Habilidades valet-publish
📦
valet-publish
Revisão do conteúdo r1 Crítico ⚙️ Comandos externos🌐 Acesso à rede📁 Acesso ao sistema de arquivos
Publish Static Files with Valet
Sharing generated sites and artifacts often requires manual hosting setup. This skill prepares content and publishes it through the Valet CLI or MCP server.
Suporta: Claude Codex Code(CC)
Não instale este Skill automaticamente.
A política canônica exige a revisão de um operador antes de qualquer ação de instalação.
Instalar com meu Agente
Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.
Solicitação do agente
Review the Skillstore skill "valet-publish" from https://skillstore.io/skills/valetdotdev-valet-publish.md and its manifest at https://skillstore.io/api/skills/valetdotdev-valet-publish/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.
Recursos legíveis por agentes
Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.
Testar
Usando "valet-publish". Publish the migration report privately for the infrastructure team.
Resultado esperado:
Published the migration report to the account site. The URL requires Valet login and is available to organization members.
Usando "valet-publish". Create a temporary public link for this product demo.
Resultado esperado:
- Published the reviewed demo directory as a temporary public site.
- The response includes the live URL, expiry time, and one-time claim URL.
- The local Valet configuration contains a credential and must not be committed.
Usando "valet-publish". Share the private audit with two external reviewers.
Resultado esperado:
Sent bounded access links to the named recipients without changing the site from private access.
Auditoria de segurança
Críticov1 • 15/08/2026 Abrir o relatório versionado
Most alerts are Markdown backticks, examples, or documentation links and are false positives. Remote pipe-to-shell installers and broad uploads create supply-chain and credential-disclosure risks despite consent and inspection safeguards.
1
Arquivos analisados
826
Linhas analisadas
7
Itens de revisão
0
Falsos positivos ignorados
Preocupações de segurança confirmadas (4)
Crítico
Pipe to shell pattern
curl -fsSL https://valet.dev/install.sh | sh
The installation command pipes a remote script directly into a shell. Compromise of the host or response can execute arbitrary code.
Alto
Environment file access
downloaded tool output, and `.env` files, and all of it becomes part
The documented uploader includes .env files unless users remove them first. Publishing such files can disclose credentials despite the skill's explicit warning.
Alto
Environment file access
`.env` files, `node_modules/`, and anything the project's `.gitignore`
The documented uploader includes .env files unless users remove them first. Publishing such files can disclose credentials despite the skill's explicit warning.
Alto
Broad Directory Upload Can Expose Unreviewed Files
Valet deployment uploads nearly every file and ignores gitignore rules. A mistaken source directory can expose logs, dependencies, dotfiles, or credentials.
The skill explicitly defines the short exclusion list and states that all other directory contents are uploaded. It also requires pre-deployment inspection.
Itens de revisão de capacidade (7)
Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.
Crítico
PowerShell invocation
On Windows, in PowerShell:
This installation section directs users to execute a downloaded PowerShell script through iex. Consent reduces surprise but not supply-chain exposure.
Crítico
PowerShell invocation
```powershell
This installation section directs users to execute a downloaded PowerShell script through iex. Consent reduces surprise but not supply-chain exposure.
Crítico
Hardcoded URL
curl -fsSL https://valet.dev/install.sh | sh
This URL supplies an installer that is immediately piped into a shell. A compromised response can execute arbitrary code.
Crítico
Hardcoded URL
irm https://valet.dev/install.ps1 | iex
This URL supplies a PowerShell installer that is immediately passed to iex. A compromised response can execute arbitrary code.
Baixo
Hardcoded URL
at `https://api.valet.dev/mcp`. Prefer the CLI; see
This is the fixed Valet MCP endpoint used for remote publishing operations. The network dependency is intentional but real.
Baixo
Hardcoded URL
its MCP server at `https://api.valet.dev/mcp`. It is reached over the network
This is the fixed Valet MCP endpoint used for remote publishing operations. The network dependency is intentional but real.
Baixo
Hardcoded URL
> add `https://api.valet.dev/mcp` as a connector in this tool's
This is the fixed Valet MCP endpoint used for remote publishing operations. The network dependency is intentional but real.
