docs(skills): harden temps-platform-setup against security-scanner findings - #369
Open
clau1902 wants to merge 2 commits into
Open
docs(skills): harden temps-platform-setup against security-scanner findings#369clau1902 wants to merge 2 commits into
clau1902 wants to merge 2 commits into
Conversation
…ndings Address the failed Gen Agent Trust Hub and Snyk audits on skills.sh: - remove the remaining curl-pipe-to-bash in the headless/agent install; all install paths now download deploy.sh, verify it against a published deploy.sh.sha256 checksum, and review before running - pin git clone examples to a release tag (v0.0.8) with --depth 1 - redact admin_password/api_key in the example setup-result output and document setup-result.json as a secret store (extract fields via jq, never expose admin_password to automation) - reference exported env vars instead of typed secrets in all token-bearing flag examples (git providers, CLI login, DNS providers) - replace the hardcoded 'temps' postgres password with a generated one and <DB_PASSWORD> placeholders in connection strings - soften kill -9 and --expires-in never guidance Requires publishing https://temps.sh/deploy.sh.sha256 alongside deploy.sh (regenerated on every deploy.sh change) before republishing the skill. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Keep the checksum-verification and secret-redaction hardening while adopting main's current installer interface (--yes, quick mode, apps_url_pattern result field). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
15 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The temps-platform-setup skill on skills.sh currently fails two of three security audits (Gen Agent Trust Hub: HIGH, Snyk: CRITICAL; SocketPass passes). This PR fixes every pattern those scanners flag in
skills/temps-platform-setup/.Changes
Remote code execution (Snyk E005/W012, Trust Hub #1)
deploy.sh→ verify againstdeploy.sh.sha256→ review → run.git cloneexamples pinned to a release tag (--depth 1 --branch v0.0.8).curl ... | bashstring no longer appears anywhere, even in prose warnings (naive regex scanners match it regardless of context).Credential handling (Snyk W007, Trust Hub #2)
setup-result.jsonoutput shows<redacted>instead ofadmin_password/tmps_...values; the file is documented as a secret store (extract single fields viajq;admin_passwordis off-limits to automation).TEMPS_TOKENper-command instead oflogin --api-key.POSTGRES_PASSWORD=temps/postgres:temps@connection strings replaced with a generated password and<DB_PASSWORD>placeholders.Minor
kill -9→ gracefulkillwith SIGKILL-as-escalation note;--expires-in nevernow recommends bounded expiry.sha256sumas the primary checksum tool (Linux servers),shasum -a 256noted for macOS.The docs now reference
https://temps.sh/deploy.sh.sha256, which does not exist yet (404). Before this version of the skill is republished, the pipeline that publishesdeploy.shto temps.sh must also generate and upload the checksum:sha256sum deploy.sh > deploy.sh.sha256Also note the
v0.0.8pin should be bumped as part of future release checklists, and a skills.sh re-scan should be requested after republish (current failing audits are dated 2026-04-02, predating recent hardening).🤖 Generated with Claude Code