技能 captain-obvious

📦

captain-obvious

Name: captain-obvious
Author: shmulc8

內容修訂 r1 中風險 📁 檔案系統存取⚙️ 外部命令⚡ 包含腳本🌐 網路存取

Audit TypeScript and Python Test Quality

Redundant assertions can inflate confidence without protecting observable behavior. Captain Obvious combines deterministic scanners with contextual review and a test-authoring contract checklist.

支援: Claude Codex Code(CC)

⚠️ 50 差

Maintain this Skill? Claim it ⚠️ 50 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "captain-obvious" from https://skillstore.io/skills/shmulc8-captain-obvious.md and its manifest at https://skillstore.io/api/skills/shmulc8-captain-obvious/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/shmulc8-captain-obvious.md 已簽名 manifest GET /api/skills/shmulc8-captain-obvious/manifest 已簽名 lockfile GET /api/skills/shmulc8-captain-obvious/lockfile

測試它

正在使用「captain-obvious」。 Review a Python test that assigns a local value of five and immediately checks that it equals five.

預期結果:

Finding: local constant echo.
Reason: the assertion repeats the test arrangement and does not inspect production behavior.
Next step: identify the intended contract before replacing or removing the test.

正在使用「captain-obvious」。 Review a TypeScript promise rejection assertion that is not awaited.

預期結果:

Finding: advisory asynchronous assertion.
Reason: failure behavior depends on the test runner, and the assertion is not awaited.
Proposal: await the assertion, then run the focused test after approval.

正在使用「captain-obvious」。 Review a conditional assertion when coverage shows that its line never executed.

預期結果:

Finding: conditional assertion promoted to proven by coverage.
Reason: the supplied coverage report records zero executions for the assertion line.
Proposal: investigate the guard and preserve the intended contract. Do not automatically delete this report-only finding.

安全審計

中風險

v1 • 2026/10/21 開啟版本化報告

Most static alerts are false positives involving documentation, template literals, AST identifiers, or legitimate toolchain operations. Confirmed risks involve shadow-file overwrite and deletion, plus symlink-following report writes to documented predictable temporary paths. The fix guards also permit irreversible changes to untracked tests; no evidence found of credential exfiltration or prompt injection.

已掃描檔案

3,933

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

中

scripts/co_py/gitguard.py:24-32 scripts/co_ts/gitguard.mjs:23-30 scripts/co_py/fixer.py:155-156 scripts/co_ts/fixer.mjs:88-92

Untracked Tests Bypass Recovery Safeguards

Both Git guards use --untracked-files=no, but test discovery includes untracked files. --fix can overwrite those tests without backups or Git restoration.

Both guards explicitly exclude untracked files, while discovery and fixers do not restrict edits to tracked targets. Neither fixer creates recovery backups.

能力複核項目 (7)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

中

scripts/captain_obvious_py.py:285

Python file write/append

with open(args.json, "w") as fh:

The report writer truncates its destination and follows symlinks. The documented predictable /tmp destination permits another local actor to redirect this write.

中

scripts/captain_obvious_ts.mjs:245

Node.js fs operations

if (jsonOut) fs.writeFileSync(jsonOut, JSON.stringify(report, null, 2));

writeFileSync follows symlinks and truncates existing destinations. Combined with the documented predictable /tmp path, this allows local report-write redirection.

中

scripts/captain_obvious_ts.mjs:245

Synchronous file operations

if (jsonOut) fs.writeFileSync(jsonOut, JSON.stringify(report, null, 2));

The report write follows existing symlinks and truncates their targets. The documented fixed /tmp output path makes this a local overwrite risk.

中

scripts/co_py/mypy_pass.py:167

Python file write/append

with open(shadow, "w", encoding="utf-8") as f:

The predictable shadow path is opened with truncation after only a symlink check. Existing regular files or hard-linked targets can be overwritten during scanning.

中

scripts/co_py/mypy_pass.py:271

Python os file operations

os.remove(s)

Cleanup removes every recorded shadow path, including paths that existed before the scan and were truncated. Existing file contents are lost without recovery.

