技能 when-bridging-web-cli-use-web-cli-teleport
📦

when-bridging-web-cli-use-web-cli-teleport

v1.0.0 內容修訂 r1 嚴重 ⚡ 包含腳本⚙️ 外部命令🌐 網路存取📁 檔案系統存取

建置 Web-CLI 橋接工作流程

團隊經常需要透過 web UI 來觸發和觀察 CLI 工作流程。此技能提供一種橋接模式，使用 REST endpoints、WebSockets 和本機 CLI 整合。

支援: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求
Review the Skillstore skill "when-bridging-web-cli-use-web-cli-teleport" from https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport.md 已簽名 manifest GET /api/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/manifest 已簽名 lockfile GET /api/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/lockfile

測試它

正在使用「when-bridging-web-cli-use-web-cli-teleport」。 規劃一個可執行已核准本機測試命令的瀏覽器介面。

預期結果:

  • 分階段的橋接架構，包含 React 控制介面、本機 API，以及受限制的命令執行器。
  • 涵蓋驗證、命令 allowlists、引數驗證和輸出範圍控管的安全性檢查清單。
  • REST 請求、WebSocket 更新、錯誤處理和逾時行為的測試計畫。

正在使用「when-bridging-web-cli-use-web-cli-teleport」。 在實作前審查我的 web-to-CLI 橋接設計。

預期結果:

  • 針對命令執行、網路暴露和輸出外洩的風險摘要。
  • 建議將自由格式 shell 命令替換為固定動作的變更。
  • 針對本機繫結、記錄、速率限制和監控的部署注意事項。

安全審計

嚴重
v10 • 2026/7/9 開啟版本化報告

The skill documents a useful web-to-CLI bridge pattern, but the sample implementation includes browser-accessible command execution through child_process.exec. Several static findings are Markdown formatting false positives, yet the confirmed execution endpoint, permissive Socket.io bridge, and output broadcast create critical security concerns if copied as written.

4
已掃描檔案
597
分析行數
29
複核項目
0
已忽略的誤報

已確認的安全問題 (2)

嚴重
SKILL.md:245-255README.md:20-22PROCESS.md:21-22
Unauthenticated Web Endpoint Executes Shell Commands
The sample bridge server enables permissive CORS, accepts command and args from an HTTP request, builds a shell command string, and executes it. This design can allow browser-accessible arbitrary command execution if used without authentication, allowlisting, and strict validation.
The server code and quick-start examples directly show command payloads reaching the execution endpoint. The implementation has no authentication or command allowlist in the cited lines.
高
SKILL.md:245-269
Command Output Broadcast to All Socket Clients
The server emits command stdout to all connected Socket.io clients after execution. Command output can contain secrets or filesystem details, so broadcasting it without client isolation can leak sensitive data.
The Socket.io server is configured with a permissive origin and the command handler emits stdout globally. The cited code does not scope output to an authenticated session or room.
能力複核項目 (29)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

