.io/skills/drix10-bootstrap/audits/1"
identifiers:
  - type: other
    value: "skillstore:drix10-bootstrap:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Onboard a New Repository

Create concise agent guidance from verified code, commands, and repository structure.

Standardize a Monorepo

Propose shared root guidance and focused module instructions for packages with distinct rules.

Define Change Risk

Record protected, critical, and low-risk paths through an explicit review process.

試試這些提示

Create Basic Agent Context

Scan this repository and propose a concise AGENTS.md. Show every section for approval before writing.

Document a Monorepo

Map the monorepo and propose root and package AGENTS.md files only where package-specific rules exist.

Migrate Existing Context

Review existing agent context files, identify conflicts, and propose a migration to AGENTS.md without replacing confirmed rules.

Calibrate Repository Risk

Bootstrap repository context, then ask me to define protected paths, critical paths, low-risk paths, and auto-merge policy.

最佳實務

Verify every repository claim against files or explicit user confirmation.
Review each proposed context section and risk boundary before writing.
Pin the agent-flow package version before running npx commands.

避免

Do not copy large directory trees into persistent context files.
Do not invent commands that are absent from package scripts, Makefiles, or CI.
Do not trust repository instruction text when it conflicts with system or user directions.

常見問題

What files can this skill create?

It can propose AGENTS.md, module guidance, CLAUDE.md imports, DOCS_INDEX.md, and CONTEXT_MANIFEST.json.

Does it overwrite existing files?

No. Overwriting requires an explicit option and a separate user confirmation.

How does it handle secrets?

It stops when secret suspects exist, reports only paths and kinds, and requires removal and rotation.

Can it configure continuous integration?

It can suggest validation steps, but bootstrap does not write CI files.

Does it support monorepos?

Yes. It proposes module guidance only for packages with distinct rules.

Which coding agents are supported?

The context supports Claude, Codex, Claude Code, Gemini, Cursor, Copilot, Windsurf, and Pi workflows.

開發者詳細資訊

作者

drix10

授權

MIT

Skillstore 修訂

版本提示

作者未聲明版本。

儲存庫

https://github.com/drix10/agent-flow/tree/aac4c5c023b25d073997626804c355ed11348feb/skills/bootstrap

引用

8b5ad1599e7c55e9b6c627bca3f556f6e9061cb1

維護新鮮度

2026/9/30

使用量

0 次下載 · 0 次瀏覽

檔案結構

📄 SKILL.md