glove

Provides a comprehensive guide for developing AI applications using the Glove framework, including setup and core concepts.

Install this skill

or

0/100

Security score

The glove skill was audited on May 27, 2026 and we found 48 security issues across 4 threat categories, including 1 critical. Review the findings below before installing.

Categories Tested

Security Issues

critical line 2334

Direct command execution function call

SourceSKILL.md

2334	67. Continuum runner spawn env-blocklist: `NODE_OPTIONS`, `LD_PRELOAD`, `LD_LIBRARY_PATH`, and `DYLD_INSERT_LIBRARIES` are stripped from BOTH the parent env forwarded to subprocesses AND any `.env

medium line 122

Template literal with variable interpolation in command context

SourceSKILL.md

122	data: `User selected: ${selected}`, // sent to AI

medium line 308

Template literal with variable interpolation in command context

SourceSKILL.md

308	const res = await fetch(`https://wttr.in/${input.city}?format=j1`);

medium line 325

Template literal with variable interpolation in command context

SourceSKILL.md

325	input: { message: `Delete ${input.file}?` },

medium line 343

Template literal with variable interpolation in command context

SourceSKILL.md

343	if (event_type === "tool_use") console.log(`\n[tool] ${(data as any).name}`);

medium line 454

Template literal with variable interpolation in command context

SourceSKILL.md

454	getInboxItems: (sid) => fetch(`/api/sessions/${sid}/inbox`).then(r => r.json()),

medium line 455

Template literal with variable interpolation in command context

SourceSKILL.md

455	addInboxItem: (sid, item) => fetch(`/api/sessions/${sid}/inbox`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ item }) }),

medium line 456

Template literal with variable interpolation in command context

SourceSKILL.md

456	updateInboxItem: (sid, itemId, updates) => fetch(`/api/sessions/${sid}/inbox/update`, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ itemId, updates }) }),

medium line 457

Template literal with variable interpolation in command context

SourceSKILL.md

457	getResolvedInboxItems: (sid) => fetch(`/api/sessions/${sid}/inbox/resolved`).then(r => r.json()),

medium line 490

Template literal with variable interpolation in command context

SourceSKILL.md

490	`Be terse. (source=${source}, hint=${args ?? "none"})`,

medium line 497

Template literal with variable interpolation in command context

SourceSKILL.md

497	?? new MemoryStore(`weather_${Date.now()}`);

medium line 598

Template literal with variable interpolation in command context

SourceSKILL.md

598	return `Switch into research mode. Focus: ${args ?? "general"}.`;

medium line 602

Template literal with variable interpolation in command context

SourceSKILL.md

602	return `Switch into research mode. User said: ${parsedText}`;

medium line 668

Template literal with variable interpolation in command context

SourceSKILL.md

668	?? new MemoryStore(`researcher_${Date.now()}`);

high line 832

Template literal with variable interpolation in command context

SourceSKILL.md

832	- Name: `${entry.id}__${tool.name}` (e.g. `notion__search`). The `__` separator (exported as `MCP_NAMESPACE_SEP`) is regex-safe across all model providers.

medium line 1357

Template literal with variable interpolation in command context

SourceSKILL.md

1357	.store((name) => new MyPersistentStore(`./agents/${name}.db`))

medium line 1433

Template literal with variable interpolation in command context

SourceSKILL.md

1433	.store((name) => new MyInboxCapableStore(`./agents/${name}.db`))

medium line 1902

Template literal with variable interpolation in command context

SourceSKILL.md

1902	const range = from != null \|\| to != null ? ` lines ${from ?? 1}-${to ?? "EOF"}` : "";

medium line 1903

Template literal with variable interpolation in command context

SourceSKILL.md

1903	return `Read ${path}${range} (${lineCount} lines).`;

high line 2293

Template literal with variable interpolation in command context

SourceSKILL.md

2293	30. MCP tool names use `__`: Bridged MCP tool names are `${entry.id}__${tool.name}` — the `__` separator (`MCP_NAMESPACE_SEP`) is regex-safe across all model providers. A Notion `search` tool surf

high line 2318

Template literal with variable interpolation in command context

SourceSKILL.md

2318	51. Permissions are keyed on (tool, input), not just tool: `Executor.checkPermission` calls `store.getPermission(name, input)` with the model-supplied input on every gated call. The default `Memor

low line 156

Fetch to external URL

SourceSKILL.md

156	// getSessionId: () => fetch("/api/session").then(r => r.json()).then(d => d.id),

low line 395

Webhook reference - potential data exfiltration

SourceSKILL.md

395	// From a background job, webhook handler, or cron:

medium line 1311

Webhook reference - potential data exfiltration

SourceSKILL.md

1311	- `glove_post_to_inbox` — "I will resolve this myself later from outside the conversation" (external service, webhook, cron).

medium line 1337

Webhook reference - potential data exfiltration

SourceSKILL.md

1337	- Firing agent work from an HTTP handler / cron / webhook and picking it up async — like a background job, but the job is a full Glove agent.

