技能 xget
📦
xget
內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取🔑 環境變數
使用 Xget 加速下載
開發者經常需要更快地存取上游套件、容器和 API 資源。此技能可協助轉換 URL，並在常見工具中套用 Xget 設定。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "xget" from https://skillstore.io/skills/xixu-me-xget.md and its manifest at https://skillstore.io/api/skills/xixu-me-xget/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「xget」。 使用我的 Xget 基底 URL 轉換 GitHub 儲存庫 URL。
預期結果:
重寫後的 Xget URL、相符的平台前綴，以及在上游 URL 不受支援時提供的簡短說明。
正在使用「xget」。 顯示我的 Xget 部署的 Docker Compose 指引。
預期結果:
聚焦的設定區段，其中公開示範主機會替換為要求的 Xget 主機。
正在使用「xget」。 設定我的專案，讓 npm 安裝使用 Xget。
預期結果:
簡潔的變更摘要、受影響的設定檔，以及驗證命令或檢查結果。
安全審計
高風險v5 • 2026/7/8 開啟版本化報告
Most script command-execution alerts are false positives from JavaScript template literals, and most placeholder URL alerts are benign documentation. Real risks remain because the skill fetches live remote guidance, encourages execution-first behavior, writes persistent shell profiles, and targets credential-bearing config files. Publication should require confirmation gates and stronger source-trust controls.
3
已掃描檔案
1,232
分析行數
16
複核項目
0
已忽略的誤報
已確認的安全問題 (5)
高
Environment file access
- `.env`, SDK initialization code, shell profile files
The skill lists .env, SDK initialization code, and shell profile files as targets for project changes. These files can contain secrets or sensitive runtime configuration.
高
NPM config file (may contain tokens)
- `.npmrc`, `pip.conf`, `NuGet.Config`, `.cargo/config.toml`, `.condarc`
The skill lists .npmrc and similar package manager config files as targets for edits. These files often contain registry tokens, so execution-first edits create credential exposure and corruption risk.
高
Environment file access
example, pair a package-manager section with container, deployment, or `.env`
The skill recommends pairing package-manager work with .env guidance when needed. Because .env files often contain secrets, this target deserves review safeguards.
高
Remote Live Guidance Can Drive Local Changes
The skill tells agents to fetch live README guidance and adapt it to the user project. The helper downloads platform and README data from raw.gitcode.com, so changed or compromised upstream content can influence local edits.
The cited instructions require live README lookup before applying changes, and the helper contains default remote URLs used by topics and snippet. This is a clear remote-content trust boundary.
高
Execution-First Workflow Encourages Persistent Changes
The skill instructs agents to run commands, edit real files, and apply changes end to end. The reference guide includes persistent shell profile setup, which can modify future user sessions.
Multiple cited sections explicitly prefer execution over examples and include commands that persist environment variables in shell profile files. The risk is behavioral and not fully captured by single-line pattern matches.
能力複核項目 (16)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Hidden file in home directory
echo 'export XGET_BASE_URL="https://xget.example.com"' >> ~/.bashrc
The referenced command appends XGET_BASE_URL to ~/.bashrc, a hidden shell startup file. Persistent profile edits can alter future shell behavior and should require explicit confirmation.
高
Hidden file in home directory
echo 'export XGET_BASE_URL="https://xget.example.com"' >> ~/.zshrc
The referenced command appends XGET_BASE_URL to ~/.zshrc, a hidden shell startup file. Persistent profile edits can alter future shell behavior and should require explicit confirmation.
高
Hidden file access
echo 'export XGET_BASE_URL="https://xget.example.com"' >> ~/.bashrc
The command writes directly to ~/.bashrc as part of persistent setup. This is legitimate configuration, but it is a real filesystem modification with persistence risk.
高
Hidden file access
echo 'export XGET_BASE_URL="https://xget.example.com"' >> ~/.zshrc
The command writes directly to ~/.zshrc as part of persistent setup. This is legitimate configuration, but it is a real filesystem modification with persistence risk.
中
Ruby/shell backtick execution
Prefer [`scripts/xget.mjs`](./scripts/xget.mjs) over manual guessing for live
The skill tells agents to prefer the included Node helper script for live platform data. Running that helper is expected, but it invokes local code that performs network fetches.
