publish-report
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill relies on the
pagecastpackage, which is dynamically fetched and executed from the npm registry usingnpxduring runtime. - [REMOTE_CODE_EXECUTION]: Executing the
pagecasttool vianpxconstitutes remote code execution, as the package code is retrieved from a remote source and executed in the local environment. - [COMMAND_EXECUTION]: The skill uses shell commands to invoke the Pagecast CLI for various operations, including publishing files, updating goals, and deploying static sites to Cloudflare Pages.
- [DATA_EXFILTRATION]: The skill's primary function is to transmit local files (HTML, Markdown) to a remote server to generate shareable public URLs. While this is the intended functionality, it creates a risk of exposing local data. The skill instructions attempt to mitigate this by directing the agent to exclude sensitive files such as secrets, credentials, and configuration files.
Audit Metadata