sealos-app-builder — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited sealos-app-builder (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill to turn a generic web app into a Sealos app that runs inside Sealos Desktop, or to scaffold a new Sealos app from scratch. Focus on the repeatable parts: SDK initialization, session access, language sync, business-data integration, local debugging through a Desktop test app, and publish readiness.
Prefer a simple, teachable implementation that a beginner can understand and extend.
Classify the request into one of these paths:
If the repository already contains Sealos-related code, inspect local sources first. In particular:
packages/client-sdk or equivalent SDK sources.providers/ or similar directories.If the repository does not contain local Sealos sources, use the bundled references in this skill as the baseline.
Treat Sealos Desktop integration as a root-level concern.
Before using any starter template, install the SDK first:
pnpm add @labring/sealos-desktop-sdkUse npm install @labring/sealos-desktop-sdk or yarn add @labring/sealos-desktop-sdk when the project uses a different package manager.
getSession() and getLanguage() early.EVENT_NAME.CHANGE_I18N when the app needs runtime language sync.Read references/minimal-app-template.md before implementing the root integration. If the app uses Next.js App Router, also read references/nextjs-app-router.md.
Use one of these starter templates:
For most apps, the key integration is not the iframe itself but the user mapping.
session.user.id as the stable app-level user identifier.name, avatar, k8sUsername, and nsid when useful.Read references/data-integration-patterns.md when you need schema or API guidance.
Do not assume a successful browser render means Sealos integration works.
The app usually needs to be opened by Sealos Desktop in an iframe for SDK calls like getSession() to succeed. When local debugging is part of the task, read references/local-debug-and-test-app.md.
Use these rules:
When the user wants deployment or launch readiness:
Use references/publish-checklist.md as the release checklist.
Default to the smallest viable Sealos integration:
Avoid spreading SDK initialization across multiple pages or components.
If the current workspace contains actual Sealos SDK sources or existing Sealos apps:
Use @labring/sealos-desktop-sdk in generated examples and starter code by default.
Only deviate from that if the target repository already has an established local workspace alias and the user explicitly wants to preserve it.
Provide:
Do this order:
session.user.id.Structure the output around:
Read only the files needed for the task:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.