Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious with medium confidence, mainly because it reports workspace deletion beyond the declared scope and a project deletion helper that bypasses its documented confirmation gate.
Consider the undeclared workspace deletion capability and the project deletion confirmation issue before installing. The unpinned installer is also a supply-chain weakness. Skillspector’s analysis is partial: it inspected all listed components, but some local references could not be resolved, so the evidence is incomplete and does not establish that the skill is safe.
scripts/litehost.shProject deletion bypasses the documented confirmation gate
The helper immediately sends an authenticated deletion request. For an existing project owned by the account, the documented endpoint permanently deletes the project and its associated data.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
link-opens.md ← GET /v1/projects/{id}/analytics (did the client open it?)
qr-code.md ← GET /qr/{id}.png | .svg (QR to print, no key needed)
deployment-history.md ← GET /v1/projects/{id}/status
delete-project.md ← DELETE /v1/projects/{id}
archive-project.md ← POST /v1/projects/{id}/archive
unarchive-project.md ← POST /v1/projects/{id}/unarchive
domains.md ← GET /v1/domains, /v1/domains/{id}, assign/remove
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
`claimUrl` to keep the project from your browser (Google or email sign-in).
To let the agent manage your projects, it signs you in **once** with an email code and saves the
key to `~/.config/litehost/credentials.json` (permissions 600). The key renews while in use, so you
are not asked for a code again. You can also provide a permanent key from
[litehost.io/dashboard → Integrations](https://litehost.io/dashboard):
The code targets the workspace resource itself. Workspace deletion is a distinct administrative operation not stated in the description; mentioning deletion of hosted content and projects does not explicitly cover deleting their workspace. The request uses the expected service, but its resource scope exceeds the declared capabilities.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
required_environment_variables:
- name: LITEHOST_API_KEY
prompt: "Your Litehost API key (format: lh_live_...). Optional."
help: "Optional. Without it the skill publishes with no sign-in, or signs in once and saves the key to ~/.config/litehost/credentials.json. Permanent keys: https://litehost.io/dashboard → Integrations."
required_for: "Managing existing projects. Not needed to publish (POST /v1/projects/temp)."
---
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
`nextStep`. Only `API_KEY_INVALID` / `API_KEY_EXPIRED` (after `forget`) lead to signing in.
- **Never rely on `export LITEHOST_API_KEY=…`.** Each command usually runs in a new shell, so the
variable is gone on the next call and every request fails with 401. The helper reads the key
from `~/.config/litehost/credentials.json` on every call.
- **Request a code once per sign-in.** If you request again while a code is open, nothing new is
sent. A wrong code (`OTP_INVALID`) means the user mistyped: ask them to re-check, never request
a new one.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
scripts/litehost.sh verify you@example.com 482931
On success the helper saves the key to `~/.config/litehost/credentials.json` (permissions 600)
and prints it masked:
```json
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
curl https://connect.litehost.io/v1/user \
-H "Authorization: Bearer $(sed -n 's/.*"apiKey"[^"]*"\([^"]*\)".*/\1/p' ~/.config/litehost/credentials.json)"
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /v1/projects/{projectId}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
and prints it masked:
{"status":"success","email":"you@example.com","apiKey":"lh_live_a1b2…9f0e","savedTo":"/home/you/.config/litehost/credentials.json","expiresAt":"2026-12-27T12:00:00.000Z","note":"Key saved; it renews while in use. Do not sign in again."}
Tell the user: "You're signed in as {email}. I saved the key in {savedTo}, so you won't need a code
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# litehost.sh api POST /v1/projects -F "title=Site" -F "files=@index.html"
#
# Key lookup order: $LITEHOST_API_KEY, then $LITEHOST_CREDENTIALS
# (default ~/.config/litehost/credentials.json).
set -euo pipefail
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Find the key (every session)
1. `LITEHOST_API_KEY` environment variable, if set
2. `~/.config/litehost/credentials.json` (`{"apiKey": "...", "email": "..."}`)
`scripts/litehost.sh` does this lookup on every call. Check the key once per session:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Take `data.apiKey` and store it where it survives this session, in this order of preference:
1. `~/.config/litehost/credentials.json` as `{"apiKey":"lh_live_…","email":"…"}` with `chmod 600`
2. The agent's secret store, as `LITEHOST_API_KEY`
3. No storage at all: ask the user to keep the key and paste it next time
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
DELETE /v1/workspaces/{workspaceId}
Projects inside the workspace are NOT deleted. They move to the user's personal scope (workspaceId becomes null).
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
set -euo pipefail
BASE="${LITEHOST_API_URL:-https://connect.litehost.io}"
CRED="${LITEHOST_CREDENTIALS:-$HOME/.config/litehost/credentials.json}"
json_field() { # json_field NAME < json (flat string fields only)
sed -n "s/.*\"$1\"[[:space:]]*:[[:space:]]*\"\([^\"]*\)\".*/\1/p" | head -n 1
The installation command invokes an unpinned npm package through npx, allowing the code executed during installation to change independently of this documentation. A compromised future release could execute with the installing user's privileges; this is a supply-chain weakness rather than evidence of a malicious MCP server.
The quick-install command executes the skills npm package without specifying a version. Installation therefore trusts whichever release resolves at execution time, creating a supply-chain execution risk if that release is compromised.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
When the user asks to deploy, host, publish, or manage a project on Litehost, read and follow the skill at ~/.claude/skills/litehost-connect/SKILL.md.
### Cursor
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
When the user asks to deploy, host, publish, update, or manage a project on Litehost,
read and follow the skill at .cursor/skills/litehost-connect/SKILL.md.
### General Agents
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Returns domain info plus all projects currently assigned to it.
curl https://connect.litehost.io/v1/domains/{domainId} \
-H "Authorization: Bearer $LITEHOST_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Equivalent curl:
curl -X POST https://connect.litehost.io/v1/auth/otp/request \
-H "Content-Type: application/json" \
-d '{"email":"you@example.com"}'
The workflow sends local files to connect.litehost.io and publishes them at a live URL, but provides no warning about uploading sensitive content or its accessibility through that URL. The opening description explains the upload functionality and expiry, but does not address these privacy implications.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X PATCH https://connect.litehost.io/v1/projects/{projectId} \
-H "Authorization: Bearer $LITEHOST_API_KEY" \
-H "Content-Type: application/json" \
-d '{"access": "private"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| name | string | yes | Display name. 1–255 chars. |
curl -X POST https://connect.litehost.io/v1/workspaces \
-H "Authorization: Bearer $LITEHOST_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name": "My Team"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| name | string | yes | New name. 1–255 chars. |
curl -X PATCH https://connect.litehost.io/v1/workspaces/{workspaceId} \
-H "Authorization: Bearer $LITEHOST_API_KEY" \
-H "Content-Type: application/json" \
-d '{"name": "New Name"}'