medium line 1444

Webhook reference - potential data exfiltration

SourceSKILL.md

1444	`mountMesh` requires the store to implement inbox methods (`getInboxItems` / `addInboxItem` / `updateInboxItem` / `getResolvedInboxItems`). Glove's default `MemoryStore` implements them; custom stores

medium line 2326

Webhook reference - potential data exfiltration

SourceSKILL.md

2326	59. `InMemoryMeshAdapter` is process-local: Construct ONE `MeshNetwork` per process and share it across every `InMemoryMeshAdapter`. For cross-process or distributed messaging, implement `MeshAdap

medium line 93

Access to .env file

SourceSKILL.md

93	Set `ANTHROPIC_API_KEY` (or `OPENAI_API_KEY`, etc.) in `.env.local`.

low line 1356

Access to .env file

SourceSKILL.md

1356	.env({ OVEN: "hot" })

medium line 1470

Access to .env file

SourceSKILL.md

1470	- `NODE_OPTIONS`, `LD_PRELOAD`, `LD_LIBRARY_PATH`, and `DYLD_INSERT_LIBRARIES` are stripped from the parent env before forwarding, and an agent's `.env({...})` cannot override them.

low line 1588

Access to .env file

SourceSKILL.md

1588	.env.example # Generated from `env` config — required vars first

low line 1646

Access to .env file

SourceSKILL.md

1646	const s3 = new S3Client({ region: process.env.AWS_REGION })

low line 1650

Access to .env file

SourceSKILL.md

1650	bucket: process.env.OUTPUTS_BUCKET!,

low line 1651

Access to .env file

SourceSKILL.md

1651	region: process.env.AWS_REGION,

low line 1667

Access to .env file

SourceSKILL.md

1667	rule.s3({ bucket: process.env.OUTPUTS_BUCKET! }),

medium line 1679

Access to .env file

SourceSKILL.md

1679	- Docker — `docker build -t my-app dist/` then run with `-p 8080:8080 -e GLOVEBOX_KEY=$(cat dist/glovebox.key) -e GLOVEBOX_PUBLIC_URL=https://my-app.example.com my-app`. Set any required env vars

low line 1691

Access to .env file

SourceSKILL.md

1691	pdf: { url: "wss://pdf.example.com/", key: process.env.GLOVEBOX_PDF_KEY! },

medium line 2089

Access to .env file

SourceSKILL.md

2089	Set `ELEVENLABS_API_KEY` in `.env.local`.

medium line 2334

Access to .env file

SourceSKILL.md

2334	67. Continuum runner spawn env-blocklist: `NODE_OPTIONS`, `LD_PRELOAD`, `LD_LIBRARY_PATH`, and `DYLD_INSERT_LIBRARIES` are stripped from BOTH the parent env forwarded to subprocesses AND any `.env

low line 15

External URL reference

SourceSKILL.md

15	Docs site: https://glove.dterminal.net

low line 308

External URL reference

SourceSKILL.md

308	const res = await fetch(`https://wttr.in/${input.city}?format=j1`);

low line 866

External URL reference

SourceSKILL.md

866	url: "https://mcp.notion.com/mcp",

low line 886

External URL reference

SourceSKILL.md

886	- `runMcpOAuth(opts)` — one call, end-to-end flow. Spins up a local listener on `http://localhost:53683/callback` (configurable), drives the SDK through DCR (or skips it via `preRegisteredClient`)

low line 1089

External URL reference

SourceSKILL.md

1089	Episodic and resources use the same lifecycle. Writes mark records `embeddingStatus: "missing"` (initial) or `"stale"` (content change) and return immediately. A separate process — typically a [Statio

low line 1144

External URL reference

SourceSKILL.md

1144	- Triggering, scheduling, or pipeline orchestration ([Station](https://station.dterminal.net)'s territory).

low line 1679

External URL reference

SourceSKILL.md

1679	- Docker — `docker build -t my-app dist/` then run with `-p 8080:8080 -e GLOVEBOX_KEY=$(cat dist/glovebox.key) -e GLOVEBOX_PUBLIC_URL=https://my-app.example.com my-app`. Set any required env vars

low line 1682

External URL reference

SourceSKILL.md

1682	`GLOVEBOX_PORT` defaults to 8080; the Dockerfile `EXPOSE`s and `ENV`s it. `GLOVEBOX_PUBLIC_URL` defaults to `http://localhost:<port>` — fine for local, broken for any client outside the container.

low line 2045

External URL reference

SourceSKILL.md

2045	Available at https://glove.dterminal.net/tools — copy-paste into your project:

Scanned on May 27, 2026

View Security Dashboard

Installation guide →

GitHub Stars 7

Rate this skill

Categorydevelopment

UpdatedJune 15, 2026

claude claude-code frontend design notion playwright react docx git api database testing devops backend frontend-developer product-manager growth-pm ml-ai-engineer ux-designer development product design

porkytheblack/glove