Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward single-page publishing helper that also discloses version-management actions such as overwriting, unpublishing, and deleting unlocked versions.
Install this if you want an agent to publish and manage single-file HTML pages on htmlcode.fun. Before allowing overwrite, delete-version, status, or current commands, check the exact short code and version, and prefer appending a new version when there is any doubt.
The declared purpose emphasizes easy HTML publishing, but the documented behavior also includes overwriting versions, changing publish status, deleting versions, switching the public current version, and downloading content. This mismatch is dangerous because users or upstream agents may authorize the skill for simple deployment while unknowingly granting broader content-management and destructive capabilities.
The skill exposes a destructive delete endpoint and nearby administrative modification endpoints, creating a tool-parameter abuse risk if an agent is induced to target attacker-chosen codes or versions. Even though the text says deletion is sensitive and should be confirmed, the skill still documents direct access to deletion and state-changing operations without enforceable validation or ownership checks in the skill definition itself.
- `GET /api/deploy/content?code={code}&version={version}` — read metadata and source.
- `GET /api/deploys/{code}/versions` — list version history and `likeCount`.
- `PATCH /api/deploys/{code}/versions/{version}` — overwrite or set status for an unlocked version.
- `DELETE /api/deploys/{code}/versions/{version}` — delete one unlocked version. Treat deletion as sensitive; ask first unless the user explicitly requested it.
- `PATCH /api/deploys/{code}/current` — switch the public current version when needed.
## Response handling
The skill describes and enables file read, file write, and network operations but does not declare any explicit tool scope or permission boundaries. In agent environments, missing scope declarations can lead to overbroad execution where a caller may invoke capabilities beyond the user’s expected action, especially because this skill can publish remote content and manipulate local files via the bundled script.
The skill metadata advertises simple HTML publishing, but the code exposes additional state-changing operations for existing deploys: overwrite, status changes, deletion, version listing, and switching the current public version. In an agent setting, this capability mismatch is dangerous because a caller or orchestrator may authorize the skill for low-risk publishing while unintentionally granting destructive modification powers over already-deployed content.
The manifest describes a deployment utility, but the code also retrieves remote content and can save it locally. This broadens the trust boundary from outbound publishing to inbound content acquisition and local file writing, which may bypass user expectations or policy controls that approved the skill only for publishing.
The get command writes fetched remote content to a local path via --output, but this code path has no confirmation prompt, explicit warning print, or inline comment/docstring disclosing that it will overwrite/create a local file. For a code-file SQP-2 check, this is a file-write operation lacking any visible disclosure in the implementation itself.