port-to-public

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local system commands and third-party binaries to manage tunnels.
  • It launches the cloudflared binary, a well-known tool for establishing secure tunnels.
  • It utilizes ps on macOS/Linux and taskkill on Windows to manage and verify tunnel processes using PID and start-time validation to prevent PID reuse issues.
  • It invokes curl to verify public connectivity, optionally utilizing Cloudflare's well-known DNS-over-HTTPS service.
  • [EXTERNAL_DOWNLOADS]: The skill relies on external infrastructure and pre-installed tools.
  • It requires the cloudflared binary (from Cloudflare) to be installed on the host system to function.
  • It connects to the *.trycloudflare.com domain to generate public URLs for established tunnels.
  • [DATA_EXFILTRATION]: The skill's primary purpose involves exposing local ports to the internet, but it implements several mitigations to ensure this is done securely.
  • Target services are strictly validated and limited to loopback addresses (localhost, 127.0.0.1, ::1) to prevent exposing other network devices.
  • An explicit --confirm-public flag is required, ensuring the user acknowledges that the generated URL has no built-in authentication.
  • A default 12-hour expiration (TTL) automatically cleans up tunnels if they are not stopped manually, minimizing the attack surface over time.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 03:12 PM
Security Audit — agent-trust-hub — port-to-public