skills/tychohq/agent-skills/caddy/Gen Agent Trust Hub

caddy

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides numerous commands for interacting with the system shell to manage the Caddy process and system services.
  • Commands include ~/.local/bin/caddy reload for configuration updates.
  • Uses launchctl (macOS) and systemctl (Linux) for service lifecycle management.
  • [EXTERNAL_DOWNLOADS]: The documentation references external sources for building and extending the tool.
  • Instructions include using xcaddy to build Caddy with the caddy-dns/vercel plugin from GitHub.
  • Mentions a companion skill dev-serve located at an external hub (clawhub.com).
  • [PRIVILEGE_ESCALATION]: The skill requires elevated privileges to perform its core functions.
  • Uses sudo launchctl on macOS to manage the Caddy LaunchDaemon, which is required to bind to privileged port 443.
  • Employs sudo setcap on Linux to grant the Caddy binary permission to bind to low-numbered network ports without running as root.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructions involve interpolating user-supplied data (application names, subdomains, and port numbers) into configuration files and shell commands.
  • Ingestion points: Placeholders like appname, YOUR_DOMAIN, and 31XX in SKILL.md and reference.md.
  • Boundary markers: None explicitly defined for the interpolation process.
  • Capability inventory: The skill can write to configuration files (Caddyfile, .env, plists) and execute service management commands via shell.
  • Sanitization: No specific sanitization or validation steps are provided for the user-supplied placeholders.
  • [CREDENTIALS_UNSAFE]: The skill provides guidance on managing sensitive authentication material for the Vercel API.
  • Recommends storing Vercel API tokens in environment files (e.g., ~/.secrets/vercel/.env) or service configuration files (plist env vars).
  • Includes instructions for approving device pairing requests via openclaw devices approve.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 06:38 AM