Exécutez n'importe quel Skill dans Manus
en un clic

Exécutez n'importe quel Skill dans Manus en un clic

Commencer

local-ipc-auth

Étoiles2

Forks3

Mis à jour3 mai 2026 à 00:24

Review pattern for local socket auth without trusting spoofable protocol identity

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

quaid-app

quaid-app/quaid

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques·SOC 15-1212

SKILL.md

readonly

name	local-ipc-auth
description	Review pattern for local socket auth without trusting spoofable protocol identity
domain	security
confidence	high
source	extracted

Pattern

For local IPC that forwards privileged writes, treat kernel-backed peer credentials as the authority and treat protocol identity (whoami, session id, socket-path token) as a cross-check only.

Use when

A CLI talks to a local daemon over a Unix socket.
The daemon exposes write-capable operations.
A same-UID spoofing race is plausible.

Requirements

Publish the endpoint only after bind + permission audit succeed.
Clear any published endpoint metadata and unlink the socket on shutdown/startup-abort so clients cannot chase stale coordinates.
Client verifies socket owner/mode before connect.
Client verifies kernel peer UID/PID after connect against the expected process.
Server verifies peer UID on every accept.
If auth/setup fails while a live owner exists, refuse; do not fall back to an unsafe direct path.

Anti-patterns

Trusting whoami or session id as the primary auth primitive.
Trusting the socket path alone.
Falling back to direct writes when the proxy channel is unavailable.
Blocking the daemon's main supervision loop on socket I/O.

Plus depuis ce dépôt

même dépôt

quaid-research

quaid-app/quaid

Resolve knowledge gaps: fetch unresolved gaps, assess sensitivity, generate research queries, ingest findings, and close gaps with a resolution slug.

2026-06-132

quaid-alerts

quaid-app/quaid

Interrupt-driven alerts: detect and surface new contradictions, stale pages, resolved gaps, and embedding drift. Priority-classified with deduplication.

2026-06-132

quaid-ingest

quaid-app/quaid

Ingest meeting notes, articles, documents, and conversations into Quaid. Handles idempotent ingestion for exact-byte duplicates and vault-backed sync.

2026-06-132

quaid-maintain

quaid-app/quaid

Keep the brain healthy: detect and resolve contradictions via the correction / supersede workflow, validate referential integrity, triage knowledge gaps, find orphaned pages, and compact the database.

2026-06-132

quaid-query

quaid-app/quaid

Answer questions from the brain using FTS5 + semantic search + structured queries. Synthesize across multiple pages. Cite sources.

2026-06-132

quaid-upgrade

quaid-app/quaid

Agent-guided binary upgrades: version check, channel detection, download via install.sh (or manual asset fetch + SHA-256 verify), and post-upgrade validation.

2026-06-132

name	local-ipc-auth
description	Review pattern for local socket auth without trusting spoofable protocol identity
domain	security
confidence	high
source	extracted

Pattern

Use when

A CLI talks to a local daemon over a Unix socket.
The daemon exposes write-capable operations.
A same-UID spoofing race is plausible.

Requirements

Publish the endpoint only after bind + permission audit succeed.
Clear any published endpoint metadata and unlink the socket on shutdown/startup-abort so clients cannot chase stale coordinates.
Client verifies socket owner/mode before connect.
Client verifies kernel peer UID/PID after connect against the expected process.
Server verifies peer UID on every accept.
If auth/setup fails while a live owner exists, refuse; do not fall back to an unsafe direct path.

Anti-patterns

Trusting whoami or session id as the primary auth primitive.
Trusting the socket path alone.
Falling back to direct writes when the proxy channel is unavailable.
Blocking the daemon's main supervision loop on socket I/O.