嚴重
SKILL.md:255
Python exec() function
exec(fullCommand, (error, stdout, stderr) => {
Although the pattern name says Python, the line is a JavaScript child_process exec call. It executes a command string built from request input, which is arbitrary command execution risk.
嚴重
SKILL.md:255
Process exec
exec(fullCommand, (error, stdout, stderr) => {
The server calls exec(fullCommand) where fullCommand is built from req.body.command and req.body.args. This is a direct remote command execution pattern.
嚴重
SKILL.md:253-297
Ruby/shell backtick execution
const fullCommand = `${command} ${args.join(' ')}`;
This JavaScript template string builds fullCommand from request-controlled command and args values. It is then passed to exec, creating a command injection and arbitrary execution path.
高
process-diagram.gv:22
Process exec
api -> cli [label="exec()", style=dashed, color=red];
The diagram explicitly shows the Bridge API reaching CLI Tools through exec(). It is documentation rather than runnable code, but it confirms process execution is part of the intended architecture.
高
PROCESS.md:17
Node.js child_process module
npm init -y && npm install express socket.io cors child_process
The workflow instructs users to add child_process while creating the CLI bridge server. In context, that server is designed to accept web requests and run CLI commands.
高
SKILL.md:217
Node.js child_process module
npm install express socket.io cors child_process
The setup instructions add child_process for the bridge server implementation. The later example uses this capability to execute commands from web requests.
高
SKILL.md:240
Node.js child_process module
const { exec } = require('child_process');
The bridge server imports child_process directly. This import is used by the API handler that runs commands received through HTTP.
中
PROCESS.md:6
Unix shell invocation
#!/bin/bash
PROCESS.md provides a runnable bash workflow that installs dependencies, starts services, and runs Docker commands. This is expected automation, but it executes external commands on the host.
中
PROCESS.md:13
Socket.io library
cd web-cli-bridge && npm install axios socket.io-client && npm run build
The workflow installs socket.io-client for real-time bridge communication. This creates a network channel that needs authentication and origin controls.
中
PROCESS.md:17
Socket.io library
npm init -y && npm install express socket.io cors child_process
The workflow installs Socket.io on the bridge server. The server-side channel is part of the command bridge and carries command output.
中
README.md:16
Socket.io library
npm init -y && npm install express socket.io cors
The quick start installs Socket.io for the bridge server. Real-time network communication is a core part of the skill and requires access controls.
中
SKILL.md:318
Shell command substitution
local results=$(npx claude-flow@alpha analyze "$path" --format json)
The bash sample executes npx claude-flow through command substitution and stores its output. The path value is quoted, but the snippet still runs an external command from a function argument.
中
SKILL.md:301-327
Template literal with command substitution
```bash
The bash block interpolates component and data values into a curl JSON body for the bridge API. It is not JavaScript template execution, but it is dynamic request construction with caller-controlled values.
中
SKILL.md:302
Unix shell invocation
#!/bin/bash
The block defines a runnable bash CLI integration tool. It invokes curl and npx to push CLI output into the web bridge.
中
SKILL.md:178
HTTP client library
const response = await axios.post('/api/cli/execute', {
The React component posts command data to /api/cli/execute. This network call is part of the web-triggered command execution flow.
中
SKILL.md:135
Socket.io library
npm install axios socket.io-client
The setup installs socket.io-client for real-time communication with the bridge server. This is a real network capability.
中
SKILL.md:158
Socket.io library
import io from 'socket.io-client';
The React component imports socket.io-client for a WebSocket connection to the bridge. This channel receives CLI output.
中
SKILL.md:217
Socket.io library
npm install express socket.io cors child_process
The bridge server setup installs Socket.io. Server-side WebSocket communication is part of the skill design.
中
SKILL.md:239
Socket.io library
const socketIo = require('socket.io');
The bridge server imports socket.io and later emits command output to clients. This is a real network service component.
低
PROCESS.md:13
HTTP client library
cd web-cli-bridge && npm install axios socket.io-client && npm run build
The workflow installs axios as part of the bridge web app. HTTP calls are an intended capability and should be reviewed with the bridge endpoint security model.
低
PROCESS.md:21
Hardcoded URL
curl -X POST http://localhost:3001/api/cli/execute \
The localhost URL is used to post directly to the CLI execution endpoint with a command payload. The URL is local, but it demonstrates network-triggered command execution.
低
README.md:20
Hardcoded URL
curl -X POST http://localhost:3001/api/cli/execute \
The quick start posts to a localhost command execution endpoint. The hardcoded URL is local, but the example still shows command execution over HTTP.
