skills/konglong87/superpm/pm-preview/Gen Agent Trust Hub

pm-preview

Pass

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell scripts to manage the lifecycle of a local Node.js server. It executes scripts/start-preview.sh to launch the server and scripts/stop-preview.sh to terminate it.
  • [EXTERNAL_DOWNLOADS]: The web-based preview interface fetches the marked.js library from the JSDelivr CDN (cdn.jsdelivr.net) to perform client-side Markdown rendering. This is a standard and safe practice for loading well-known technology libraries.
  • [DATA_EXFILTRATION]: The local server provides API endpoints to read the contents of Markdown files for rendering. The server implementation includes path normalization and prefix checks to prevent directory traversal attacks, ensuring access is restricted to the 'docs/' directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 21, 2026, 07:31 AM
Security Audit — agent-trust-hub — pm-preview