Skills port-allocator
📦
port-allocator
Content revision r2 High Risk ⚙️ External commands📁 Filesystem access
Allocate Development Ports Without Conflicts
Concurrent development projects often compete for the same local ports. This skill assigns predictable port ranges and records them in a shared registry.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "port-allocator" from https://skillstore.io/skills/guo-yu-port-allocator.md and its manifest at https://skillstore.io/api/skills/guo-yu-port-allocator/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "port-allocator". Allocate ports for the current package-based project.
Expected outcome:
Project detected: landing. Assigned range: 3000 through 3009. Main application: 3000. API: 3001. Other services: 3002 through 3009.
Using "port-allocator". List all registered project ranges.
Expected outcome:
- landing: 3000 through 3009
- admin-console: 3010 through 3019
- No overlapping ranges detected.
Using "port-allocator". Scan my configured code directory.
Expected outcome:
Scan completed. Two registered projects were unchanged. One new project was found and proposed for ports 3020 through 3029.
Security Audit
High Riskv5 • 8/5/2026 Open versioned report
Most static alerts are false positives caused by Markdown backticks, translated text, path references, and /dev/null. Confirmed risks include forceful process termination, persistent global instruction edits, and broad unattended access to ~/.claude files. The documented registry update also lacks concurrency control.
5
Files scanned
722
Lines analyzed
18
Review items
0
False positives ignored
Confirmed security concerns (2)
High
Overbroad unattended shell permissions
The allow workflow edits Claude Code settings to permit wildcard find, lsof, and cat commands without repeated confirmation. The cat pattern covers every direct child of ~/.claude, which exceeds port allocation needs.
The permission list and instruction to merge it into permissions.allow are explicit. The broad ~/.claude wildcard is directly visible in the documented configuration.
Medium
Non-atomic port allocation across concurrent sessions
The workflow checks the registry, chooses the next range, and then updates the file without a locking or atomic recheck step. Concurrent sessions can assign the same ports and later terminate each other's processes.
The documented read-check-allocate-write sequence is explicit, while no synchronization step is specified. This matters because the skill claims to coordinate multiple Claude Code instances.
Capability review items (18)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Hidden file in home directory
`~/.claude/CLAUDE.md` を更新する際は、**ユーザーの既存コンテンツを保持する必要があります**:
The instructions direct the agent to modify the user's global ~/.claude/CLAUDE.md. Persistent global instruction changes can affect unrelated future sessions and projects.
High
Hidden file in home directory
"Bash(cat ~/.claude/*)",
The permission entry authorizes cat across ~/.claude/*, exceeding the files required for port allocation. This broad read can expose unrelated configuration or secret-bearing files without confirmation.
High
Hidden file access
`~/.claude/CLAUDE.md` を更新する際は、**ユーザーの既存コンテンツを保持する必要があります**:
The instructions direct the agent to modify the user's global ~/.claude/CLAUDE.md. Persistent global instruction changes can affect unrelated future sessions and projects.
High
Hidden file access
"Bash(cat ~/.claude/*)",
The permission entry authorizes cat across ~/.claude/*, exceeding the files required for port allocation. This broad read can expose unrelated configuration or secret-bearing files without confirmation.
High
Hidden file in home directory
When updating `~/.claude/CLAUDE.md`, **must preserve the user's existing content**:
The instructions direct the agent to modify the user's global ~/.claude/CLAUDE.md. Persistent global instruction changes can affect unrelated future sessions and projects.
High
Hidden file in home directory
"Bash(cat ~/.claude/*)",
The permission entry authorizes cat across ~/.claude/*, exceeding the files required for port allocation. This broad read can expose unrelated configuration or secret-bearing files without confirmation.
High
Hidden file access
When updating `~/.claude/CLAUDE.md`, **must preserve the user's existing content**:
The instructions direct the agent to modify the user's global ~/.claude/CLAUDE.md. Persistent global instruction changes can affect unrelated future sessions and projects.
High
Hidden file access
"Bash(cat ~/.claude/*)",
The permission entry authorizes cat across ~/.claude/*, exceeding the files required for port allocation. This broad read can expose unrelated configuration or secret-bearing files without confirmation.
