Skills local-dev-server

📦

local-dev-server

Name: local-dev-server
Author: Acurioustractor

Content revision r1 High Risk ⚙️ External commands📁 Filesystem access🌐 Network access

Manage Local Next.js Dev Servers

Local development servers often fail from stale caches, busy ports, or hidden build errors. This skill gives Claude, Codex, and Claude Code repeatable commands to restart and verify Next.js servers.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "local-dev-server" from https://skillstore.io/skills/acurioustractor-local-dev-server.md and its manifest at https://skillstore.io/api/skills/acurioustractor-local-dev-server/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/acurioustractor-local-dev-server.md Signed manifest GET /api/skills/acurioustractor-local-dev-server/manifest Signed lockfile GET /api/skills/acurioustractor-local-dev-server/lockfile

Test it

Using "local-dev-server". The local app is stuck on an infinite loading screen.

Expected outcome:

The response identifies stale build cache as a likely cause, performs a clean local restart with confirmation, and reports the returned HTTP status.

Using "local-dev-server". Port 3030 is already in use.

Expected outcome:

The response explains which local process owns the port, asks before terminating it, and starts the expected development server after approval.

Using "local-dev-server". Keep the dev server running during a long session.

Expected outcome:

The response uses PM2 process management, checks recent logs, and tells the user how to stop or restart the process later.

Security Audit

High Risk

v10 • 7/7/2026 Open versioned report

Most Ruby backtick, device-file, localhost URL, and reconnaissance detections are false positives caused by Markdown formatting and local health checks. The confirmed risks are forceful process termination, persistent shell profile alias guidance, destructive cache deletion, and external absolute deployment scripts. No prompt injection attempt was found in the reviewed files.

Files scanned

210

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (2)

High

refs/pm2-commands.md:24-32 refs/pm2-commands.md:98-99

External Script Execution Outside Project Scope

The PM2 reference directs agents to run absolute deployment scripts under /Users/benknight/act-global-infrastructure. This can execute unreviewed local scripts outside the skill directory and affect unrelated services.

The cited lines contain absolute deployment script paths for broad ecosystem start, restart, and stop actions. The scripts are not included in the reviewed skill, so their behavior cannot be verified.

Medium

SKILL.md:24-25 SKILL.md:69-73 SKILL.md:87-89

Destructive Cache Deletion Guidance

The skill instructs agents to delete the .next directory during normal restarts. This targets build cache, but it is destructive and should require workspace confirmation.

The cited lines repeatedly instruct removal of the .next directory as a restart step. The scope is local cache cleanup, but the deletion command is still destructive.

Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

refs/pm2-commands.md:91

Hidden file in home directory

## Shell Aliases (add to ~/.zshrc)

The reference explicitly tells users to add aliases to ~/.zshrc, a persistent hidden shell startup file. The aliases are operational, but modifying shell startup configuration is security-sensitive.

Medium

refs/pm2-commands.md:70

xargs command (can execute arbitrary commands)

lsof -ti :3030 | xargs kill -9

The command force-kills whatever process owns port 3030 using PIDs from lsof. This is legitimate troubleshooting, but it can terminate unrelated local services without confirmation.

Medium

refs/pm2-commands.md:82

xargs command (can execute arbitrary commands)

lsof -ti :3030 | xargs kill -9

The command force-kills whatever process owns port 3030 using PIDs from lsof. This is legitimate troubleshooting, but it can terminate unrelated local services without confirmation.

Medium

refs/pm2-commands.md:91

Hidden file access

## Shell Aliases (add to ~/.zshrc)

The reference points to ~/.zshrc for persistent shell aliases. This is a real hidden-file access pattern even though the listed aliases are not malicious by themselves.

Medium

SKILL.md:22

xargs command (can execute arbitrary commands)

lsof -ti:3030 | xargs kill -9 2>/dev/null

The command force-kills whatever process owns port 3030 using PIDs from lsof. This is legitimate troubleshooting, but it can terminate unrelated local services without confirmation.

