スキル valet-publish
📦
valet-publish
コンテンツリビジョン r1 重大 ⚙️ 外部コマンド🌐 ネットワークアクセス📁 ファイルシステムへのアクセス
Publish Static Files with Valet
Sharing generated sites and artifacts often requires manual hosting setup. This skill prepares content and publishes it through the Valet CLI or MCP server.
対応: Claude Codex Code(CC)
この Skill を自動インストールしないでください。
基準ポリシーにより、インストール操作の前にオペレーターのレビューが必要です。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "valet-publish" from https://skillstore.io/skills/valetdotdev-valet-publish.md and its manifest at https://skillstore.io/api/skills/valetdotdev-valet-publish/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「valet-publish」を使用しています。 Publish the migration report privately for the infrastructure team.
期待される結果:
Published the migration report to the account site. The URL requires Valet login and is available to organization members.
「valet-publish」を使用しています。 Create a temporary public link for this product demo.
期待される結果:
- Published the reviewed demo directory as a temporary public site.
- The response includes the live URL, expiry time, and one-time claim URL.
- The local Valet configuration contains a credential and must not be committed.
「valet-publish」を使用しています。 Share the private audit with two external reviewers.
期待される結果:
Sent bounded access links to the named recipients without changing the site from private access.
セキュリティ監査
重大v1 • 2026/8/15 バージョン別レポートを開く
Most alerts are Markdown backticks, examples, or documentation links and are false positives. Remote pipe-to-shell installers and broad uploads create supply-chain and credential-disclosure risks despite consent and inspection safeguards.
1
スキャンされたファイル
826
解析済み行数
7
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (4)
重大
Pipe to shell pattern
curl -fsSL https://valet.dev/install.sh | sh
The installation command pipes a remote script directly into a shell. Compromise of the host or response can execute arbitrary code.
高
Environment file access
downloaded tool output, and `.env` files, and all of it becomes part
The documented uploader includes .env files unless users remove them first. Publishing such files can disclose credentials despite the skill's explicit warning.
高
Environment file access
`.env` files, `node_modules/`, and anything the project's `.gitignore`
The documented uploader includes .env files unless users remove them first. Publishing such files can disclose credentials despite the skill's explicit warning.
高
Broad Directory Upload Can Expose Unreviewed Files
Valet deployment uploads nearly every file and ignores gitignore rules. A mistaken source directory can expose logs, dependencies, dotfiles, or credentials.
The skill explicitly defines the short exclusion list and states that all other directory contents are uploaded. It also requires pre-deployment inspection.
機能レビュー項目 (7)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
重大
PowerShell invocation
On Windows, in PowerShell:
This installation section directs users to execute a downloaded PowerShell script through iex. Consent reduces surprise but not supply-chain exposure.
重大
PowerShell invocation
```powershell
This installation section directs users to execute a downloaded PowerShell script through iex. Consent reduces surprise but not supply-chain exposure.
重大
Hardcoded URL
curl -fsSL https://valet.dev/install.sh | sh
This URL supplies an installer that is immediately piped into a shell. A compromised response can execute arbitrary code.
重大
Hardcoded URL
irm https://valet.dev/install.ps1 | iex
This URL supplies a PowerShell installer that is immediately passed to iex. A compromised response can execute arbitrary code.
低
Hardcoded URL
at `https://api.valet.dev/mcp`. Prefer the CLI; see
This is the fixed Valet MCP endpoint used for remote publishing operations. The network dependency is intentional but real.
低
Hardcoded URL
its MCP server at `https://api.valet.dev/mcp`. It is reached over the network
This is the fixed Valet MCP endpoint used for remote publishing operations. The network dependency is intentional but real.
低
Hardcoded URL
> add `https://api.valet.dev/mcp` as a connector in this tool's
This is the fixed Valet MCP endpoint used for remote publishing operations. The network dependency is intentional but real.
