webui
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several bash commands to manage a local Nuxt.js server. These include dependency installation (npm ci), building (npm run build), and starting the server (node .output/server/index.mjs). All operations are performed within the local environment and are standard for web application deployment.
- [REMOTE_CODE_EXECUTION]: While the skill runs 'npm ci', this is a standard practice for installing project dependencies defined in the 'package-lock.json'. The dependencies are managed by the package manager and do not involve arbitrary remote script execution like 'curl | bash'.
- [EXTERNAL_DOWNLOADS]: The skill downloads packages via 'npm' from the official registry during the first run or if corruption is detected. This is expected behavior for a web-based tool.
- [PRIVILEGE_ESCALATION]: The skill manages its own process PID in '/tmp/claude-paper-webui.pid' and uses 'kill' to manage the server lifecycle. It does not use 'sudo' or attempt to acquire elevated system permissions.
Audit Metadata