Medium

SKILL.md:41

xargs command (can execute arbitrary commands)

lsof -ti:3030 | xargs kill -9 2>/dev/null

The command force-kills whatever process owns port 3030 using PIDs from lsof. This is legitimate troubleshooting, but it can terminate unrelated local services without confirmation.

Medium

SKILL.md:71

xargs command (can execute arbitrary commands)

lsof -ti:3030 | xargs kill -9 2>/dev/null

The command force-kills whatever process owns port 3030 using PIDs from lsof. This is legitimate troubleshooting, but it can terminate unrelated local services without confirmation.

Medium

SKILL.md:78

xargs command (can execute arbitrary commands)

lsof -ti:3030 | xargs kill -9 2>/dev/null

The command force-kills whatever process owns port 3030 using PIDs from lsof. This is legitimate troubleshooting, but it can terminate unrelated local services without confirmation.

Risk Factors

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/acurioustractor-local-dev-server/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/acurioustractor-local-dev-server/security.svg)](https://skillstore.io/skills/acurioustractor-local-dev-server?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/acurioustractor-local-dev-server?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/acurioustractor-local-dev-server/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/acurioustractor-local-dev-server.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Acurioustractor. (2026). local-dev-server security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/acurioustractor-local-dev-server/audits/10

BibTeX citation

@techreport{acurioustractor-acurioustractor-local-dev-server-2026,
  author = {Acurioustractor},
  title = {local-dev-server security audit report (audit version 10)},
  institution = {Skillstore},
  year = {2026},
  number = {10},
  url = {https://skillstore.io/skills/acurioustractor-local-dev-server/audits/10},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "local-dev-server security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
  - name: "Acurioustractor"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/acurioustractor-local-dev-server/audits/10"
identifiers:
  - type: other
    value: "skillstore:acurioustractor-local-dev-server:audit:10"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Restart A Broken Local Server

Recover a Next.js server when pages spin, static chunks fail, or the development process is stale.

Resolve Port Conflicts

Identify and clear a busy local port before launching the expected development server.

Keep A Dev Server Running

Use PM2 commands to start, restart, inspect, and stop a persistent local development process.

Try These Prompts

Start The Server

Start the local Next.js development server using this skill. Confirm the working directory, clear stale cache only if needed, and report the localhost status.

Fix A Busy Port

Port 3030 is already in use. Use this skill to identify the owning process, ask before terminating it, then restart the dev server.

Recover From Cache Errors

The app shows stale chunk or vendor chunk errors. Use this skill to perform a clean restart and verify the main route after compilation.

Audit PM2 Server State

Use this skill to inspect the PM2-managed local dev server, review recent logs, restart only if necessary, and summarize any errors found.

Best Practices

Confirm the working directory before deleting build cache.
Verify the process owner before stopping anything on port 3030.
Check localhost status and logs after every restart.

Avoid

Killing port processes without user confirmation.
Editing shell startup files without explicit approval.
Running user-specific absolute deployment scripts without review.

Frequently Asked Questions

What does this skill manage?

It manages a local Next.js development server, cache cleanup, PM2 commands, and localhost verification.

Does it work with Claude, Codex, and Claude Code?

Yes. The metadata lists Claude, Codex, and Claude Code as supported tools.

Why does it remove the .next directory?

It removes the build cache when stale chunks or corrupted cache files break local pages.

Can it fix production deployment issues?

No. It is focused on local development server workflows, not production deployment troubleshooting.

Is port 3030 configurable?

The documented workflow assumes port 3030. Users should adapt commands before using a different port.

What should users review before installing it?

Users should review force-kill commands, .next deletion steps, shell alias guidance, and any absolute deployment script references.

Developer Details

Author

Acurioustractor

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/Acurioustractor/empathy-ledger-v2/tree/main/.claude/skills/local/local-dev-server

Ref

d46e62089a6dfc9e14ea02eebd9b8e2ad2dfe1f4

Maintenance freshness

7/20/2026

Usage

8 downloads · 335 views

File structure

📁 refs/

📄 pm2-commands.md

📄 SKILL.md