Skills when-bridging-web-cli-use-web-cli-teleport
📦

when-bridging-web-cli-use-web-cli-teleport

v1.0.0 Content revision r1 Critical ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access

Build Web-CLI Bridge Workflows

Teams often need a web UI to trigger and observe CLI workflows. This skill provides a bridge pattern using REST endpoints, WebSockets, and local CLI integration.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "when-bridging-web-cli-use-web-cli-teleport" from https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport.md Signed manifest GET /api/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/manifest Signed lockfile GET /api/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/lockfile

Test it

Using "when-bridging-web-cli-use-web-cli-teleport". Plan a browser interface that runs approved local test commands.

Expected outcome:

  • A phased bridge architecture with a React control surface, a local API, and a restricted command runner.
  • A security checklist covering authentication, command allowlists, argument validation, and output scoping.
  • A test plan for REST requests, WebSocket updates, error handling, and timeout behavior.

Using "when-bridging-web-cli-use-web-cli-teleport". Review my web-to-CLI bridge design before implementation.

Expected outcome:

  • A risk summary for command execution, network exposure, and output leakage.
  • Recommended changes that replace free-form shell commands with fixed actions.
  • Deployment notes for local binding, logging, rate limits, and monitoring.

Security Audit

Critical
v10 • 7/9/2026 Open versioned report

The skill documents a useful web-to-CLI bridge pattern, but the sample implementation includes browser-accessible command execution through child_process.exec. Several static findings are Markdown formatting false positives, yet the confirmed execution endpoint, permissive Socket.io bridge, and output broadcast create critical security concerns if copied as written.

4
Files scanned
597
Lines analyzed
29
Review items
0
False positives ignored

Confirmed security concerns (2)