低
SKILL.md:135
HTTP client library
npm install axios socket.io-client
The web app setup installs axios for HTTP communication with the bridge API. This is intended network behavior.
低
SKILL.md:157
HTTP client library
import axios from 'axios';
The React component imports axios to call the bridge API. This confirms HTTP client behavior in the sample application.
低
SKILL.md:166
Hardcoded URL
const newSocket = io('http://localhost:3001');
The React sample connects to a hardcoded localhost Socket.io server. It is local, but it establishes the bridge network endpoint.
低
SKILL.md:228
Hardcoded URL
curl -X POST http://localhost:3001/api/cli/execute \
The curl example posts to the localhost CLI execution endpoint. The target is local, but the endpoint accepts command payloads over HTTP.
低
SKILL.md:310
Hardcoded URL
curl -X POST http://localhost:3001/api/web/render \
The bash helper posts CLI-generated UI data to the localhost web-render endpoint. This is intended bridge network behavior.
低
SKILL.md:338
Hardcoded URL
curl -X POST http://localhost:3001/api/cli/execute \
The test command posts to the localhost CLI execution endpoint with an npx command payload. It demonstrates network-triggered command execution.
低
SKILL.md:352
Hardcoded URL
npx artillery quick --count 10 -n 20 http://localhost:3001/api/cli/execute
The artillery command load-tests the local CLI execution endpoint. The URL is local, but it targets the risky command bridge API.

風險因素

⚡ 包含腳本 (2)
process-diagram.gv:22 SKILL.md:255
⚙️ 外部命令 (34)
process-diagram.gv:22 PROCESS.md:17 PROCESS.md:6 SKILL.md:217 SKILL.md:240 SKILL.md:255 SKILL.md:59-103 SKILL.md:103-108 SKILL.md:108-110 SKILL.md:110-113 SKILL.md:113-115 SKILL.md:115-118 SKILL.md:118-120 SKILL.md:120-129 SKILL.md:129-150 SKILL.md:150-154 SKILL.md:154-184 SKILL.md:184-203 SKILL.md:203-212 SKILL.md:212-231 SKILL.md:231-235 SKILL.md:235-253 SKILL.md:253-297 SKILL.md:297-301 SKILL.md:301-327 SKILL.md:327-336 SKILL.md:336-353 SKILL.md:353-357 SKILL.md:357-407 SKILL.md:407-416 SKILL.md:416-452 SKILL.md:318 SKILL.md:301-327 SKILL.md:302
🌐 網路存取 (24)
PROCESS.md:13 PROCESS.md:13 PROCESS.md:17 PROCESS.md:21 README.md:16 README.md:20 SKILL.md:135 SKILL.md:157 SKILL.md:178 SKILL.md:376 SKILL.md:390 SKILL.md:396 SKILL.md:135 SKILL.md:158 SKILL.md:217 SKILL.md:239 SKILL.md:360 SKILL.md:166 SKILL.md:228 SKILL.md:310 SKILL.md:338 SKILL.md:352 SKILL.md:367 SKILL.md:451
📁 檔案系統存取 (2)
PROCESS.md:16 SKILL.md:361
審計單位: codex 檢視審計紀錄 →
分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告
安全評估

複製報告連結

https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/security.svg)](https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
學術引用 (APA · BibTeX · CFF)

APA 引用

DNYoussef. (2026). when-bridging-web-cli-use-web-cli-teleport security audit report (audit version 10) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/audits/10

BibTeX 引用

@techreport{dnyoussef-dnyoussef-when-bridging-web-cli-use-web-cli-teleport-2026, author = {DNYoussef}, title = {when-bridging-web-cli-use-web-cli-teleport security audit report (audit version 10)}, institution = {Skillstore}, year = {2026}, number = {10}, url = {https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/audits/10}, note = {Author version 1.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "when-bridging-web-cli-use-web-cli-teleport security audit report (audit version 10)" version: "1.0.0" type: report authors: - name: "DNYoussef" date-released: "2026-07-09" url: "https://skillstore.io/skills/dnyoussef-when-bridging-web-cli-use-web-cli-teleport/audits/10" identifiers: - type: other value: "skillstore:dnyoussef-when-bridging-web-cli-use-web-cli-teleport:audit:10" description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據 證據置信度: 中
55
架構
100
可維護性
87
內容
70
社群
78
規範符合度

你可以打造什麼

建立內部 CLI 儀表板原型

設計本機儀表板，用於啟動已核准的 CLI 任務，並將其進度串流到瀏覽器。

將 Web 工具連接至本機自動化

規劃 React 介面如何透過受控的橋接 API 呼叫本機自動化。

規劃雙向開發者工具

規劃 CLI 工具如何將分析結果傳回即時 web 介面。

試試這些提示

建立本機原型計畫 
使用此技能為我的專案規劃本機 web-to-CLI 橋接。列出 web app、橋接伺服器、CLI 命令流程和基本測試步驟。
新增安全命令控制 
使用此技能重新設計橋接，使其只執行已核准的命令。包含驗證、引數驗證、逾時和稽核記錄。
設計即時狀態更新 
使用此技能為 CLI jobs 設計 WebSocket 狀態更新。讓每個使用者工作階段彼此隔離，並描述命令輸出如何只傳達給請求者。
審查正式環境就緒度 
使用此技能審查規劃中的 web-CLI bridge 是否已準備好用於正式環境。找出不安全的假設、缺少的控制措施，以及更安全的實作模式。

最佳實務

  • 在暴露任何執行 endpoint 之前，要求驗證並使用 allowlisted commands。
  • 命令執行器應使用固定的引數陣列，並避免 shell 命令字串。
  • 讓橋接服務僅繫結至受信任的介面，並記錄每個請求。

避免

  • 不要向瀏覽器或遠端使用者暴露自由格式命令欄位。
  • 不要將命令輸出廣播給每個已連線的 client。
  • 不要將 localhost 範例視為正式環境安全性控制措施。

常見問題

此技能能協助我建置什麼？
它協助你使用 REST APIs 和 WebSockets，規劃 web 介面與命令列工作流程之間的橋接。
它是否包含完整應用程式？
不能。它提供架構步驟和範例片段，需要依專案進行特定實作。
我可以在正式環境使用範例伺服器嗎？
不能直接使用。命令執行範例必須先加入驗證、allowlists、驗證規則和輸出隔離。
它假設使用哪些工具？
它假設會使用 Node.js、React、Socket.io、Docker 範例，以及選用的 Claude Flow 命令。
為什麼稽核報告會提出安全性疑慮？
範例展示了一個可以執行 CLI 命令的 web endpoint。這種模式很強大，但若沒有嚴格控制會很危險。
它是否適用於 Claude、Codex 和 Claude Code？
marketplace metadata 將 Claude、Codex 和 Claude Code 列為可用於使用此指引的支援工具。

開發者詳細資訊

作者

DNYoussef

授權

MIT

作者版本

v1.0.0

Skillstore 修訂

r1

儲存庫

https://github.com/DNYoussef/ai-chrome-extension/tree/main/.claude/skills/workflow/when-bridging-web-cli-use-web-cli-teleport

引用

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

維護新鮮度

2026/7/29

使用量

8 次下載 · 187 次瀏覽

檔案結構

📄 process-diagram.gv

📄 PROCESS.md

📄 README.md

📄 SKILL.md

DNYoussef 的更多技能

查看全部

相關技能

查看全部