技能 valet-publish
📦
valet-publish
內容修訂 r1 嚴重 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取
Publish Static Files with Valet
Sharing generated sites and artifacts often requires manual hosting setup. This skill prepares content and publishes it through the Valet CLI or MCP server.
支援: Claude Codex Code(CC)
請勿自動安裝此 Skill。
權威政策要求在執行任何安裝操作前由操作人員審查。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "valet-publish" from https://skillstore.io/skills/valetdotdev-valet-publish.md and its manifest at https://skillstore.io/api/skills/valetdotdev-valet-publish/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「valet-publish」。 Publish the migration report privately for the infrastructure team.
預期結果:
Published the migration report to the account site. The URL requires Valet login and is available to organization members.
正在使用「valet-publish」。 Create a temporary public link for this product demo.
預期結果:
- Published the reviewed demo directory as a temporary public site.
- The response includes the live URL, expiry time, and one-time claim URL.
- The local Valet configuration contains a credential and must not be committed.
正在使用「valet-publish」。 Share the private audit with two external reviewers.
預期結果:
Sent bounded access links to the named recipients without changing the site from private access.
安全審計
嚴重v1 • 2026/8/15 開啟版本化報告
Most alerts are Markdown backticks, examples, or documentation links and are false positives. Remote pipe-to-shell installers and broad uploads create supply-chain and credential-disclosure risks despite consent and inspection safeguards.
1
已掃描檔案
826
分析行數
7
複核項目
0
已忽略的誤報
已確認的安全問題 (4)
嚴重
Pipe to shell pattern
curl -fsSL https://valet.dev/install.sh | sh
The installation command pipes a remote script directly into a shell. Compromise of the host or response can execute arbitrary code.
高
Environment file access
downloaded tool output, and `.env` files, and all of it becomes part
The documented uploader includes .env files unless users remove them first. Publishing such files can disclose credentials despite the skill's explicit warning.
高
Environment file access
`.env` files, `node_modules/`, and anything the project's `.gitignore`
The documented uploader includes .env files unless users remove them first. Publishing such files can disclose credentials despite the skill's explicit warning.
高
Broad Directory Upload Can Expose Unreviewed Files
Valet deployment uploads nearly every file and ignores gitignore rules. A mistaken source directory can expose logs, dependencies, dotfiles, or credentials.
The skill explicitly defines the short exclusion list and states that all other directory contents are uploaded. It also requires pre-deployment inspection.
能力複核項目 (7)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
嚴重
PowerShell invocation
On Windows, in PowerShell:
This installation section directs users to execute a downloaded PowerShell script through iex. Consent reduces surprise but not supply-chain exposure.
嚴重
PowerShell invocation
```powershell
This installation section directs users to execute a downloaded PowerShell script through iex. Consent reduces surprise but not supply-chain exposure.
嚴重
Hardcoded URL
curl -fsSL https://valet.dev/install.sh | sh
This URL supplies an installer that is immediately piped into a shell. A compromised response can execute arbitrary code.
嚴重
Hardcoded URL
irm https://valet.dev/install.ps1 | iex
This URL supplies a PowerShell installer that is immediately passed to iex. A compromised response can execute arbitrary code.
低
Hardcoded URL
at `https://api.valet.dev/mcp`. Prefer the CLI; see
This is the fixed Valet MCP endpoint used for remote publishing operations. The network dependency is intentional but real.
低
Hardcoded URL
its MCP server at `https://api.valet.dev/mcp`. It is reached over the network
This is the fixed Valet MCP endpoint used for remote publishing operations. The network dependency is intentional but real.
低
Hardcoded URL
> add `https://api.valet.dev/mcp` as a connector in this tool's
This is the fixed Valet MCP endpoint used for remote publishing operations. The network dependency is intentional but real.
