Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
HTML Instant Deploy (htmlcode.fun)
v1.1.0Deploy HTML content or files to the web via htmlcode.fun. Use when the user asks to "deploy to web", "host this html", "generate a live link for this fronten...
⭐ 2· 55·0 current·0 all-time
byXiao Mu@520xiaomumu
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The stated purpose (instantly deploy single-file HTML to htmlcode.fun) is reasonable and aligns with the curl-based API call in the docs. However, the SKILL.md repeatedly refers to a 'bundled PowerShell script' at ./scripts/deploy.ps1 which is not included in the package (there are no code files). That missing artifact is an incoherence: either the script should be bundled or the instructions should not reference it.
Instruction Scope
Instructions ask the agent to extract HTML content and POST it to https://www.htmlcode.fun/api/deploy (expected for this purpose). But they also tell the agent to run a local PowerShell script that does not exist. The instructions direct sending arbitrary user-supplied content to an external public service — reasonable for a deploy tool but a privacy/security consideration if the HTML contains secrets or proprietary data.
Install Mechanism
This is an instruction-only skill with no install spec (low installation risk). However, the SKILL.md references a 'bundled' script that isn't present; this packaging inconsistency should be resolved by the publisher.
Credentials
No environment variables, credentials, or config paths are requested (proportionate). That said, because deployments go to a public third-party endpoint with no authentication in the docs, any sensitive content in the HTML would be publicly exposed — the skill should explicitly warn about this.
Persistence & Privilege
The skill does not request persistent presence (always:false) and does not request elevated privileges or modify other configs. Autonomous invocation is allowed (platform default) but not by itself a problem.
What to consider before installing
This skill appears to do what it says (POST a single HTML file to htmlcode.fun), but the runtime instructions reference a local PowerShell script (./scripts/deploy.ps1) that is not included — ask the publisher to provide the script or update the instructions to a direct curl-based flow. Before using: (1) verify the htmlcode.fun endpoint and privacy policy; deployments produce public URLs so do not include secrets or proprietary data in the HTML; (2) confirm which binaries will be used (pwsh/curl) and that your environment is comfortable running them; (3) prefer the explicit curl approach described in SKILL.md rather than running unknown scripts; and (4) if you need private hosting, use a different skill or service that requires authentication. If the publisher cannot explain the missing script, treat the skill as incomplete and avoid invoking it.Like a lobster shell, security has layers — review code before you run it.
latestvk9767ynwm50n4ssayxd3ywyp4n83tmfa
License
MIT-0
Free to use, modify, and redistribute. No attribution required.