Навыки brewpage-publish
📦
brewpage-publish
Ревизия содержимого r1 Высокий риск 🌐 Доступ к сети⚙️ Внешние команды📁 Доступ к файловой системе
Seiten und Dateien auf Brewpage veröffentlichen
Das Teilen kleiner Seiten und Dateien kann Hosting-Einrichtung erfordern. Diese Skill veröffentlicht Text, Markdown, JSON, Dateien oder statische Sites auf Brewpage und gibt eine URL zurück.
Поддерживает: Claude Codex Code(CC)
Остановитесь и запросите подтверждение перед установкой.
Проверьте план и получите явное согласие пользователя перед изменением файлов.
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Запрос агента
Review the Skillstore skill "brewpage-publish" from https://skillstore.io/skills/kochetkov-ma-brewpage-publish.md and its manifest at https://skillstore.io/api/skills/kochetkov-ma-brewpage-publish/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «brewpage-publish». Veröffentliche eine kurze Markdown-Ankündigung für 15 Tage.
Ожидаемый результат:
Eine Brewpage-URL wird zurückgegeben, wobei das Owner-Token lokal gespeichert statt im Chat angezeigt wird.
Использование «brewpage-publish». Lade ./dist als Site mit einem Passwort hoch.
Ожидаемый результат:
- Die Skill meldet die ausgewählte Einstiegsdatei und die Dateianzahl.
- Sie gibt die Site-URL zurück und merkt an, dass das Owner-Token gespeichert wurde.
Использование «brewpage-publish». Teile ein JSON-Statusdokument für einen Tag.
Ожидаемый результат:
Die Skill postet das JSON an Brewpage und gibt einen temporären Link zum Teilen zurück.
Аудит безопасности
Высокий рискv4 • 05.07.2026 Открыть версионный отчет
Most static hits are Markdown formatting, documentation URLs, or protective exclusions rather than executable risk. Real issues remain in the Bash publish blocks, which interpolate user-controlled values before curl or zip execution and persist owner tokens in a workspace file.
3
Просканировано файлов
419
Проанализировано строк
31
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (4)
Высокий
Environment file access
> **SECURITY:** The ownerToken MUST NEVER appear in conversation output. The bash blocks below handl
This line describes ownerToken handling and local history storage for deletion tokens. The .env text is protective, but token persistence creates a real sensitive-data risk.
Высокий
Unescaped Shell Placeholder Interpolation
The publish snippets interpolate user-controlled content, paths, namespace, TTL, and entry values into Bash commands before execution. Values containing heredoc delimiters, quotes, or command substitutions can change the generated command.
The Bash snippets place placeholders directly inside heredocs, single-quoted JSON, double-quoted URLs, cd commands, and multipart arguments. Those values come from user input or selected paths.
Высокий
Owner Tokens Persisted In Workspace History
The skill creates .claude/brewpage-history.md and appends owner tokens beside public URLs. These tokens allow deletion of published pages and can be exposed through accidental commits or later file reads.
The file path and echo commands are explicit, and each publish path appends the owner token when present. The skill warns not to print tokens but still stores them locally.
Средний
Pre-Built ZIP Upload Bypasses Secret Exclusions
Directory uploads exclude common secret and project files, but the ZIP upload path sends the supplied archive as-is. A ZIP containing credentials, source maps, or repository data would be uploaded without the same filtering.
The SKILL.md instructions describe ZIP files as an alternative input and the ZIP publish block uploads archive=@{zip_file_path}. The exclusion list is only shown for the directory auto-zip path.
Пункты проверки возможностей (31)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Высокий
Ruby/shell backtick execution
```bash
This range is an executable Bash publish block, not only Markdown formatting. It performs curl or archive operations using user-selected content and placeholders.
Высокий
Ruby/shell backtick execution
[ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | html |"
This line writes owner tokens into the local history file. The token is not printed, but it is still stored as sensitive data in the workspace.
Высокий
Ruby/shell backtick execution
```bash
This range is an executable Bash publish block, not only Markdown formatting. It performs curl or archive operations using user-selected content and placeholders.
Высокий
Ruby/shell backtick execution
[ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | json |"
This line writes owner tokens into the local history file. The token is not printed, but it is still stored as sensitive data in the workspace.