リスク要因
⚙️ 外部コマンド (50)
SKILL.md:13 SKILL.md:20 SKILL.md:22 SKILL.md:27-29 SKILL.md:29-31 SKILL.md:31-34 SKILL.md:34-36 SKILL.md:36-57 SKILL.md:57-61 SKILL.md:61-62 SKILL.md:62-70 SKILL.md:70-74 SKILL.md:74-86 SKILL.md:86-98 SKILL.md:98 SKILL.md:99-107 SKILL.md:107-109 SKILL.md:109-120 SKILL.md:120-122 SKILL.md:122-126 SKILL.md:126-128 SKILL.md:128-130 SKILL.md:130-131 SKILL.md:131-134 SKILL.md:134-135 SKILL.md:135-137 SKILL.md:137-140 SKILL.md:140-142 SKILL.md:142-150 SKILL.md:150-155 SKILL.md:155-156 SKILL.md:156 SKILL.md:158-160 SKILL.md:160-166 SKILL.md:166-170 SKILL.md:170-177 SKILL.md:177-179 SKILL.md:179-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-186 SKILL.md:186-195 SKILL.md:195-208 SKILL.md:208 SKILL.md:209 SKILL.md:210-219 SKILL.md:219-225 SKILL.md:225-226 SKILL.md:226-232 SKILL.md:232-239
🌐 ネットワークアクセス (9)
📁 ファイルシステムへのアクセス (1)
検出されたパターン
Pipe to shell pattern
監査者: codex
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/valetdotdev-valet-publish/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/valetdotdev-valet-publish?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/valetdotdev-valet-publish?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/valetdotdev-valet-publish/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/valetdotdev-valet-publish.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
valetdotdev. (2026). valet-publish security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/valetdotdev-valet-publish/audits/1BibTeX形式の引用
@techreport{valetdotdev-valetdotdev-valet-publish-2026,
author = {valetdotdev},
title = {valet-publish security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/valetdotdev-valet-publish/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "valet-publish security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "valetdotdev"
date-released: "2026-08-15"
url: "https://skillstore.io/skills/valetdotdev-valet-publish/audits/1"
identifiers:
- type: other
value: "skillstore:valetdotdev-valet-publish:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 低 55
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
74
仕様準拠
作成できるもの
Deploy a development preview
Publish a prepared build directory as a private review site or an approved public preview.
Share a rendered report
Turn an analysis, dashboard, or status document into a controlled live URL.
Distribute static assets
Host PDFs, images, and design deliverables with clear titles, access settings, and recipient sharing.
これらのプロンプトを試す
Publish a prepared folder
Review the contents of [folder], explain the visibility choices, and publish it with Valet after I approve the destination.
Create a temporary public preview
Prepare [file or folder] in a clean directory, check for sensitive files, and publish an anonymous preview after confirming public access.
Publish a private report
Build a complete HTML report from [source], follow the organization design system, and publish it privately to [organization].
Update and share an existing site
Download or locate [site], review changes and upload scope, update it, then share with [recipients] using bounded access links.
ベストプラクティス
- Publish from a clean directory containing only intended public or organization-visible files.
- Confirm visibility, access changes, installations, and destructive actions before executing them.
- Protect claim tokens, report accurate expiry details, and use bounded recipient links when possible.
回避
- Do not publish a working directory without reviewing every included file.
- Do not make a site public merely to avoid authentication or connector setup.
- Do not print, commit, or place passwords and site tokens in agent commands.
よくある質問
Does this skill require a Valet account?
No. Anonymous publishing works without an account, but creates a public site that expires after 36 hours.
Are account sites public by default?
No. New account sites are private and available to members of the owning organization.
Can the MCP server publish PDFs or images?
No. MCP publishing carries text files only. Binary files require the Valet CLI.
Which files does CLI deployment exclude?
It excludes Git directories, Valet directories, the root Valet manifest, and symbolic links. Other files can be uploaded.
Can an anonymous site be updated later?
Yes, from its original linked directory while its site credential remains valid and the site has not expired.
How should sensitive access credentials be handled?
Keep passwords out of agent commands and transcripts. Never print or commit Valet configuration files or anonymous site tokens.
開発者情報
作成者
valetdotdevライセンス
MIT
Skillstore リビジョン
r1
バージョンに関する注意
作者はバージョンを宣言していません。
参照
60855416b9ec7b18f5e06fa97cdadcfda015db7a
メンテナンスの新しさ
2026/8/15
利用状況
0 ダウンロード · 0 閲覧
ファイル構成
📄 SKILL.md