中
Ruby/shell backtick execution
platform data, URL conversion, and README `Use Cases` lookup.
This line continues the instruction to use the helper for live platform data and README lookup. The risk is indirect execution of a local script that retrieves remote content.
中
Ruby/shell backtick execution
- list candidate headings with `node scripts/xget.mjs topics --format json`
The skill explicitly instructs agents to run node scripts/xget.mjs topics. This is a real external command path, even though it is part of the intended workflow.
中
Ruby/shell backtick execution
`node scripts/xget.mjs snippet --base-url https://xget.example.com --heading "Docker Compose Configu
The skill explicitly instructs agents to run node scripts/xget.mjs snippet. The helper fetches remote README content and rewrites it for the selected base URL.
中
Ruby/shell backtick execution
`node scripts/xget.mjs platforms --format json` when the answer depends on
The skill explicitly instructs agents to run node scripts/xget.mjs platforms. The command fetches live remote platform data, so the external command risk is real.
中
Ruby/shell backtick execution
current prefixes, and use `convert` for exact URL rewrites.
This line continues the instruction to use helper commands for current prefixes and URL conversion. It is legitimate tooling but still directs command execution.
低
Hardcoded URL
'https://raw.gitcode.com/xixu-me/xget/raw/main/src/config/platform-catalog.js';
The script hardcodes the remote GitCode URL used to fetch the live Xget platform catalog. This is intentional network behavior and creates a source-trust dependency.
低
Hardcoded URL
const DEFAULT_README_URL = 'https://raw.gitcode.com/xixu-me/xget/raw/main/README.md';
The script hardcodes the remote GitCode README URL used by topics and snippet commands. This is intentional network behavior and creates a source-trust dependency.
低
Environment variable access (dot notation)
resolveBaseUrl(getStringOption(options, 'base-url'), process.env.XGET_BASE_URL) ??
The convert command reads process.env.XGET_BASE_URL as a configuration fallback. The variable is a service URL rather than a secret, but it is real environment access.
低
Environment variable access (dot notation)
resolveBaseUrl(getStringOption(options, 'base-url'), process.env.XGET_BASE_URL) ??
The snippet command reads process.env.XGET_BASE_URL as a configuration fallback. The variable is a service URL rather than a secret, but it is real environment access.
低
Environment variable object
resolveBaseUrl(getStringOption(options, 'base-url'), process.env.XGET_BASE_URL) ??
The code accesses the process.env object to resolve XGET_BASE_URL for URL conversion. This is expected configuration access, but it is still environment-variable use.
低
Environment variable object
resolveBaseUrl(getStringOption(options, 'base-url'), process.env.XGET_BASE_URL) ??
The code accesses the process.env object to resolve XGET_BASE_URL for README snippet rewriting. This is expected configuration access, but it is still environment-variable use.