Высокий
Ruby/shell backtick execution
```bash
This range is an executable Bash publish block, not only Markdown formatting. It performs curl or archive operations using user-selected content and placeholders.
Высокий
Ruby/shell backtick execution
[ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | file |"
This line writes owner tokens into the local history file. The token is not printed, but it is still stored as sensitive data in the workspace.
Высокий
Ruby/shell backtick execution
```bash
This range is an executable Bash publish block, not only Markdown formatting. It performs curl or archive operations using user-selected content and placeholders.
Высокий
Ruby/shell backtick execution
[ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | site ($F
This line writes owner tokens into the local history file. The token is not printed, but it is still stored as sensitive data in the workspace.
Высокий
Ruby/shell backtick execution
```bash
This range is an executable Bash publish block, not only Markdown formatting. It performs curl or archive operations using user-selected content and placeholders.
Высокий
Ruby/shell backtick execution
[ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | site ($F
This line writes owner tokens into the local history file. The token is not printed, but it is still stored as sensitive data in the workspace.
Высокий
Shell command substitution
CONTENT=$(cat <<'BREWPAGE_EOF'
User-provided page content is placed inside a shell heredoc before execution. Content containing the delimiter or shell syntax could alter the command block.
Высокий
Shell command substitution
RESPONSE=$(curl -s -X POST "https://brewpage.app/api/html?ns={ns}&ttl={days}&format=markdown" \
The curl command is constructed from user-controlled placeholders and then executed by Bash. This creates command-injection and unintended upload risk.
Высокий
Shell command substitution
[ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | html |"
The command appends owner tokens to a workspace history file. This intentionally stores sensitive deletion tokens at rest.
Высокий
Shell command substitution
RESPONSE=$(curl -s -X POST "https://brewpage.app/api/json?ns={ns}&ttl={days}" \
The JSON publish block inserts original_json inside a shell command. Quotes or shell metacharacters in user JSON can break the intended curl invocation.
Высокий
Shell command substitution
[ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | json |"
The command appends owner tokens to a workspace history file. This intentionally stores sensitive deletion tokens at rest.
Высокий
Shell command substitution
RESPONSE=$(curl -s -X POST "https://brewpage.app/api/files?ns={ns}&ttl={days}" \
A user-controlled path placeholder is inserted into a curl multipart argument. Unescaped shell metacharacters in the final path can alter the command.
Высокий
Shell command substitution
[ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | file |"
The command appends owner tokens to a workspace history file. This intentionally stores sensitive deletion tokens at rest.
Высокий
Shell command substitution
RESPONSE=$(curl -s -X POST "https://brewpage.app/api/sites?ns={ns}&ttl={days}&entry={entry}" \
The site upload command uses user-controlled namespace, TTL, entry, and archive values inside a shell command. Without strict validation, those values can affect execution.
Высокий
Shell command substitution
[ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | site ($F
The command appends owner tokens to a workspace history file. This intentionally stores sensitive deletion tokens at rest.
Высокий
Shell command substitution
RESPONSE=$(curl -s -X POST "https://brewpage.app/api/sites?ns={ns}&ttl={days}&entry={entry}" \
A user-controlled path placeholder is inserted into a curl multipart argument. Unescaped shell metacharacters in the final path can alter the command.
Высокий
Shell command substitution
[ -n "$TOKEN" ] && echo "| $(date '+%Y-%m-%d %H:%M') | [$URL]($URL) | \`$TOKEN\` | {ttl}d | site ($F
The command appends owner tokens to a workspace history file. This intentionally stores sensitive deletion tokens at rest.
Высокий
Template literal with command substitution
```bash
The fenced Bash publish block is intended to be executed and contains user-controlled placeholders plus command substitutions. The block can upload data and may be affected by unescaped input.
Высокий
Template literal with command substitution
```bash
The fenced Bash publish block is intended to be executed and contains user-controlled placeholders plus command substitutions. The block can upload data and may be affected by unescaped input.
Высокий
Template literal with command substitution
```bash
The fenced Bash publish block is intended to be executed and contains user-controlled placeholders plus command substitutions. The block can upload data and may be affected by unescaped input.
Высокий
Template literal with command substitution
```bash
The fenced Bash publish block is intended to be executed and contains user-controlled placeholders plus command substitutions. The block can upload data and may be affected by unescaped input.
