attach-primitive
Defines contracts and invariants for side-effectful composition primitives in workspace development, enhancing modularity and clarity.
Install this skill
or
10/100
Security score
The attach-primitive skill was audited on Jun 10, 2026 and we found 8 security issues across 1 threat category, including 5 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
high line 47
Access to system keychain/keyring
SourceSKILL.md
| 47 | Table and KV stores are no longer attached one-by-one. They are constructed as a bundle by `createWorkspace({ id, tables, kv, keyring? })`, which owns the Y.Doc's lifecycle and exposes `workspace.ydoc |
high line 93
Access to system keychain/keyring
SourceSKILL.md
| 93 | When several sibling handles must be constructed atomically (one Y.Doc, N stores activated together, optionally one keyring derivation feeding them all), that work lives in `createWorkspace`, not in a |
medium line 103
Access to system keychain/keyring
SourceSKILL.md
| 103 | // Encrypted: same call shape, `keyring` switches it on |
medium line 106
Access to system keychain/keyring
SourceSKILL.md
| 106 | keyring: signedIn.keyring, |
high line 117
Access to system keychain/keyring
SourceSKILL.md
| 117 | The workspace bundle owns the stores' lifecycle: `using workspace = createWorkspace(...)` triggers cascade disposal. Passing `keyring` switches encryption on at construction; without it the stores are |
medium line 145
Access to system keychain/keyring
SourceSKILL.md
| 145 | keyring, |
high line 196
Access to system keychain/keyring
SourceSKILL.md
| 196 | - **Don't introduce a separate top-level encrypted-X helper.** Encryption is a construction-time switch on `createWorkspace({ id, keyring, tables, kv })`, not an `attach*` primitive. If you find yours |
high line 203
Access to system keychain/keyring
SourceSKILL.md
| 203 | - `packages/workspace/src/create-workspace.ts` ; the bundle factory; takes `{ id, tables, kv, keyring? }` and returns `{ ydoc, tables, kv, [Symbol.dispose] }` after one atomic construction (and one ke |
Scanned on Jun 10, 2026
View Security Dashboard