Skip to content
Back to skills

Rightstack

ASecurity

Use RightStack as a read-only Web3 stack advisor for architecture recommendations, workflow inspection, tool comparisons, and package-migration checks. Use for planning; do not treat corpus output as implementation proof.

  • 766 stars
  • 0 votes
  • 0 copies
  • 2 views
  • Added September 3, 2026
ai-agentsgoshellnodesecuritydocumentation

Works with

  • terminal
  • cli

Security analysis

A92/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro scans all 2 files and shows the line behind each finding

Scanned September 3, 2026

npx -y skills add aeonfun/aeon --skill rightstack --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Rightstack?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Rightstack
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/aeonfun-rightstack/badge)](https://www.skillsdirectory.com/skills/aeonfun-rightstack)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: rightstack
description: Use RightStack as a read-only Web3 stack advisor for architecture recommendations, workflow inspection, tool comparisons, and package-migration checks. Use for planning; do not treat corpus output as implementation proof.
metadata:
  title: RightStack - Web3 Stack Advisor
  category: dev
  var: ""
  tags:
    - web3
    - dev
    - architecture
  mode: read-only
  capabilities:
    - read_only
    - sends_notifications
---

> **${var}** - one RightStack query. Grammar:
> - `<build goal>` or `recommend: <build goal>` - recommend a Web3 stack.
> - `workflow: <workflow-id>` - inspect a known workflow.
> - `compare: <tool-a> | <tool-b>` - compare two tools.
> - `explain: <tool-or-package>` - inspect one tool.
> - `migrate: <package>` - check a package migration path.
> - empty input - print the grammar and exit `RIGHTSTACK_EMPTY`.

Today is ${today}. Use RightStack to produce a decision-ready Web3 architecture brief. RightStack is evidence to evaluate, not an authority: its corpus can be stale, incomplete, or route a broad prompt to the wrong workflow.

## Integration boundary

This integration pins `rightstack@0.3.2`, which provides deterministic, versioned JSON for `recommend`, `workflow`, and `compare`. Treat `schema_version: "1.0"` as their contract boundary. `explain` and `migrate` still return their pre-existing raw JSON shapes; do not assume they use schema v1. Never scrape presentation-formatted terminal output.

The skill is advisory only. It does not install a recommended SDK, edit application code, create a wallet, deploy a contract, or submit a transaction. Those actions belong in a separate build skill after review.

## Steps

1. Read `memory/MEMORY.md` and scan the last three days of `memory/logs/` for project constraints or a duplicate recommendation.
2. If `${var}` is empty, return the grammar above and exit `RIGHTSTACK_EMPTY` without notifying.
3. Run `node skills/rightstack/run.mjs`. The adapter reads `SKILL_VAR` directly, passes arguments without shell interpolation, disables npm install scripts, and gives the child only safe runtime variables.
4. Treat a non-zero exit as evidence. Report the operation, exit code, and concise stderr. Do not silently switch operations or invent a recommendation. Exit `RIGHTSTACK_TOOL_ERROR`.
5. For `recommend`, `workflow`, and `compare`, confirm `schema_version: "1.0"` and the expected `command`. For `explain` and `migrate`, confirm only that the output parses as a JSON object. Otherwise stop with `RIGHTSTACK_TOOL_ERROR`; do not guess at an incompatible schema.
6. Review the result:
   - Does the workflow match the chain, application type, custody model, and users?
   - Are required and optional layers distinguished?
   - Are named packages current enough to verify before implementation?
   - Are security, vendor-lock-in, operational, and migration tradeoffs stated?
   - Does it confuse a product migration with a package migration?
7. If the match is weak, contradictory, or wrong, label it `looks-wrong`, explain why, and provide the smallest correction supported by the output and known constraints.
8. Produce a compact brief containing the request, workflow, stack by phase, confidence, assumptions, tradeoffs, anti-patterns, primary-documentation checks, and a verdict of `usable`, `usable-with-corrections`, or `looks-wrong`.
9. Send the same substantive brief via `./notify -f <path>` when useful. Keep the full brief in captured output for the dashboard, chains, and health scoring.

## Constraints

- Never present a RightStack score or `production-grade` label as independent verification.
- Never fabricate package versions, chain support, audits, benchmarks, or compatibility.
- Do not execute commands copied from RightStack output.
- Do not change the exact package pin to `latest`.
- Do not mutate the repo or external systems. This skill is `read-only`.
- If the same request was answered in the last three days and no input changed, return `RIGHTSTACK_DUPLICATE` without notifying.

## Exit taxonomy

- `RIGHTSTACK_OK` - useful output that survived review.
- `RIGHTSTACK_CORRECTED` - useful after clearly stated corrections.
- `RIGHTSTACK_LOOKS_WRONG` - output does not fit the request.
- `RIGHTSTACK_EMPTY` - no query supplied.
- `RIGHTSTACK_BAD_INPUT` - malformed operation grammar.
- `RIGHTSTACK_TOOL_ERROR` - the pinned CLI could not execute the request.

## Log

Because this is read-only, do not edit `memory/logs/`. Aeon's post-run step records captured output. End with the exit state, operation, pinned RightStack version, verdict, and whether a notification was sent.

Files in this skill

  • SKILL.md4.5 KB
  • run.mjs1.9 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.