Высокий
Template literal with command substitution
```bash
The fenced Bash publish block is intended to be executed and contains user-controlled placeholders plus command substitutions. The block can upload data and may be affected by unescaped input.
Средний
Hardcoded URL
RESPONSE=$(curl -s -X POST "https://brewpage.app/api/html?ns={ns}&ttl={days}&format=markdown" \
This executable curl POST sends user-selected content to brewpage.app. The behavior is disclosed, but it is still a real external upload path.
Средний
Hardcoded URL
RESPONSE=$(curl -s -X POST "https://brewpage.app/api/json?ns={ns}&ttl={days}" \
This executable curl POST sends user-selected content to brewpage.app. The behavior is disclosed, but it is still a real external upload path.
Средний
Hardcoded URL
RESPONSE=$(curl -s -X POST "https://brewpage.app/api/files?ns={ns}&ttl={days}" \
This executable curl POST sends user-selected content to brewpage.app. The behavior is disclosed, but it is still a real external upload path.
Средний
Hardcoded URL
RESPONSE=$(curl -s -X POST "https://brewpage.app/api/sites?ns={ns}&ttl={days}&entry={entry}" \
This executable curl POST sends user-selected content to brewpage.app. The behavior is disclosed, but it is still a real external upload path.
Средний
Hardcoded URL
RESPONSE=$(curl -s -X POST "https://brewpage.app/api/sites?ns={ns}&ttl={days}&entry={entry}" \
This executable curl POST sends user-selected content to brewpage.app. The behavior is disclosed, but it is still a real external upload path.
Факторы риска
🌐 Доступ к сети (14)
⚙️ Внешние команды (103)
SKILL.md:18 SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:27 SKILL.md:28 SKILL.md:29 SKILL.md:30 SKILL.md:31 SKILL.md:33 SKILL.md:38-41 SKILL.md:41-43 SKILL.md:43 SKILL.md:46 SKILL.md:47 SKILL.md:48-52 SKILL.md:52-58 SKILL.md:58-68 SKILL.md:68-71 SKILL.md:71 SKILL.md:72 SKILL.md:73 SKILL.md:78 SKILL.md:79-80 SKILL.md:80-86 SKILL.md:86-96 SKILL.md:96-99 SKILL.md:99-101 SKILL.md:101-104 SKILL.md:104 SKILL.md:105-106 SKILL.md:106-110 SKILL.md:110 SKILL.md:113-122 SKILL.md:122-123 SKILL.md:123-129 SKILL.md:129-131 SKILL.md:131-134 SKILL.md:134-152 SKILL.md:152-157 SKILL.md:157-160 SKILL.md:160-173 SKILL.md:173-178 SKILL.md:178-181 SKILL.md:181-193 SKILL.md:193-198 SKILL.md:198-201 SKILL.md:201-220 SKILL.md:220-225 SKILL.md:225-228 SKILL.md:228-243 SKILL.md:243-248 SKILL.md:248-252 SKILL.md:252-253 SKILL.md:253-256 SKILL.md:256-258 SKILL.md:258-259 SKILL.md:259-267 SKILL.md:267-271 SKILL.md:271-272 SKILL.md:272-274 SKILL.md:274-278 SKILL.md:278-279 SKILL.md:279 SKILL.md:280 SKILL.md:281-282 SKILL.md:282 SKILL.md:283 SKILL.md:284 SKILL.md:285 SKILL.md:286 SKILL.md:116 SKILL.md:136-139 SKILL.md:140 SKILL.md:143-146 SKILL.md:148 SKILL.md:149 SKILL.md:152 SKILL.md:164-167 SKILL.md:169 SKILL.md:170 SKILL.md:173 SKILL.md:185-187 SKILL.md:189 SKILL.md:190 SKILL.md:193 SKILL.md:205 SKILL.md:208-211 SKILL.md:214 SKILL.md:216 SKILL.md:217 SKILL.md:220 SKILL.md:232-235 SKILL.md:237 SKILL.md:239 SKILL.md:240 SKILL.md:243 SKILL.md:113-122 SKILL.md:134-152 SKILL.md:160-173 SKILL.md:181-193 SKILL.md:201-220 SKILL.md:228-243
📁 Доступ к файловой системе (4)
Аудитор:: codex Посмотреть историю аудитов →
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/kochetkov-ma-brewpage-publish/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/kochetkov-ma-brewpage-publish?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/kochetkov-ma-brewpage-publish?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/kochetkov-ma-brewpage-publish/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/kochetkov-ma-brewpage-publish.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
kochetkov-ma. (2026). brewpage-publish security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/kochetkov-ma-brewpage-publish/audits/4Цитата BibTeX
@techreport{kochetkov-ma-kochetkov-ma-brewpage-publish-2026,
author = {kochetkov-ma},
title = {brewpage-publish security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/kochetkov-ma-brewpage-publish/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "brewpage-publish security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "kochetkov-ma"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/kochetkov-ma-brewpage-publish/audits/4"
identifiers:
- type: other
value: "skillstore:kochetkov-ma-brewpage-publish:audit:4"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: Средний 55
Архитектура
85
Сопровождаемость
85
Контент
67
Сообщество
83
Соответствие спецификации
Что вы можете построить
Eine statische Vorschau teilen
Veröffentliche ein erstelltes Site-Verzeichnis und sende eine temporäre URL an Reviewer.
