develop-and-deploy-web-app

• Analyzed: May 12, 2026, 10:21 AM
• Findings: 1
• Version: 1.0.6
• Hash: 835cbc015a37107fad718e9f68ebc42dc9e0fe3f39dc067642699d639b6a1371
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a comprehensive framework for scaffolding, deploying, and managing background Node.js applications ('LiteApps'). While the behavior is aligned with its stated purpose, it utilizes several high-risk capabilities, including spawning detached background processes (start-app.js), opening a range of network ports (33333-39999) for a shared HTTP proxy (shared-host.js), and executing 'npm install' which fetches and runs remote code (install-app.js). Although the scripts implement security controls like strict regex validation for user inputs in common.js to prevent path traversal, the ability for an AI agent to maintain persistent background services and modify platform-wide registries (web-app-registry.json) warrants a suspicious classification due to the inherent risk of these operations.