Critical
SKILL.md:245-255README.md:20-22PROCESS.md:21-22
Unauthenticated Web Endpoint Executes Shell Commands
The sample bridge server enables permissive CORS, accepts command and args from an HTTP request, builds a shell command string, and executes it. This design can allow browser-accessible arbitrary command execution if used without authentication, allowlisting, and strict validation.
The server code and quick-start examples directly show command payloads reaching the execution endpoint. The implementation has no authentication or command allowlist in the cited lines.
High
SKILL.md:245-269
Command Output Broadcast to All Socket Clients
The server emits command stdout to all connected Socket.io clients after execution. Command output can contain secrets or filesystem details, so broadcasting it without client isolation can leak sensitive data.
The Socket.io server is configured with a permissive origin and the command handler emits stdout globally. The cited code does not scope output to an authenticated session or room.
Capability review items (29)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Critical
SKILL.md:255
Python exec() function
exec(fullCommand, (error, stdout, stderr) => {
Although the pattern name says Python, the line is a JavaScript child_process exec call. It executes a command string built from request input, which is arbitrary command execution risk.
Critical
SKILL.md:255
Process exec
exec(fullCommand, (error, stdout, stderr) => {
The server calls exec(fullCommand) where fullCommand is built from req.body.command and req.body.args. This is a direct remote command execution pattern.
Critical
SKILL.md:253-297
Ruby/shell backtick execution
const fullCommand = `${command} ${args.join(' ')}`;
This JavaScript template string builds fullCommand from request-controlled command and args values. It is then passed to exec, creating a command injection and arbitrary execution path.
High
process-diagram.gv:22
Process exec
api -> cli [label="exec()", style=dashed, color=red];
The diagram explicitly shows the Bridge API reaching CLI Tools through exec(). It is documentation rather than runnable code, but it confirms process execution is part of the intended architecture.
High
PROCESS.md:17
Node.js child_process module
npm init -y && npm install express socket.io cors child_process
The workflow instructs users to add child_process while creating the CLI bridge server. In context, that server is designed to accept web requests and run CLI commands.
High
SKILL.md:217
Node.js child_process module
npm install express socket.io cors child_process
The setup instructions add child_process for the bridge server implementation. The later example uses this capability to execute commands from web requests.
High
SKILL.md:240
Node.js child_process module
const { exec } = require('child_process');
The bridge server imports child_process directly. This import is used by the API handler that runs commands received through HTTP.
Medium
PROCESS.md:6
Unix shell invocation
#!/bin/bash
PROCESS.md provides a runnable bash workflow that installs dependencies, starts services, and runs Docker commands. This is expected automation, but it executes external commands on the host.
Medium
PROCESS.md:13
Socket.io library
cd web-cli-bridge && npm install axios socket.io-client && npm run build
The workflow installs socket.io-client for real-time bridge communication. This creates a network channel that needs authentication and origin controls.
Medium
PROCESS.md:17
Socket.io library
npm init -y && npm install express socket.io cors child_process
The workflow installs Socket.io on the bridge server. The server-side channel is part of the command bridge and carries command output.
Medium
README.md:16
Socket.io library
npm init -y && npm install express socket.io cors
The quick start installs Socket.io for the bridge server. Real-time network communication is a core part of the skill and requires access controls.
Medium
SKILL.md:318
Shell command substitution
local results=$(npx claude-flow@alpha analyze "$path" --format json)
The bash sample executes npx claude-flow through command substitution and stores its output. The path value is quoted, but the snippet still runs an external command from a function argument.
Medium
SKILL.md:301-327
Template literal with command substitution
```bash
The bash block interpolates component and data values into a curl JSON body for the bridge API. It is not JavaScript template execution, but it is dynamic request construction with caller-controlled values.
Medium
SKILL.md:302
Unix shell invocation
#!/bin/bash
The block defines a runnable bash CLI integration tool. It invokes curl and npx to push CLI output into the web bridge.
Medium
SKILL.md:178
HTTP client library
const response = await axios.post('/api/cli/execute', {
The React component posts command data to /api/cli/execute. This network call is part of the web-triggered command execution flow.
Medium
SKILL.md:135
Socket.io library
npm install axios socket.io-client
The setup installs socket.io-client for real-time communication with the bridge server. This is a real network capability.
Medium
SKILL.md:158
Socket.io library
import io from 'socket.io-client';
The React component imports socket.io-client for a WebSocket connection to the bridge. This channel receives CLI output.
Medium
SKILL.md:217
Socket.io library
npm install express socket.io cors child_process
The bridge server setup installs Socket.io. Server-side WebSocket communication is part of the skill design.
Medium
SKILL.md:239
Socket.io library
const socketIo = require('socket.io');
The bridge server imports socket.io and later emits command output to clients. This is a real network service component.
Low
PROCESS.md:13
HTTP client library
cd web-cli-bridge && npm install axios socket.io-client && npm run build
The workflow installs axios as part of the bridge web app. HTTP calls are an intended capability and should be reviewed with the bridge endpoint security model.
Low
PROCESS.md:21
Hardcoded URL
curl -X POST http://localhost:3001/api/cli/execute \
The localhost URL is used to post directly to the CLI execution endpoint with a command payload. The URL is local, but it demonstrates network-triggered command execution.
Low
README.md:20
Hardcoded URL
curl -X POST http://localhost:3001/api/cli/execute \
The quick start posts to a localhost command execution endpoint. The hardcoded URL is local, but the example still shows command execution over HTTP.
Low
SKILL.md:135
HTTP client library
npm install axios socket.io-client
