Security audit
Security checks across malware telemetry and agentic risk
The skill’s purpose is coherent, but it needs review because it can publish local services to public Cloudflare URLs with weak scoping and control.
Install only if you deliberately want generated mini-apps to be reachable through public Cloudflare tunnel URLs. Do not use it with secrets, private business data, internal tools, or unreviewed generated code. Prefer a hardened version that validates names and ports, verifies cloudflared from an official source outside /tmp, asks before public deployment, supports local-only serving, and automatically expires or cleans up running apps.
# Also kill tunnel if exists
tunnel_pid=$(cat "$JITS_DIR/$name.tunnel.pid" 2>/dev/null)
[ -n "$tunnel_pid" ] && kill "$tunnel_pid" 2>/dev/null
rm -f "$JITS_DIR/$name".*
echo "🛑 Stopped $name"
else
echo "❌ App '$name' not found"62/62 vendors flagged this skill as clean.
No suspicious patterns detected.