Skill

Publish HTML to a public URL instantly. Zero config, auto-registers on first use. Use when the user wants to share, preview, host, or deploy generated HTML,...

Security Scan

The skill is coherent with its stated purpose (publishing HTML via a third-party API) but includes small mismatches and a privacy/persistence behavior you should be aware of.

Purpose & Capability

The SKILL.md describes publishing HTML via https://shippage.ai and the only declared runtime dependency is curl, which is consistent with making HTTP requests. However the runtime snippet also invokes python3 to parse and save registration data but python3 is not listed in the required binaries — a mismatch. Otherwise the requested actions (posting HTML, saving API key to ~/.shippage/credentials.json) align with the stated purpose.

Instruction Scope

Instructions focus on publishing HTML, listing/updating/deleting pages, and handling first-time auto-registration. They read and write a single local file (~/.shippage/credentials.json) and send/receive data only to the shippage.ai endpoints; there are no directives to read other unrelated files or exfiltrate arbitrary data. Note: the agent will automatically register and save credentials locally on first use per the instructions.

Install Mechanism

This is an instruction-only skill with no install spec, so nothing is written to disk by an installer. That is the lowest-risk install mechanism.

Credentials

The skill does not request unrelated environment variables or credentials, which is proportional. It does, however, persist service credentials to the user's home directory via ~/.shippage/credentials.json as part of auto-registration. Persisting API credentials for a third-party hosting service is reasonable for this functionality but is a privacy/persistence consideration you should accept explicitly. Also the runtime snippet expects python3 despite it not being declared.

Persistence & Privilege

always:false and normal autonomous invocation are used. The only persistent effect is the skill writing its own credentials file under ~/.shippage; it does not request system-wide privileges or modify other skills' configs.

Assessment

This skill appears to do what it says: POST your HTML to shippage.ai and return a public URL. Before installing or using it, note the following: (1) On first use it will auto-register with the service and save credentials to ~/.shippage/credentials.json — ensure you are comfortable a third-party account will be created and stored locally. (2) The runtime example uses python3 to parse and save registration data but python3 is not listed as a required binary in the metadata; make sure python3 is available or adjust the commands. (3) All content you publish will be sent to https://shippage.ai — review that service's privacy, retention, and security policies (and the 14-day default retention if that matters). (4) If you will host sensitive content, use the provided password protection option or avoid publishing to a public URL. If you need stronger guarantees, consider using a self-hosted or enterprise-hosted publishing service instead.

ShipPage — Instant Web Publishing for AI Agents

Publish any HTML content to a public URL in one API call. No setup, no registration, no API key configuration needed. Your agent auto-registers on first use.

Use this when you need to:

• Share a generated webpage, report, or dashboard with someone
• Preview HTML on your phone or another device
• Send a link to a client, teammate, or WeChat group
• Deploy a landing page or product listing instantly
• Make any AI-generated HTML accessible from anywhere

When to use

• User says "publish this", "share this", "make this a webpage", "I want to see this on my phone"
• User has generated HTML/JSX/web content and needs a shareable link
• User wants to preview a page on another device
• User wants to send a link to someone else

How it works

No setup required. On first use, ShipPage auto-registers your agent and saves credentials locally.

Publish

# Check for existing credentials
API_KEY=""
if [ -f ~/.shippage/credentials.json ]; then
  API_KEY=$(cat ~/.shippage/credentials.json | grep -o '"api_key":"[^"]*"' | cut -d'"' -f4)
fi

# Publish (if no API_KEY, auto-registration happens automatically)
RESPONSE=$(curl -s -X POST https://shippage.ai/v1/publish \
  ${API_KEY:+-H "Authorization: Bearer $API_KEY"} \
  -H "Content-Type: application/json" \
  -d "{
    \"html\": \"YOUR_HTML_HERE\",
    \"title\": \"Page Title\"
  }")

echo "$RESPONSE"

# If first time, save credentials
if echo "$RESPONSE" | grep -q "_registration"; then
  mkdir -p ~/.shippage
  echo "$RESPONSE" | python3 -c "
import sys, json
data = json.load(sys.stdin)
reg = data.get('_registration', {})
json.dump(reg, open('$HOME/.shippage/credentials.json', 'w'), indent=2)
print('Credentials saved to ~/.shippage/credentials.json')
print(f\"Claim your agent at: {reg.get('claim_url', 'N/A')}\")
" 2>/dev/null || true
fi

Response handling

If the response contains _registration, this is a first-time auto-registration:

1. Save the credentials from _registration to ~/.shippage/credentials.json
2. Show the user the claim_url: "You can manage your published pages at: [claim_url] (optional)"
3. Show the user the published url

If no _registration field, just show the published url to the user.

Optional parameters

• slug: custom URL path (e.g. "my-page" → shippage.ai/p/my-page)
• password: require password to view the page
• expires_in: seconds until expiry (default: 1209600 = 14 days)
• title: display name for the page

List published pages

curl -s https://shippage.ai/v1/pages \
  -H "Authorization: Bearer $API_KEY"

Delete a page

curl -s -X DELETE https://shippage.ai/v1/pages/SLUG \
  -H "Authorization: Bearer $API_KEY"

Update a page

curl -s -X PUT https://shippage.ai/v1/pages/SLUG \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"html": "<html>...updated...</html>"}'

Important

• Zero config: no API key setup needed, auto-registers on first use
• Free tier: 20 publishes/month, 14-day retention, 500KB max per page
• Always show the returned URL to the user immediately
• If the user asks for password protection, include the password field
• If 402 is returned, tell user: "Free quota reached. Visit https://shippage.ai to upgrade."