技能 setup-template
📦

setup-template

內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數

Align TypeScript Repositories with Their Template

Template-derived repositories can retain missing GitHub settings and incomplete migration work even when builds pass. This skill guides repository setup and evidence-based comparisons against the template.

支援: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求
Review the Skillstore skill "setup-template" from https://skillstore.io/skills/masseater-setup-template.md and its manifest at https://skillstore.io/api/skills/masseater-setup-template/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/masseater-setup-template.md 已簽名 manifest GET /api/skills/masseater-setup-template/manifest 已簽名 lockfile GET /api/skills/masseater-setup-template/lockfile

測試它

正在使用「setup-template」。 Illustrative assessment with a missing hook and an unsuccessful verification task.

預期結果:

  • Migration status: incomplete.
  • Git hooks: incomplete. The configured hook directory does not match the expected template location.
  • Verification: incomplete. The verification task failed; include the actual task output as evidence.
  • Next steps: correct the hook configuration and investigate the failed task before repeating the assessment.

正在使用「setup-template」。 Illustrative setup review where an existing ruleset requires tests before merging.

預期結果:

  • Existing protection: tests must pass before merging.
  • Template difference: the proposed ruleset requires only the up-to-date check.
  • Decision needed: preserve the existing test requirement rather than replacing it with weaker protection.
  • No settings changed.

安全審計

高風險
v1 • 2026/10/24 開啟版本化報告

Most static alerts are false positives from Markdown, Japanese text, or expected GitHub operations; installation and verification execute repository-controlled code. Check mode also applies remote configuration despite the stated inspection-only boundary. The prescribed ruleset replacement can remove stronger protections, while the template criteria place verification after merging rather than before.

4
已掃描檔案
244
分析行數
1
複核項目
0
已忽略的誤報

已確認的安全問題 (2)

高
usecases/setup.md:47-58usecases/setup.md:65-74references/typescript-template.md:79-83
Template Alignment Can Weaken Pre-Merge Protections
Setup replaces a same-named ruleset with deletion, force-push, and up-to-date protections only. The reference requires verification after main pushes and treats PR verification as obsolete, potentially removing stronger checks and allowing unverified changes onto main.
The replacement payload lists only freshness as a required status check, and the reference explicitly excludes PR verification. Existing stronger protections are not preserved.
中
SKILL.md:17usecases/check.md:9usecases/setup.md:9-42
Inspection Mode Applies Remote Configuration Changes
SKILL.md says inspection must not repair issues, but check step 5 directs the agent to apply the setup procedure. That procedure registers secrets and changes Actions permissions, merge settings, and branch rulesets, creating remote side effects during a requested assessment.
The check procedure explicitly directs configuration alignment, contradicting the stated inspection-only boundary. The referenced setup commands perform authenticated remote writes.
能力複核項目 (1)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

中
SKILL.md:43
Ruby/shell backtick execution
- `vp install` と `vp run verify` を実行する。verify が落ちたら、落ちたタスクとその出力を最初の欠けとして扱う
Although the backticks are Markdown, the prose explicitly directs execution of vp install and vp run verify. Repository-controlled scripts can run with agent privileges without a preceding trust review.

風險因素

⚙️ 外部命令 (8)
SKILL.md:8 SKILL.md:10 SKILL.md:30 SKILL.md:43 SKILL.md:51 SKILL.md:52 usecases/setup.md:57 usecases/setup.md:58
🌐 網路存取 (1)
SKILL.md:8
📁 檔案系統存取 (1)
usecases/check.md:7
🔑 環境變數 (2)
usecases/setup.md:14 usecases/setup.md:22
審計單位: codex
分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告
安全評估

複製報告連結

https://skillstore.io/skills/masseater-setup-template/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/masseater-setup-template/security.svg)](https://skillstore.io/skills/masseater-setup-template?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/masseater-setup-template?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/masseater-setup-template/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/masseater-setup-template.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
學術引用 (APA · BibTeX · CFF)

APA 引用

masseater. (2026). setup-template security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/masseater-setup-template/audits/1

BibTeX 引用

@techreport{masseater-masseater-setup-template-2026, author = {masseater}, title = {setup-template security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/masseater-setup-template/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "setup-template security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "masseater" date-released: "2026-10-24" url: "https://skillstore.io/skills/masseater-setup-template/audits/1" identifiers: - type: other value: "skillstore:masseater-setup-template:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據 證據置信度: 中
41
架構
85
可維護性
87
內容
65
社群
83
規範符合度

你可以打造什麼

Initialize a Template-Derived Repository

Configure repository automation, deployment identifiers, secret names, and branch settings after creating a repository from the template.

Assess an AI-Assisted Migration

Compare the migrated repository with template elements and collect evidence for missing hooks, ineffective checks, and leftover configuration.

Review Automation Configuration

Compare GitHub settings and CI behavior with template expectations while identifying differences that require explicit policy decisions.

試試這些提示

Review Setup Requirements 
List the setup steps for this template-derived repository. Identify required tools, permissions, and secret names without changing files or GitHub settings.
Configure an Approved Repository 
Prepare setup for [owner/repository]. Show proposed changes and existing protections first. Request approval before writes and use interactive secret entry.
Assess Migration Completeness 
Assess this migration against the template. Override setup-in-check behavior: report differences without repairs. Request approval before installation or verification, then provide evidence.
Compare Template and Security Policy 
Compare [owner/repository] with the template and our policy: [requirements]. Identify weaker rules, missing verification, and unsupported exceptions. Propose changes without applying them.

最佳實務

  • Confirm the target repository and review existing permissions and rulesets before approving setup changes.
  • Enter credentials through secure interactive prompts, and review repository scripts before running installation or verification.
  • Preserve stronger organizational protections and retain command evidence for every migration judgment.

避免

  • Treating the default check workflow as read-only despite its setup step.
  • Replacing stronger branch protections solely to match the template.
  • Declaring migration complete because builds pass without checking hooks, automation, and obsolete configuration.

常見問題

Which repositories does this skill target?
It targets repositories derived from masseater/typescript-template. Other repositories require confirmation of applicable steps before work begins.
What tools and permissions are needed?
GitHub CLI authentication and sufficient repository permissions are needed for setup. Local checks also use Vite+ and project-specific tooling.
Does check mode change anything?
Yes. It runs installation and verification and directs GitHub setup. Explicitly prohibit remote writes when requesting an assessment only.
How should I provide secrets?
Use GitHub CLI interactive prompts or approved secret management. Avoid placing secret values in chat, reports, or committed files.
Does template alignment guarantee secure branch protection?
No. The prescribed model relies on freshness checks before merging and verification afterward. Preserve stronger requirements from your organizational policy.
Are newer template features automatically migration defects?
No. The skill separates later template additions from missing migration elements and requires reasons for elements that do not apply.

開發者詳細資訊

作者

masseater

授權

MIT

Skillstore 修訂

r1

版本提示

作者未聲明版本。

儲存庫

https://github.com/masseater/skills/tree/4810c8f1186a229ca57d2f278c0a94f0fc862fec/skills/setup-template

引用

965badf91ae3b8f9a49183f5a56d91de6efc51ad

維護新鮮度

2026/10/24

使用量

0 次下載 · 0 次瀏覽

檔案結構

📁 references/

📄 typescript-template.md

📄 SKILL.md

📁 usecases/

📄 check.md

📄 setup.md

masseater 的更多技能

查看全部

相關技能

查看全部