High
Hidden file in home directory
更新 `~/.claude/CLAUDE.md` 时,**必须保留用户原有内容**:
The instructions direct the agent to modify the user's global ~/.claude/CLAUDE.md. Persistent global instruction changes can affect unrelated future sessions and projects.
High
Hidden file in home directory
"Bash(cat ~/.claude/*)",
The permission entry authorizes cat across ~/.claude/*, exceeding the files required for port allocation. This broad read can expose unrelated configuration or secret-bearing files without confirmation.
High
Hidden file access
更新 `~/.claude/CLAUDE.md` 时,**必须保留用户原有内容**:
The instructions direct the agent to modify the user's global ~/.claude/CLAUDE.md. Persistent global instruction changes can affect unrelated future sessions and projects.
High
Hidden file access
"Bash(cat ~/.claude/*)",
The permission entry authorizes cat across ~/.claude/*, exceeding the files required for port allocation. This broad read can expose unrelated configuration or secret-bearing files without confirmation.
Medium
xargs command (can execute arbitrary commands)
lsof -ti:3000 | xargs kill -9 2>/dev/null
The documented command sends PIDs from lsof for a fixed port to kill -9. It can forcibly terminate an unrelated process that happens to occupy the port.
Medium
xargs command (can execute arbitrary commands)
lsof -ti:3001 | xargs kill -9 2>/dev/null
The documented command sends PIDs from lsof for a fixed port to kill -9. It can forcibly terminate an unrelated process that happens to occupy the port.
Medium
xargs command (can execute arbitrary commands)
lsof -ti:3000 | xargs kill -9 2>/dev/null
The documented command sends PIDs from lsof for a fixed port to kill -9. It can forcibly terminate an unrelated process that happens to occupy the port.
Medium
xargs command (can execute arbitrary commands)
lsof -ti:3001 | xargs kill -9 2>/dev/null
The documented command sends PIDs from lsof for a fixed port to kill -9. It can forcibly terminate an unrelated process that happens to occupy the port.
Medium
xargs command (can execute arbitrary commands)
lsof -ti:3000 | xargs kill -9 2>/dev/null
The documented command sends PIDs from lsof for a fixed port to kill -9. It can forcibly terminate an unrelated process that happens to occupy the port.
Medium
xargs command (can execute arbitrary commands)
lsof -ti:3001 | xargs kill -9 2>/dev/null
The documented command sends PIDs from lsof for a fixed port to kill -9. It can forcibly terminate an unrelated process that happens to occupy the port.
Risk Factors
⚙️ External commands (50)
SKILL.ja.md:29 SKILL.ja.md:30 SKILL.ja.md:34 SKILL.md:8 SKILL.md:14 SKILL.md:15 SKILL.md:16 SKILL.md:17 SKILL.md:18 SKILL.md:19 SKILL.md:27-35 SKILL.md:35-39 SKILL.md:39-41 SKILL.md:41-44 SKILL.md:44-48 SKILL.md:48-52 SKILL.md:52-53 SKILL.md:53-55 SKILL.md:55-68 SKILL.md:68-74 SKILL.md:74-85 SKILL.md:85-87 SKILL.md:87-92 SKILL.md:92 SKILL.md:97 SKILL.md:99-110 SKILL.md:110-113 SKILL.md:113-122 SKILL.md:122-125 SKILL.md:125-133 SKILL.md:133-135 SKILL.md:135-139 SKILL.md:139 SKILL.md:141-142 SKILL.md:142-144 SKILL.md:144-153 SKILL.md:153-155 SKILL.md:155-156 SKILL.md:156-157 SKILL.md:157-165 SKILL.md:165-170 SKILL.md:170-172 SKILL.md:172-176 SKILL.md:176-183 SKILL.md:183-192 SKILL.md:192-195 SKILL.md:195-208 SKILL.md:208-215 SKILL.md:215-216 SKILL.md:216-217
📁 Filesystem access (50)
SKILL.ja.md:39 SKILL.ja.md:52 SKILL.ja.md:61 SKILL.ja.md:80 SKILL.ja.md:84 SKILL.ja.md:92 SKILL.ja.md:97 SKILL.ja.md:118 SKILL.ja.md:139 SKILL.ja.md:221 SKILL.ja.md:222 SKILL.ja.md:223 SKILL.ja.md:39 SKILL.ja.md:52 SKILL.ja.md:61 SKILL.ja.md:80 SKILL.ja.md:84 SKILL.ja.md:92 SKILL.ja.md:97 SKILL.ja.md:118 SKILL.ja.md:139 SKILL.ja.md:147 SKILL.ja.md:221 SKILL.ja.md:222 SKILL.ja.md:223 SKILL.ja.md:29 SKILL.ja.md:30 SKILL.md:39 SKILL.md:52 SKILL.md:61 SKILL.md:80 SKILL.md:84 SKILL.md:92 SKILL.md:97 SKILL.md:118 SKILL.md:139 SKILL.md:221 SKILL.md:222 SKILL.md:223 SKILL.md:39 SKILL.md:52 SKILL.md:61 SKILL.md:80 SKILL.md:84 SKILL.md:92 SKILL.md:97 SKILL.md:118 SKILL.md:139 SKILL.md:147 SKILL.md:221