Fatores de risco
⚙️ Comandos externos (50)
SKILL.md:13 SKILL.md:20 SKILL.md:22 SKILL.md:27-29 SKILL.md:29-31 SKILL.md:31-34 SKILL.md:34-36 SKILL.md:36-57 SKILL.md:57-61 SKILL.md:61-62 SKILL.md:62-70 SKILL.md:70-74 SKILL.md:74-86 SKILL.md:86-98 SKILL.md:98 SKILL.md:99-107 SKILL.md:107-109 SKILL.md:109-120 SKILL.md:120-122 SKILL.md:122-126 SKILL.md:126-128 SKILL.md:128-130 SKILL.md:130-131 SKILL.md:131-134 SKILL.md:134-135 SKILL.md:135-137 SKILL.md:137-140 SKILL.md:140-142 SKILL.md:142-150 SKILL.md:150-155 SKILL.md:155-156 SKILL.md:156 SKILL.md:158-160 SKILL.md:160-166 SKILL.md:166-170 SKILL.md:170-177 SKILL.md:177-179 SKILL.md:179-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-186 SKILL.md:186-195 SKILL.md:195-208 SKILL.md:208 SKILL.md:209 SKILL.md:210-219 SKILL.md:219-225 SKILL.md:225-226 SKILL.md:226-232 SKILL.md:232-239
🌐 Acesso à rede (9)
📁 Acesso ao sistema de arquivos (1)
Padrões detectados
Pipe to shell pattern
Auditado por: codex
Compartilhar e citar este relatório
Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.
Copiar link do relatório
https://skillstore.io/skills/valetdotdev-valet-publish/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportBadge Markdown
[](https://skillstore.io/skills/valetdotdev-valet-publish?utm_source=security_passport_badge)Badge HTML
<a href="https://skillstore.io/skills/valetdotdev-valet-publish?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/valetdotdev-valet-publish/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Cartão incorporável
<iframe src="https://skillstore.io/embed/skills/valetdotdev-valet-publish.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citações acadêmicas (APA · BibTeX · CFF)
Citação APA
valetdotdev. (2026). valet-publish security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/valetdotdev-valet-publish/audits/1Citação BibTeX
@techreport{valetdotdev-valetdotdev-valet-publish-2026,
author = {valetdotdev},
title = {valet-publish security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/valetdotdev-valet-publish/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "valet-publish security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "valetdotdev"
date-released: "2026-08-15"
url: "https://skillstore.io/skills/valetdotdev-valet-publish/audits/1"
identifiers:
- type: other
value: "skillstore:valetdotdev-valet-publish:audit:1"
description: "Skillstore immutable audit report identifier"
Pontuação do Skillstore
Por que esta pontuação Confiança das evidências: Baixo 55
Arquitetura
85
Manutenibilidade
87
Conteúdo
65
Comunidade
74
Conformidade com a especificação
O que você pode criar
Deploy a development preview
Publish a prepared build directory as a private review site or an approved public preview.
Share a rendered report
Turn an analysis, dashboard, or status document into a controlled live URL.
Distribute static assets
Host PDFs, images, and design deliverables with clear titles, access settings, and recipient sharing.
Teste estes prompts
Publish a prepared folder
Review the contents of [folder], explain the visibility choices, and publish it with Valet after I approve the destination.
Create a temporary public preview
Prepare [file or folder] in a clean directory, check for sensitive files, and publish an anonymous preview after confirming public access.
Publish a private report
Build a complete HTML report from [source], follow the organization design system, and publish it privately to [organization].
Update and share an existing site
Download or locate [site], review changes and upload scope, update it, then share with [recipients] using bounded access links.
Boas práticas
- Publish from a clean directory containing only intended public or organization-visible files.
- Confirm visibility, access changes, installations, and destructive actions before executing them.
- Protect claim tokens, report accurate expiry details, and use bounded recipient links when possible.
Evitar
- Do not publish a working directory without reviewing every included file.
- Do not make a site public merely to avoid authentication or connector setup.
- Do not print, commit, or place passwords and site tokens in agent commands.
Perguntas frequentes
Does this skill require a Valet account?
No. Anonymous publishing works without an account, but creates a public site that expires after 36 hours.
Are account sites public by default?
No. New account sites are private and available to members of the owning organization.
Can the MCP server publish PDFs or images?
No. MCP publishing carries text files only. Binary files require the Valet CLI.
Which files does CLI deployment exclude?
It excludes Git directories, Valet directories, the root Valet manifest, and symbolic links. Other files can be uploaded.
Can an anonymous site be updated later?
Yes, from its original linked directory while its site credential remains valid and the site has not expired.
How should sensitive access credentials be handled?
Keep passwords out of agent commands and transcripts. Never print or commit Valet configuration files or anonymous site tokens.
Detalhes do desenvolvedor
Autor
valetdotdevLicença
MIT
Revisão da Skillstore
r1
Aviso de versão
O autor não declarou uma versão.
Repositório
https://github.com/valetdotdev/skills/tree/a3e8193eb1e509e840c99cec5fec2ba1a636c296/skills/valet-publishReferência
60855416b9ec7b18f5e06fa97cdadcfda015db7a
Atualidade da manutenção
15/08/2026
Uso
0 downloads · 0 visualizações
Estrutura de arquivos
📄 SKILL.md