風險因素
⚙️ 外部命令 (53)
references/REFERENCE.md:15 references/REFERENCE.md:17 references/REFERENCE.md:35 references/REFERENCE.md:37 scripts/xget.mjs:15 scripts/xget.mjs:16 scripts/xget.mjs:75 scripts/xget.mjs:81-121 scripts/xget.mjs:140 scripts/xget.mjs:151 scripts/xget.mjs:175 scripts/xget.mjs:181 scripts/xget.mjs:201 scripts/xget.mjs:230 scripts/xget.mjs:270 scripts/xget.mjs:274 scripts/xget.mjs:287 scripts/xget.mjs:330 scripts/xget.mjs:353 scripts/xget.mjs:390 scripts/xget.mjs:393 scripts/xget.mjs:410 scripts/xget.mjs:493 scripts/xget.mjs:496 scripts/xget.mjs:507 scripts/xget.mjs:526 scripts/xget.mjs:547-600 scripts/xget.mjs:600-643 scripts/xget.mjs:643-648 scripts/xget.mjs:648-758 scripts/xget.mjs:758-763 scripts/xget.mjs:763-838 scripts/xget.mjs:838-901 scripts/xget.mjs:901-963 scripts/xget.mjs:963 SKILL.md:7 SKILL.md:23 SKILL.md:27 SKILL.md:30 SKILL.md:31 SKILL.md:50 SKILL.md:57 SKILL.md:58 SKILL.md:59 SKILL.md:61 SKILL.md:75 SKILL.md:76 SKILL.md:78 SKILL.md:82 SKILL.md:83 SKILL.md:84 SKILL.md:85 SKILL.md:88
🌐 網路存取 (16)
references/REFERENCE.md:18 references/REFERENCE.md:24 references/REFERENCE.md:30 references/REFERENCE.md:39 references/REFERENCE.md:45 references/REFERENCE.md:51 references/REFERENCE.md:57 references/REFERENCE.md:93 scripts/xget.mjs:7 scripts/xget.mjs:8 scripts/xget.mjs:10 scripts/xget.mjs:11 scripts/xget.mjs:118 scripts/xget.mjs:120 SKILL.md:27 SKILL.md:59
📁 檔案系統存取 (8)
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/xixu-me-xget/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/xixu-me-xget?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/xixu-me-xget?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xixu-me-xget/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/xixu-me-xget.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
xixu-me. (2026). xget security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/xixu-me-xget/audits/5BibTeX 引用
@techreport{xixu-me-xixu-me-xget-2026,
author = {xixu-me},
title = {xget security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/xixu-me-xget/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "xget security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "xixu-me"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/xixu-me-xget/audits/5"
identifiers:
- type: other
value: "skillstore:xixu-me-xget:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 高 64
架構
85
可維護性
87
內容
68
社群
91
規範符合度
你可以打造什麼
設定套件管理器加速
設定 npm、pip、Cargo、NuGet、Conda 或類似工具，以使用 Xget 部署。
準備容器和 CI 工作流程
調整 Docker、Kubernetes 和 GitHub Actions 範例，以使用 Xget 登錄檔前綴。
切換 SDK 基底 URL
更新 AI SDK 或推論 API 基底 URL，同時保留一般提供者驗證行為。
試試這些提示
轉換單一 URL
使用我的基底 URL 將這個上游 URL 轉換為 Xget URL：[base URL] 和 [upstream URL]。
列出相符的設定主題
尋找與 [tool or platform] 相關的目前 Xget 使用案例主題，並摘要相關設定路徑。
設定專案檔案
更新此專案，讓 [package manager or container registry] 使用 Xget。使用 [base URL] 並驗證變更後的設定。
規劃多層遷移
檢閱此儲存庫，並在套用之前，規劃套件安裝、容器拉取、CI 作業和 SDK 基底 URL 的 Xget 變更。
最佳實務
- 在要求套用設定變更之前，請提供真實的 Xget 基底 URL。
- 當精確前綴或最新支援很重要時，請重新整理即時平台對應表。
- 在執行持久性的 shell 設定檔和專案設定變更之前，請先檢閱。
避免
- 請勿在生產命令中使用佔位用的 Xget 主機。
- 請勿在未檢查平台對應表的情況下，假設某個上游 URL 受到支援。
- 當使用者只要求範例時，請勿套用持久性的設定檔變更。
常見問題
這個技能的用途是什麼？
它可協助調整 URL、命令和設定，讓工具能夠使用 Xget 部署。
它需要網路存取嗎？
是。當需要目前的 Xget 指引時，輔助工具會擷取即時平台和 README 資料。
它可以修改我的專案檔案嗎？
可以，當你要求它套用設定時可以。使用持久性設定之前，請先檢閱變更。
它能處理容器登錄檔嗎？
可以。它包含 OCI 登錄檔前綴和容器工作流程設定的指引。
它會變更 API 金鑰嗎？
不會。AI SDK 指引會保留一般提供者驗證，且只變更相關的基底 URL。
發布它安全嗎？
這是中等風險。其行為是合法的，但使用者應核准命令執行和檔案變更。
開發者詳細資訊
作者
xixu-me授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
64ca8af0f54a325752f08bd54e52151061ea659a
維護新鮮度
2026/7/21
使用量
10 次下載 · 64 次瀏覽
檔案結構