風險因素
⚙️ 外部命令 (50)
SKILL.md:13 SKILL.md:20 SKILL.md:22 SKILL.md:27-29 SKILL.md:29-31 SKILL.md:31-34 SKILL.md:34-36 SKILL.md:36-57 SKILL.md:57-61 SKILL.md:61-62 SKILL.md:62-70 SKILL.md:70-74 SKILL.md:74-86 SKILL.md:86-98 SKILL.md:98 SKILL.md:99-107 SKILL.md:107-109 SKILL.md:109-120 SKILL.md:120-122 SKILL.md:122-126 SKILL.md:126-128 SKILL.md:128-130 SKILL.md:130-131 SKILL.md:131-134 SKILL.md:134-135 SKILL.md:135-137 SKILL.md:137-140 SKILL.md:140-142 SKILL.md:142-150 SKILL.md:150-155 SKILL.md:155-156 SKILL.md:156 SKILL.md:158-160 SKILL.md:160-166 SKILL.md:166-170 SKILL.md:170-177 SKILL.md:177-179 SKILL.md:179-181 SKILL.md:181-182 SKILL.md:182-183 SKILL.md:183-186 SKILL.md:186-195 SKILL.md:195-208 SKILL.md:208 SKILL.md:209 SKILL.md:210-219 SKILL.md:219-225 SKILL.md:225-226 SKILL.md:226-232 SKILL.md:232-239
🌐 網路存取 (9)
📁 檔案系統存取 (1)
偵測到的模式
Pipe to shell pattern
審計單位: codex
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/valetdotdev-valet-publish/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/valetdotdev-valet-publish?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/valetdotdev-valet-publish?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/valetdotdev-valet-publish/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/valetdotdev-valet-publish.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
valetdotdev. (2026). valet-publish security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/valetdotdev-valet-publish/audits/1BibTeX 引用
@techreport{valetdotdev-valetdotdev-valet-publish-2026,
author = {valetdotdev},
title = {valet-publish security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/valetdotdev-valet-publish/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "valet-publish security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "valetdotdev"
date-released: "2026-08-15"
url: "https://skillstore.io/skills/valetdotdev-valet-publish/audits/1"
identifiers:
- type: other
value: "skillstore:valetdotdev-valet-publish:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 低 55
架構
85
可維護性
87
內容
65
社群
74
規範符合度
你可以打造什麼
Deploy a development preview
Publish a prepared build directory as a private review site or an approved public preview.
Share a rendered report
Turn an analysis, dashboard, or status document into a controlled live URL.
Distribute static assets
Host PDFs, images, and design deliverables with clear titles, access settings, and recipient sharing.
試試這些提示
Publish a prepared folder
Review the contents of [folder], explain the visibility choices, and publish it with Valet after I approve the destination.
Create a temporary public preview
Prepare [file or folder] in a clean directory, check for sensitive files, and publish an anonymous preview after confirming public access.
Publish a private report
Build a complete HTML report from [source], follow the organization design system, and publish it privately to [organization].
Update and share an existing site
Download or locate [site], review changes and upload scope, update it, then share with [recipients] using bounded access links.
最佳實務
- Publish from a clean directory containing only intended public or organization-visible files.
- Confirm visibility, access changes, installations, and destructive actions before executing them.
- Protect claim tokens, report accurate expiry details, and use bounded recipient links when possible.
避免
- Do not publish a working directory without reviewing every included file.
- Do not make a site public merely to avoid authentication or connector setup.
- Do not print, commit, or place passwords and site tokens in agent commands.
常見問題
Does this skill require a Valet account?
No. Anonymous publishing works without an account, but creates a public site that expires after 36 hours.
Are account sites public by default?
No. New account sites are private and available to members of the owning organization.
Can the MCP server publish PDFs or images?
No. MCP publishing carries text files only. Binary files require the Valet CLI.
Which files does CLI deployment exclude?
It excludes Git directories, Valet directories, the root Valet manifest, and symbolic links. Other files can be uploaded.
Can an anonymous site be updated later?
Yes, from its original linked directory while its site credential remains valid and the site has not expired.
How should sensitive access credentials be handled?
Keep passwords out of agent commands and transcripts. Never print or commit Valet configuration files or anonymous site tokens.
開發者詳細資訊
作者
valetdotdev授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
60855416b9ec7b18f5e06fa97cdadcfda015db7a
維護新鮮度
2026/8/15
使用量
0 次下載 · 0 次瀏覽
檔案結構
📄 SKILL.md