publish-report

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill relies on the pagecast package, which is dynamically fetched and executed from the npm registry using npx during runtime.
  • [REMOTE_CODE_EXECUTION]: Executing the pagecast tool via npx constitutes remote code execution, as the package code is retrieved from a remote source and executed in the local environment.
  • [COMMAND_EXECUTION]: The skill uses shell commands to invoke the Pagecast CLI for various operations, including publishing files, updating goals, and deploying static sites to Cloudflare Pages.
  • [DATA_EXFILTRATION]: The skill's primary function is to transmit local files (HTML, Markdown) to a remote server to generate shareable public URLs. While this is the intended functionality, it creates a risk of exposing local data. The skill instructions attempt to mitigate this by directing the agent to exclude sensitive files such as secrets, credentials, and configuration files.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 08:49 PM