CtrlK
BlogDocsLog inGet started
Tessl Logo
PluginPublic

ai-ecoverse/advanced-skills

Quarantined high-risk skills (browser session capture, WebSocket interception) for Slack and Microsoft Teams. Install only after reviewing the security implications.

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

skill-paths.test.jsskills/slack/tests/

import fs from 'node:fs';
import path from 'node:path';
import test, { is } from 'tst';

// slack finds its own files relative to where it is installed (__dirname),
// not at a literal /workspace/skills path, so the host jsh can run it from
// anywhere (ai-ecoverse/skills#491). This evaluates the shipped definitions
// with the script installed at /opt/skills/slack/scripts.
const SOURCE = fs.readFileSync(path.join(process.cwd(), 'scripts/slack.jsh'), 'utf8');
const INSTALLED = '/opt/skills/slack/scripts';

// The top-level `const` lines named, evaluated in file order with __dirname set.
function consts(names) {
  const lines = SOURCE.split('\n').filter((l) =>
    names.some((n) => new RegExp(`^const ${n} = `).test(l))
  );
  return new Function('__dirname', `${lines.join('\n')}\nreturn { ${names.join(', ')} };`)(
    INSTALLED
  );
}

test('the skill’s own files live under its install directory', () => {
  is(consts(['SKILL_ROOT', 'LAST_POST_DIR']), {
    SKILL_ROOT: '/opt/skills/slack',
    LAST_POST_DIR: '/opt/skills/slack',
  });
});

tile.json