The web app setup installs axios for HTTP communication with the bridge API. This is intended network behavior.
Low
SKILL.md:157
HTTP client library
import axios from 'axios';
The React component imports axios to call the bridge API. This confirms HTTP client behavior in the sample application.
Low
SKILL.md:166
Hardcoded URL
const newSocket = io('http://localhost:3001');
The React sample connects to a hardcoded localhost Socket.io server. It is local, but it establishes the bridge network endpoint.
Low
SKILL.md:228
Hardcoded URL
curl -X POST http://localhost:3001/api/cli/execute \
The curl example posts to the localhost CLI execution endpoint. The target is local, but the endpoint accepts command payloads over HTTP.
Low
SKILL.md:310
Hardcoded URL
curl -X POST http://localhost:3001/api/web/render \
The bash helper posts CLI-generated UI data to the localhost web-render endpoint. This is intended bridge network behavior.
Low
SKILL.md:338
Hardcoded URL
curl -X POST http://localhost:3001/api/cli/execute \
The test command posts to the localhost CLI execution endpoint with an npx command payload. It demonstrates network-triggered command execution.
Low
SKILL.md:352
Hardcoded URL
npx artillery quick --count 10 -n 20 http://localhost:3001/api/cli/execute
The artillery command load-tests the local CLI execution endpoint. The URL is local, but it targets the risky command bridge API.

Risk Factors

⚡ Contains scripts (2)
process-diagram.gv:22 SKILL.md:255
⚙️ External commands (34)
process-diagram.gv:22 PROCESS.md:17 PROCESS.md:6 SKILL.md:217 SKILL.md:240 SKILL.md:255 SKILL.md:59-103 SKILL.md:103-108 SKILL.md:108-110 SKILL.md:110-113 SKILL.md:113-115 SKILL.md:115-118 SKILL.md:118-120 SKILL.md:120-129 SKILL.md:129-150 SKILL.md:150-154 SKILL.md:154-184 SKILL.md:184-203 SKILL.md:203-212 SKILL.md:212-231 SKILL.md:231-235 SKILL.md:235-253 SKILL.md:253-297 SKILL.md:297-301 SKILL.md:301-327 SKILL.md:327-336 SKILL.md:336-353 SKILL.md:353-357 SKILL.md:357-407 SKILL.md:407-416 SKILL.md:416-452 SKILL.md:318 SKILL.md:301-327 SKILL.md:302
🌐 Network access (24)
PROCESS.md:13 PROCESS.md:13 PROCESS.md:17 PROCESS.md:21 README.md:16 README.md:20 SKILL.md:135 SKILL.md:157 SKILL.md:178 SKILL.md:376 SKILL.md:390 SKILL.md:396 SKILL.md:135 SKILL.md:158 SKILL.md:217 SKILL.md:239 SKILL.md:360 SKILL.md:166 SKILL.md:228 SKILL.md:310 SKILL.md:338 SKILL.md:352 SKILL.md:367 SKILL.md:451
📁 Filesystem access (2)
PROCESS.md:16 SKILL.md:361
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/security.svg)](https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

DNYoussef. (2026). when-bridging-web-cli-use-web-cli-teleport security audit report (audit version 10) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/audits/10

BibTeX citation

@techreport{dnyoussef-dnyoussef-when-bridging-web-cli-use-web-cli-teleport-2026, author = {DNYoussef}, title = {when-bridging-web-cli-use-web-cli-teleport security audit report (audit version 10)}, institution = {Skillstore}, year = {2026}, number = {10}, url = {https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/audits/10}, note = {Author version 1.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "when-bridging-web-cli-use-web-cli-teleport security audit report (audit version 10)" version: "1.0.0" type: report authors: - name: "DNYoussef" date-released: "2026-07-09" url: "https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/audits/10" identifiers: - type: other value: "skillstore:dnyoussef-when-bridging-web-cli-use-web-cli-teleport:audit:10" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
100
Maintainability
87
Content
70
Community
78
Spec Compliance

What You Can Build

Prototype Internal CLI Dashboards

Design a local dashboard that starts approved CLI tasks and streams their progress to a browser.

Connect Web Tools to Local Automation

Plan how a React interface can call local automation through a controlled bridge API.

Plan Bidirectional Developer Tooling

Map how CLI tools can send analysis results back to a live web interface.

Try These Prompts

Create a Local Prototype Plan 
Use this skill to plan a local web-to-CLI bridge for my project. List the web app, bridge server, CLI command flow, and basic test steps.
Add Secure Command Controls 
Use this skill to redesign the bridge so it only runs approved commands. Include authentication, argument validation, timeouts, and audit logging.
Design Live Status Updates 
Use this skill to design WebSocket status updates for CLI jobs. Keep each user session isolated and describe how command output reaches only the requester.
Review Production Readiness 
Use this skill to review a planned web-CLI bridge for production readiness. Identify unsafe assumptions, missing controls, and safer implementation patterns.

Best Practices

  • Require authentication and allowlisted commands before exposing any execution endpoint.
  • Use fixed argument arrays and avoid shell command strings for command runners.
  • Keep bridge services bound to trusted interfaces and log every request.

Avoid

  • Do not expose a free-form command field to browsers or remote users.
  • Do not broadcast command output to every connected client.
  • Do not treat localhost examples as production security controls.

Frequently Asked Questions

What does this skill help me build?
It helps you plan a bridge between a web interface and command-line workflows using REST APIs and WebSockets.
Does it include a complete application?
No. It provides architecture steps and sample snippets that need project-specific implementation.
Can I use the sample server in production?
Not as written. The command execution example needs authentication, allowlists, validation, and output isolation first.
Which tools does it assume?
It assumes Node.js, React, Socket.io, Docker examples, and optional Claude Flow commands.
Why does the audit report security concerns?
The examples show a web endpoint that can run CLI commands. That pattern is powerful but dangerous without strict controls.
Does it work with Claude, Codex, and Claude Code?
The marketplace metadata lists Claude, Codex, and Claude Code as supported tools for using the guidance.

Developer Details

Author

DNYoussef

License

MIT

Author version

v1.0.0

Skillstore revision

r1

Repository

https://github.com/DNYoussef/ai-chrome-extension/tree/main/.claude/skills/workflow/when-bridging-web-cli-use-web-cli-teleport

Ref

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

Maintenance freshness

7/22/2026

Usage

6 downloads · 187 views

File structure

📄 process-diagram.gv

📄 PROCESS.md

📄 README.md

📄 SKILL.md

More from DNYoussef

View all

Related Skills

View all