port-to-public
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local system commands and third-party binaries to manage tunnels.
- It launches the
cloudflaredbinary, a well-known tool for establishing secure tunnels. - It utilizes
pson macOS/Linux andtaskkillon Windows to manage and verify tunnel processes using PID and start-time validation to prevent PID reuse issues. - It invokes
curlto verify public connectivity, optionally utilizing Cloudflare's well-known DNS-over-HTTPS service. - [EXTERNAL_DOWNLOADS]: The skill relies on external infrastructure and pre-installed tools.
- It requires the
cloudflaredbinary (from Cloudflare) to be installed on the host system to function. - It connects to the
*.trycloudflare.comdomain to generate public URLs for established tunnels. - [DATA_EXFILTRATION]: The skill's primary purpose involves exposing local ports to the internet, but it implements several mitigations to ensure this is done securely.
- Target services are strictly validated and limited to loopback addresses (
localhost,127.0.0.1,::1) to prevent exposing other network devices. - An explicit
--confirm-publicflag is required, ensuring the user acknowledges that the generated URL has no built-in authentication. - A default 12-hour expiration (TTL) automatically cleans up tunnels if they are not stopped manually, minimizing the attack surface over time.
Audit Metadata