Einen Dokumententwurf veröffentlichen
Wandle eine Markdown-Notiz oder einen Bericht in eine gehostete Seite um, ohne einen Server einzurichten.
Ein Datenbeispiel hosten
Lade ein JSON-Objekt oder eine Datei hoch und teile einen Direktlink für kurzfristige Zusammenarbeit.
Попробуйте эти промпты
Eine Notiz veröffentlichen
Veröffentliche diesen Text auf Brewpage mit der Standard-TTL. Frag mich, bevor du einen öffentlichen Namespace oder ein Passwort verwendest.
Eine Markdown-Datei teilen
Veröffentliche report.md für 7 Tage auf Brewpage. Verwende einen beschreibenden Namespace und frag mich nach Passwortschutz.
Eine erstellte Site hosten
Veröffentliche die erstellte Site in ./dist mit index.html als Einstiegsdatei. Zeige vor dem Upload die Dateianzahl an und verwende ein Passwort.
Mit Bereinigung veröffentlichen
Veröffentliche ./release-site für 3 Tage als Brewpage-Site, bestätige, dass das Archiv Geheimnisse ausschließt, speichere das Owner-Token und fasse die Löschschritte zusammen.
Лучшие практики
- Prüfe Dateien und Verzeichnisse, bevor du sie auf Brewpage veröffentlichst.
- Verwende Passwortschutz für Entwürfe, private Dateien und Review-Links.
- Schütze die Owner-Token-Verlaufsdatei und halte sie aus der Versionskontrolle heraus.
Избегать
- Quellbäume statt erstellter statischer Ausgabe veröffentlichen.
- ZIP-Archive hochladen, die nicht auf Geheimnisse geprüft wurden.
- Owner-Token teilen oder die Verlaufsdatei committen.
Часто задаваемые вопросы
Was kann diese Skill veröffentlichen?
Sie kann Text, Markdown, JSON, einzelne Dateien, Verzeichnisse und ZIP-Archive auf Brewpage veröffentlichen.
Erfordert sie ein Brewpage-Konto?
Die README gibt an, dass für die Veröffentlichung keine Registrierung erforderlich ist.
Sind veröffentlichte Inhalte öffentlich?
Standardmäßig können Inhalte öffentlich sein. Verwende Passwortschutz, wenn der Inhalt privat oder unfertig ist.
Wo werden Owner-Token gespeichert?
Die Skill speichert Owner-Token in .claude/brewpage-history.md, damit Benutzer veröffentlichte Seiten später löschen können.
Welche Kommandozeilentools werden benötigt?
Die Skill verwendet Bash mit Tools wie curl, jq, zip, tr, head, mktemp und file.
Wie sollten ZIP-Uploads gehandhabt werden?
Prüfe ZIP-Archive vor dem Upload, da vorab erstellte ZIP-Dateien unverändert gesendet werden.
Сведения для разработчиков
Автор
kochetkov-maЛицензия
MIT
Ревизия Skillstore
r1
Примечание о версии
Автор не указал версию.
Ссылка
a25199bc7d6b82598536822d1738eb5d5f54025b
Актуальность поддержки
18.07.2026
Использование
1 загрузок · 0 просмотров