local-web-surface
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions and associated files do not contain malicious patterns. The content focuses on legitimate developer tooling and emphasizes security best practices for local service deployment.
- [COMMAND_EXECUTION]: The skill utilizes standard macOS system utilities including
launchctlfor service management,lsoffor port conflict detection, andplutilfor configuration validation. These operations are performed within the local user context for the purpose of managing the service lifecycle. - [DATA_EXPOSURE]: Potential data exposure risks are mitigated through explicit instructions to bind services to the loopback interface (
127.0.0.1), implement exact Host header validation, and maintain strict separation between local-only projections and public publication syncs. - [PROMPT_INJECTION]: The skill addresses indirect prompt injection risks associated with processing local markdown and data files by mandating the use of
textContentfor UI elements and requiring a controlled sanitizer for rendering markdown content. It also implements a 'fail-closed' policy for content with missing or invalid visibility metadata.
Audit Metadata