pm-preview
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell scripts to manage the lifecycle of a local Node.js server. It executes
scripts/start-preview.shto launch the server andscripts/stop-preview.shto terminate it. - [EXTERNAL_DOWNLOADS]: The web-based preview interface fetches the
marked.jslibrary from the JSDelivr CDN (cdn.jsdelivr.net) to perform client-side Markdown rendering. This is a standard and safe practice for loading well-known technology libraries. - [DATA_EXFILTRATION]: The local server provides API endpoints to read the contents of Markdown files for rendering. The server implementation includes path normalization and prefix checks to prevent directory traversal attacks, ensuring access is restricted to the 'docs/' directory.
Audit Metadata