跳到主要内容
知仓学习社ZHICANG

rch

Offload one build through RCH or diagnose its remote compiler. Use when: remote compilation is selected; report errors without creating a retry cont…

读凭据写文件严重 10 · 高危 3hashgraph-online/awesome-codex-plugins

它会碰到什么

扫了多少10 个文本文件,68 KB
它会碰到什么读凭据写文件
命中总数13 处
命中统计严重 10 · 高 3 · 中 0 · 低 0
逐条看命中(13 条严重或高危)
  • 严重 references/CONFIGURATION.md:27cred-paths
    4. `.env` / `.rch.env`
  • 严重 references/CONFIGURATION.md:102cred-paths
    identity_file = "~/.ssh/id_ed25519"
  • 严重 references/CONFIGURATION.md:102cred-paths
    identity_file = "~/.ssh/id_ed25519"
  • 严重 references/FAIL_OPEN.md:174cred-paths
    worker's `authorized_keys` or its host-key entry;
  • 严重 references/FAIL_OPEN.md:174cred-write
    worker's `authorized_keys` or its host-key entry;
  • 严重 references/FAIL_OPEN.md:191cred-paths
    `authorized_keys`, restarting `sshd`).
  • 严重 references/FAIL_OPEN.md:191cred-write
    `authorized_keys`, restarting `sshd`).
  • 严重 references/RECOVERY_PLAYBOOKS.md:92cred-paths
    2. Auth error → check `identity_file` permissions (`chmod 600`), key on agent (`ssh-add -l`), and authorized_keys on the worker.
  • 严重 references/RECOVERY_PLAYBOOKS.md:92cred-write
    2. Auth error → check `identity_file` permissions (`chmod 600`), key on agent (`ssh-add -l`), and authorized_keys on the worker.
  • 严重 references/WORKERS.md:60cred-paths
    identity_file = "~/.ssh/new_worker_ed25519"
  • references/CONFIGURATION.md:143identity-config-write
    "hooks": {
  • references/CONFIGURATION.md:147identity-config-write
    "hooks": [
  • references/RECOVERY_PLAYBOOKS.md:218fs-destructive
    - Massive `Cargo.toml`/`metadata` and the closure preflight is slow → cache should warm; if not, the cache may be invalid: `rm -rf ~/.cache/rch/classify_cache_v

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

RCH — remote compilation specialist

RCH can offload one explicit compilation command or inspect the remote compiler

path. This skill reports what happened; it does not govern retries or repair.

Staged diagnosis works because the offload pipeline fails in order —

availability, configuration, hook, classification, sync, remote compile,

worker pressure — so the first failing stage localizes the fault and every

later stage is noise until it passes. Remediate in irreversibility order:

read-only probes and config inspection before daemon restarts, restarts before

cleanup, and destructive cleanup or worker mutation only with explicit caller

authority.

Named failure mode — green-local blindness: a passing [RCH] local (...)

build read as offload success; the local fallback hid that the remote claim

was never proved.

Anti-pattern: re-running the build hoping the fallback reason disappears.

Corrective: read the recorded fallback reason and fix that stage; the pipeline

fails deterministically, not moodily.

Procedure

  1. Capture rch check, rch doctor --json, worker status, and the relevant

[RCH] summary before mutation.

  1. For diagnosis, identify the first failing stage: availability, configuration,

hook, classification, sync, remote compile, or worker pressure.

  1. Run only the caller-authorized command or documented safe diagnostic once.
  2. Capture the exact command, worker when known, exit code, local-fallback reason,

and post-action status.

  1. Stop and return the evidence.

[RCH] local (...) means the requested remote-offload claim was not proved even

when the local build succeeds. Destructive cleanup, worker deployment, daemon

configuration, and remote mutation require explicit caller authority.

rch check exit status adjudicates readiness (0 = ready, nonzero = not

offload-ready). Do not read rch doctor --json success: true as readiness — a

successful diagnostic report can coexist with a down daemon or unreachable

workers. Adjudicate on rch check; use doctor for the reasons behind it.

Output

Return a factual packet with status (remote, local_fallback, failed, or

not_proven), commands and exit codes, worker, summary line, and checked/not

checked surfaces. Do not include a next action. not_proven here is a runtime

diagnosis status, not an AgentOps verdict; it carries no verdict weight and never

substitutes for a verdict.v2.

References

The SKILL.md authority boundary above governs every reference below. Where a

reference lists a remediation, its read-only diagnostics run autonomously but its

remote, privileged, or irreversible steps (remote/sudo mutation, daemon

start/restart/reconfigure, worker or fleet deployment, toolchain sync,

destructive cleanup) still require explicit caller authorization first. A

reference never widens the autonomy the kernel grants.

  • [Fail-open reasons](references/FAIL_OPEN.md)
  • [Error catalog](references/ERROR_CODES.md)
  • [Troubleshooting](references/TROUBLESHOOTING.md)
  • [Recovery playbooks](references/RECOVERY_PLAYBOOKS.md)
  • [Worker operations](references/WORKERS.md)
  • [Configuration](references/CONFIGURATION.md)
  • [Machine-readable surfaces](references/MACHINE_INTROSPECTION.md)

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。