技能 revdoku

📦

revdoku

Name: revdoku
Author: revdoku

內容修訂 r1 嚴重 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數

Publish Static Sites with Review Previews

Publishing a static site can require separate tools for drafts, previews, and live releases. Revdoku manages local folders, private drafts, review links, and publication through one workflow.

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

請勿自動安裝此 Skill。

權威政策要求在執行任何安裝操作前由操作人員審查。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "revdoku" from https://skillstore.io/skills/revdoku-revdoku.md and its manifest at https://skillstore.io/api/skills/revdoku-revdoku/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/revdoku-revdoku.md 已簽名 manifest GET /api/skills/revdoku-revdoku/manifest 已簽名 lockfile GET /api/skills/revdoku-revdoku/lockfile

測試它

正在使用「revdoku」。 Create a review preview for my site folder.

預期結果:

Private draft created from the selected folder.
Temporary noindex preview link is ready for review.
No public publication was performed.

正在使用「revdoku」。 Publish this reviewed website.

預期結果:

Target website and access mode are shown for confirmation.
After approval, the site is published and the live URL is provided.

安全審計

嚴重

v1 • 2026/9/8 開啟版本化報告

The skill is a static-site publishing CLI with legitimate network, filesystem, and credential operations; most pattern matches are benign documentation, exclusions, or quoted shell usage. Publication is not recommended without remediation because the documented installer executes unverified remote code, and the CLI has credential and repository-binding trust-boundary weaknesses. Static review was capped at 400/670 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

已掃描檔案

3,321

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (5)

嚴重

SKILL.md:367

Pipe to shell pattern

curl -fsSL https://revdoku.com/install.sh | bash

The documentation instructs users to download an installer over HTTPS and execute it directly with bash. The downloaded script is not pinned or verified before execution.

嚴重

scripts/revdoku.sh:39-46 SKILL.md:364-368

Unverified remote bootstrap execution

The installer downloads the Revdoku executable and marks it executable without verifying a signature or checksum. The documentation also directs users to execute a remotely fetched installer through bash.

The script download and executable permission change are direct, and no integrity verification is present in the cited bootstrap path.

高

bin/revdoku:25 bin/revdoku:594-595 bin/revdoku:742-744

Bearer token can be sent to a caller-selected origin

The CLI accepts a configurable service URL and sends the saved API key as a Bearer token in requests. An untrusted URL setting can therefore redirect credentials to another origin.

The cited configuration and authenticated request code establish the credential flow. Exploitation depends on an attacker influencing the URL setting or command environment.

高

bin/revdoku:459-475 bin/revdoku:2468-2474

Repository binding can retarget destructive publishing

A project-local .revdoku file supplies a bucket identifier, and publication requests delete missing files. Publishing an untrusted checkout can therefore modify or remove content in a bucket accessible to the user.

The local binding is read without an interactive target confirmation, and the cited publish payload requests deletion of absent files. Exploitation requires valid credentials and a user-initiated publish.

中

bin/revdoku:908-914

Existing credentials file permissions are not repaired

Saving an API key sets a restrictive umask but does not explicitly chmod an existing credentials file. A previously permissive file can retain its permissions after being overwritten with a new key.

The cited save routine establishes umask but lacks a permission repair step. The exposure requires an existing file with insecure mode on a shared system.

風險因素

⚙️ 外部命令 (50)

bin/revdoku:11 bin/revdoku:78 bin/revdoku:186 bin/revdoku:344 bin/revdoku:407 bin/revdoku:432 bin/revdoku:433 bin/revdoku:459 bin/revdoku:460 bin/revdoku:461 bin/revdoku:489 bin/revdoku:935 bin/revdoku:1015 bin/revdoku:1016 bin/revdoku:1017 bin/revdoku:1018 bin/revdoku:1020 bin/revdoku:1021 bin/revdoku:1022 bin/revdoku:1028 bin/revdoku:1172 bin/revdoku:1189 bin/revdoku:1667 bin/revdoku:2686 bin/revdoku:7 bin/revdoku:12 bin/revdoku:19 bin/revdoku:55 bin/revdoku:339 bin/revdoku:389 bin/revdoku:430 bin/revdoku:443 bin/revdoku:451 bin/revdoku:456 bin/revdoku:466 bin/revdoku:470 bin/revdoku:471 bin/revdoku:472 bin/revdoku:501 bin/revdoku:558 bin/revdoku:559 bin/revdoku:560 bin/revdoku:561 bin/revdoku:734 bin/revdoku:741 bin/revdoku:749 bin/revdoku:754 bin/revdoku:755 bin/revdoku:772 bin/revdoku:773

