The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the portless package directly from the official npm registry (registry.npmjs.org). This is a legitimate operation for installing the utility.
[COMMAND_EXECUTION]: Provides scripts and instructions for managing a local proxy service, which includes binding to privileged ports (443), modifying the system trust store for local CA certificates, and managing Task Scheduler/system services for boot persistence. These are necessary and documented requirements for the tool's core functionality.
[PROMPT_INJECTION]: The script sync-aliases-from-yaml.ps1 reads service definitions from a process-compose.yaml file to dynamically execute portless alias commands. This constitutes an indirect prompt injection surface; however, the risk is minimized by the use of PowerShell's call operator and standard variable passing, and the surface is limited to local configuration files.
[REMOTE_CODE_EXECUTION]: While the skill installs external code, the install-portless.ps1 script implements significant security best practices, including SHA-512 integrity verification against the registry metadata and a heuristic scan for known supply-chain Indicators of Compromise (IOCs).

portless-ops