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/guo-yu-port-allocator/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/guo-yu-port-allocator?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/guo-yu-port-allocator?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/guo-yu-port-allocator/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/guo-yu-port-allocator.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
guo-yu. (2026). port-allocator security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/guo-yu-port-allocator/audits/5BibTeX citation
@techreport{guo-yu-guo-yu-port-allocator-2026,
author = {guo-yu},
title = {port-allocator security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/guo-yu-port-allocator/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "port-allocator security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "guo-yu"
date-released: "2026-08-05"
url: "https://skillstore.io/skills/guo-yu-port-allocator/audits/5"
identifiers:
- type: other
value: "skillstore:guo-yu-port-allocator:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
91
Spec Compliance
What You Can Build
Start a local application
Reserve a predictable port range before launching a frontend and its supporting services.
Coordinate several repositories
Scan a shared code directory and record distinct ranges for each package-based project.
Standardize team port assignments
Review current allocations and add missing projects using a consistent ten-port convention.
Try These Prompts
Allocate my current project
Check whether the current directory contains package.json. Allocate or report its port range without changing global permissions.
Review existing allocations
List every registered project and port range. Highlight duplicate or overlapping assignments, but do not modify the registry.
Discover projects under a code root
Scan [CODE_ROOT] to depth three for package.json files. Exclude build artifacts and propose ranges for unregistered projects before writing changes.
Audit and repair port coordination
Review the registry for overlaps, stale paths, and active listener conflicts. Propose an atomic repair plan and require confirmation before terminating processes.
Best Practices
- Review proposed assignments before updating the shared registry.
- Confirm process ownership before terminating any listener on an assigned port.
- Keep permission grants limited to the registry and selected project root.
Avoid
- Do not terminate every Node process when one development server conflicts.
- Do not grant wildcard read access across the entire Claude configuration directory.
- Do not overwrite global instructions or registry data without preserving existing content.
Frequently Asked Questions
Which projects receive ports?
Only directories containing package.json qualify for automatic allocation.
How many ports does each project receive?
Each project receives ten consecutive ports, beginning at a multiple of ten from 3000.
Can I choose the code directory?
Yes. Configure an existing directory as the code root before scanning.
Does scanning modify every project?
No. It discovers package-based projects and updates the central allocation registry.
Can it safely stop conflicting services?
Process termination needs confirmation and ownership checks. A port assignment alone does not prove that a listener belongs to the current project.
Does it support concurrent allocation?
The documented workflow does not specify registry locking. Concurrent sessions should serialize updates until locking is added.
Developer Details
Author
guo-yuLicense
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
286d37c9c189ddd1aafd3548415fb031d1df79d5
Maintenance freshness
8/6/2026
Usage
5 downloads · 149 views
File structure