🌐 網路存取 (15)

bin/revdoku:4 bin/revdoku:123 bin/revdoku:340 bin/revdoku:1386 bin/revdoku:1523 bin/revdoku:1691 bin/revdoku:2176 scripts/revdoku.sh:7 scripts/revdoku.sh:9 SKILL.md:51 SKILL.md:53 SKILL.md:63 SKILL.md:360 SKILL.md:367 SKILL.md:414

📁 檔案系統存取 (50)

bin/revdoku:1665 bin/revdoku:5 bin/revdoku:14 bin/revdoku:464 bin/revdoku:466 bin/revdoku:1665 bin/revdoku:19 bin/revdoku:97 bin/revdoku:442 bin/revdoku:470 bin/revdoku:471 bin/revdoku:472 bin/revdoku:493 bin/revdoku:710 bin/revdoku:770 bin/revdoku:791 bin/revdoku:792 bin/revdoku:793 bin/revdoku:794 bin/revdoku:795 bin/revdoku:882 bin/revdoku:883 bin/revdoku:887 bin/revdoku:898 bin/revdoku:923 bin/revdoku:924 bin/revdoku:926 bin/revdoku:927 bin/revdoku:929 bin/revdoku:930 bin/revdoku:965 bin/revdoku:977 bin/revdoku:1125 bin/revdoku:1263 bin/revdoku:1266 bin/revdoku:1279 bin/revdoku:1343 bin/revdoku:1344 bin/revdoku:1345 bin/revdoku:1372 bin/revdoku:1373 bin/revdoku:1605 bin/revdoku:1606 bin/revdoku:1610 bin/revdoku:1627 bin/revdoku:1630 bin/revdoku:1631 bin/revdoku:1632 bin/revdoku:1670 bin/revdoku:1673

🔑 環境變數 (28)

偵測到的模式

Pipe to shell pattern

審計單位: claude

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/revdoku-revdoku/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/revdoku-revdoku/security.svg)](https://skillstore.io/skills/revdoku-revdoku?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/revdoku-revdoku?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/revdoku-revdoku/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/revdoku-revdoku.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

revdoku. (2026). revdoku security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/revdoku-revdoku/audits/1

BibTeX 引用

@techreport{revdoku-revdoku-revdoku-2026,
  author = {revdoku},
  title = {revdoku security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/revdoku-revdoku/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "revdoku security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "revdoku"
date-released: "2026-09-08"
url: "https://skillstore.io/skills/revdoku-revdoku/audits/1"
identifiers:
  - type: other
    value: "skillstore:revdoku-revdoku:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 低

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Review a marketing site before release

Create a private draft and share a temporary review preview before a public launch.

Deploy a static project folder

Upload a finished HTML, CSS, JavaScript, or SPA folder and publish it after review.

Share a protected client deliverable

Publish a static deliverable with password or email-gated access for a limited audience.

試試這些提示

Create a first draft

Create a simple static landing page in a new folder. Prepare it as a private Revdoku draft, not a public website.

Request a review preview

Upload the site in ./website as a private draft. Create a temporary noindex preview link and show me the URL.

Publish after confirmation

Review the files in ./dist. Explain what will be published, then ask for my confirmation before publishing it publicly.

Update a protected site safely

Check the Revdoku binding in this project. Show the target and changed files. After I confirm, update the existing password-protected website.

最佳實務

Create a private draft or preview before every public release.
Review the resolved bucket and changed files before approving publication.
Keep secrets outside the upload folder and verify exclusions before deployment.

避免

Do not publish an unreviewed folder from an untrusted repository.
Do not pass an untrusted service URL when using saved credentials.
Do not use the curl-to-bash installer until the downloaded artifact is verified.