Habilidades revdoku
📦

revdoku

Revisión del contenido r1 Crítico ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos🔑 Variables de entorno

Publish Static Sites with Review Previews

Publishing a static site can require separate tools for drafts, previews, and live releases. Revdoku manages local folders, private drafts, review links, and publication through one workflow.

Compatible con: Claude Codex Code(CC)
⚠️ 38 Deficiente

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente
Review the Skillstore skill "revdoku" from https://skillstore.io/skills/revdoku-revdoku.md and its manifest at https://skillstore.io/api/skills/revdoku-revdoku/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Pruébalo

Usando "revdoku". Create a review preview for my site folder.

Resultado esperado:

  • Private draft created from the selected folder.
  • Temporary noindex preview link is ready for review.
  • No public publication was performed.

Usando "revdoku". Publish this reviewed website.

Resultado esperado:

  • Target website and access mode are shown for confirmation.
  • After approval, the site is published and the live URL is provided.

Auditoría de seguridad

Crítico

The skill is a static-site publishing CLI with legitimate network, filesystem, and credential operations; most pattern matches are benign documentation, exclusions, or quoted shell usage. Publication is not recommended without remediation because the documented installer executes unverified remote code, and the CLI has credential and repository-binding trust-boundary weaknesses. Static review was capped at 400/670 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

3
Archivos escaneados
3,321
Líneas analizadas
0
Elementos de revisión
0
Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (5)

Crítico
Pipe to shell pattern
curl -fsSL https://revdoku.com/install.sh | bash
The documentation instructs users to download an installer over HTTPS and execute it directly with bash. The downloaded script is not pinned or verified before execution.
Crítico
Unverified remote bootstrap execution
The installer downloads the Revdoku executable and marks it executable without verifying a signature or checksum. The documentation also directs users to execute a remotely fetched installer through bash.
The script download and executable permission change are direct, and no integrity verification is present in the cited bootstrap path.
Alto
Bearer token can be sent to a caller-selected origin
The CLI accepts a configurable service URL and sends the saved API key as a Bearer token in requests. An untrusted URL setting can therefore redirect credentials to another origin.
The cited configuration and authenticated request code establish the credential flow. Exploitation depends on an attacker influencing the URL setting or command environment.
Alto
Repository binding can retarget destructive publishing
A project-local .revdoku file supplies a bucket identifier, and publication requests delete missing files. Publishing an untrusted checkout can therefore modify or remove content in a bucket accessible to the user.
The local binding is read without an interactive target confirmation, and the cited publish payload requests deletion of absent files. Exploitation requires valid credentials and a user-initiated publish.
Medio
Existing credentials file permissions are not repaired
Saving an API key sets a restrictive umask but does not explicitly chmod an existing credentials file. A previously permissive file can retain its permissions after being overwritten with a new key.
The cited save routine establishes umask but lacks a permission repair step. The exposure requires an existing file with insecure mode on a shared system.

Factores de riesgo

⚙️ Comandos externos (50)
🌐 Acceso a red (15)
📁 Acceso al sistema de archivos (50)
🔑 Variables de entorno (28)

Patrones detectados

Pipe to shell pattern
Auditado por: claude
Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado
Evaluación de seguridad

Copiar enlace del informe

https://skillstore.io/skills/revdoku-revdoku/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/revdoku-revdoku/security.svg)](https://skillstore.io/skills/revdoku-revdoku?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/revdoku-revdoku?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/revdoku-revdoku/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/revdoku-revdoku.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Citas académicas (APA · BibTeX · CFF)

Cita APA

revdoku. (2026). revdoku security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/revdoku-revdoku/audits/1

Cita BibTeX

@techreport{revdoku-revdoku-revdoku-2026, author = {revdoku}, title = {revdoku security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/revdoku-revdoku/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "revdoku security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "revdoku" date-released: "2026-09-08" url: "https://skillstore.io/skills/revdoku-revdoku/audits/1" identifiers: - type: other value: "skillstore:revdoku-revdoku:audit:1" description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Bajo
45
Arquitectura
85
Mantenibilidad
87
Contenido
65
Comunidad
83
Cumplimiento de la especificación

Lo que puedes crear

Review a marketing site before release

Create a private draft and share a temporary review preview before a public launch.

Deploy a static project folder

Upload a finished HTML, CSS, JavaScript, or SPA folder and publish it after review.

Share a protected client deliverable

Publish a static deliverable with password or email-gated access for a limited audience.

Prueba estos prompts

Create a first draft
Create a simple static landing page in a new folder. Prepare it as a private Revdoku draft, not a public website.
Request a review preview
Upload the site in ./website as a private draft. Create a temporary noindex preview link and show me the URL.
Publish after confirmation
Review the files in ./dist. Explain what will be published, then ask for my confirmation before publishing it publicly.
Update a protected site safely
Check the Revdoku binding in this project. Show the target and changed files. After I confirm, update the existing password-protected website.

Mejores prácticas

  • Create a private draft or preview before every public release.
  • Review the resolved bucket and changed files before approving publication.
  • Keep secrets outside the upload folder and verify exclusions before deployment.

Evitar

  • Do not publish an unreviewed folder from an untrusted repository.
  • Do not pass an untrusted service URL when using saved credentials.
  • Do not use the curl-to-bash installer until the downloaded artifact is verified.

Preguntas frecuentes

What can Revdoku publish?
It can publish static files, folders, and single-page applications from a local path.
Can I review a site before it is public?
Yes. Create a private draft and use a temporary noindex preview link.
Does publishing require confirmation?
It should. Publishing makes content externally available, so confirm the target and access mode first.
How are repeat deployments targeted?
The CLI can store a project-local .revdoku binding with the target bucket details.
Can I protect a published site?
Yes. The documented workflow supports password-protected and email-gated publication modes.
What should I avoid uploading?
Keep credentials, private keys, environment files, and unrelated local data outside the selected upload folder.

Detalles del desarrollador

Autor

revdoku

Licencia

MIT

Revisión de Skillstore

r1

Aviso de versión

El autor no declaró una versión.

Ref.

d9e5ab86dafd32a1ddde9b8b4fde177589b55b95

Actualidad del mantenimiento

8/9/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📁 bin/

📄 revdoku

📁 scripts/

📄 revdoku.sh

📄 SKILL.md

Ver todo