中

SKILL.md:72

Temp directory access

node <skill-dir>/scripts/captain_obvious_ts.mjs --project <repo> --json /tmp/co-ts.json

The documented command writes to predictable /tmp/co-ts.json. An existing symlink can redirect the truncating report write to another writable file.

中

SKILL.md:73

Temp directory access

python3 <skill-dir>/scripts/captain_obvious_py.py --path <repo> --json /tmp/co-py.json

The documented command writes to predictable /tmp/co-py.json. An existing symlink can redirect Python's truncating report write to another writable file.

風險因素

📁 檔案系統存取 (43)

⚙️ 外部命令 (50)

⚡ 包含腳本 (3)

scripts/captain_obvious_ts.mjs:78 scripts/captain_obvious_ts.mjs:80 scripts/co_py/analyzer.py:7-19

🌐 網路存取 (1)

scripts/co_py/analyzer.py:570

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/shmulc8-captain-obvious/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/shmulc8-captain-obvious/security.svg)](https://skillstore.io/skills/shmulc8-captain-obvious?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/shmulc8-captain-obvious?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/shmulc8-captain-obvious/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/shmulc8-captain-obvious.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

shmulc8. (2026). captain-obvious security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/shmulc8-captain-obvious/audits/1

BibTeX 引用

@techreport{shmulc8-shmulc8-captain-obvious-2026,
  author = {shmulc8},
  title = {captain-obvious security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/shmulc8-captain-obvious/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "captain-obvious security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "shmulc8"
date-released: "2026-10-21"
url: "https://skillstore.io/skills/shmulc8-captain-obvious/audits/1"
identifiers:
  - type: other
    value: "skillstore:shmulc8-captain-obvious:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Review Generated Test Suites

Find tautologies and mock echoes in generated tests, then review advisory findings against the production behavior.

Maintain Shared Test Standards

Use contract questions and documented detector categories to distinguish meaningful regression checks from redundant assertions during review.

Compare Test Changes in CI

Compare supported proven syntactic findings against a Git baseline without enabling fixes. Comparison errors return success with a diagnostic.

試試這些提示

Review One Python Test

Review this Python test using the authoring questions. Identify its observable contract and a plausible regression. Do not run commands or edit files.

Run a Report-Only Python Audit

Audit this trusted Python repository with --no-types and without --fix. Use stdout instead of a report file. Summarize findings without deleting tests.

Review Coverage-Based Findings

Audit this trusted TypeScript project using its existing coverage report. Separate proven and advisory findings. Propose advisory changes for approval; do not edit files.

Plan a Baseline Quality Check

Review the --check workflow for this trusted repository against [base]. Explain fail-open behavior and excluded categories. Propose a report-only CI command for approval.

最佳實務

Scan only trusted repositories, start without fixes, and avoid predictable shared temporary report paths.
Back up untracked tests and existing shadow-named files before scanning or fixing; Python --no-types avoids shadow-file creation.
Review each proposed deletion against its contract, obtain approval for advisory edits, and run type checks and tests afterward.

避免

Treating a clean scanner report as proof that every test can detect meaningful regressions.
Deleting advisory findings or weakening security contract tests solely because their assertions look repetitive.
Using --force, trusting Git cleanliness for untracked files, or running repository toolchains without reviewing their trust boundary.

常見問題

Which languages and test styles are supported?

The bundled scanners target TypeScript and JavaScript Jest-style or Vitest-style tests, plus Python pytest and unittest patterns.

Does scanning execute my tests?

The scanners parse tests rather than run the test suite. They can load repository TypeScript code or execute mypy plugins and environment commands.

Can I scan without modifying Python files?

Use --no-types without --fix or a file output option. Single-file Python mode also parses source without mypy shadow files.

Are all findings automatically deleted?

No. Explicit --fix targets findings marked safe. Advisory and report-only findings require review, and advisory edits require user approval.

What does coverage input add?

Coverage can confirm that a conditional assertion never executed or suppress a finding when it did. The report must include test-file lines.

Can the baseline check enforce every finding?

No. It compares newly introduced proven syntactic findings. Type-dependent and coverage-dependent categories are excluded, and comparison failures return success with diagnostics.