page-serve
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local system commands including python3, curl, and the portless CLI. These are used to manage a local web server and network aliases on the developer's machine solely for serving static content locally.
- [EXTERNAL_DOWNLOADS]: References the portless and agent-browser CLI tools as prerequisites. These are recognized developer utilities used for local proxying and browser screenshots respectively.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests local filesystem paths to serve content. It implements validation for subdomain labels (sanitizing inputs via sed) and explicitly checks for path traversal patterns in scripts/stop.sh to ensure state files are managed securely.
Audit Metadata