Security audit
Security checks for vulnerabilities and agentic risk
Review before installing: this hosting skill directs automatic sharing of task details with its vendor and understates its optional wallet access.
Require explicit approval before uploading content or sending vendor feedback. Prefer claim-token updates over funded-wallet access. Review and pin payment dependencies before using paid tooling, protect management tokens, and use passcodes for sensitive pages. Anonymous content remains stored for 30 days after expiry.
The skill instructs the agent to report unsupported user tasks to the vendor without obtaining permission. Although it excludes names, email addresses, and page content, task descriptions can still expose confidential plans or business context unrelated to delivering the requested hosting service.
The service and authentication mechanism are consistent with the declared publishing workflow, but the supplied command deletes an existing site rather than publishing or updating one. Site deletion is a distinct destructive capability that the description does not disclose; optional expiry does not itself declare explicit deletion.
The service domain is consistent with the description, and authentication is not itself a mismatch. However, the supplied chunk invokes an update-query tool, submits no HTML, and requests no page creation or modification. Checking what is new since a timestamp is not a declared capability or an evident implementation step for publishing. The tool's internal implementation is not provided, so the assessment is limited to the visible request.
Referenced artifact was not completely inspected
`scripts/update-page.mjs` in this skill does all three steps (run
Referenced artifact was not completely inspected
node scripts/update-page.mjs --site <id> --file new.html
Referenced artifact was not completely inspected
(or `node scripts/update-page.mjs --site <id> --file brief.html` if you paid
Without declared permissions the skill's intent is opaque and cannot be validated.
Generic triggers such as morning brief and dashboard do not establish permission to upload content to an external host. Combined with directions to publish copies for outside recipients, these triggers create a plausible path from a local content-generation request to unintended third-party disclosure.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
go to, remember it, and name them in every publish:
curl -sS -X POST https://api.stacktr.ee/sites -F 'file=@page.html' \
-F 'owner_email=<their address>' -F 'agent=<your name>'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
go to, remember it, and name them in every publish:
curl -sS -X POST https://api.stacktr.ee/sites -F 'file=@page.html' \
-F 'owner_email=<their address>' -F 'agent=<your name>'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
over by email, without you in the loop:
curl -sS -X POST https://api.stacktr.ee/sites/<id>/keep \
-H 'content-type: application/json' \
-d '{"claim_token":"<claim_token>","email":"<their address>"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
($0.50), keep the URL and the claim_token, then every run
curl -sS -X PUT https://api.stacktr.ee/sites/<id> \
-H "Authorization: Claim <claim_token>" \
-H "Content-Type: application/json" \
--data-binary @brief.json
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- No account: run the activity request above for each page you sent, and say
its `summary`.
- With an account, one read covers every page: `whats_new` on the Stacktree
connector (`https://api.stacktr.ee/mcp`). Pass the previous run's
`checked_at` as `since` (left out, it means the last 24 hours). Each item
has `said`, a sentence to pass on, and `next`, the tool that follows it up.
Over curl:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Over curl:
curl -sS -X POST https://api.stacktr.ee/mcp \
-H "Authorization: Bearer $STACKTREE_API_KEY" \
-H 'accept: application/json, text/event-stream' \
-H 'content-type: application/json' \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
not for one person, leave both fields out:
curl -sS -X POST https://api.stacktr.ee/sites -F 'file=@page.html'
The JSON response carries url (hand it to your human), expires_at (24 hours;
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
(free, `claim_url` in the response) and set the gate there, or use the free
anonymous path which accepts `password` directly.
Probe terms without paying: `GET https://api.stacktr.ee/publish` returns the
current 402 challenge, prices, and accepted rails. Payment is EIP-3009 USDC:
you sign an authorization; you never hold ETH or pay gas.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Nothing to install, nothing to sign, no extra round trip:
curl -sS -X PUT https://api.stacktr.ee/sites/<id> \
-H "Authorization: Claim <claim_token>" \
-H "Content-Type: application/json" \
--data-binary @revision.json
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
page instead of guessing:
curl -sS https://api.stacktr.ee/sites/<id>/activity \
-H "Authorization: Claim <claim_token>"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -X DELETE https://api.stacktr.ee/sites/<id> \
-H "Authorization: Claim <claim_token>"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# 1. start it
curl -sS -X POST https://api.stacktr.ee/api-keys/device-code \
-H 'content-type: application/json' -d '{"client_hint":"my-agent"}'
# → { device_code, user_code, verification_url_complete, interval, expires_in }
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# → { device_code, user_code, verification_url_complete, interval, expires_in }
# 2. print verification_url_complete for your human, then poll every `interval` seconds
curl -sS -X POST https://api.stacktr.ee/api-keys/device-code/poll \
-H 'content-type: application/json' -d '{"device_code":"…"}'
# → {"status":"pending"} keep polling · {"status":"authorized","api_key":"stk_live_…"} store it
# → {"status":"denied"} or {"status":"expired"} stop
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Everything in this skill is plain HTTP, which is why it works anywhere. If your
runtime does speak MCP, the same account is reachable at
`https://api.stacktr.ee/mcp` (streamable HTTP), and **it takes an API key**:
send `Authorization: Bearer stk_live_…` exactly as you would on REST. No
browser, no OAuth dance, nothing to register. OAuth 2.1 + DCR is also
accepted, but only clients that want it need it.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
accepted, but only clients that want it need it.
curl -sS -X POST https://api.stacktr.ee/mcp \
-H "Authorization: Bearer $STACKTREE_API_KEY" \
-H 'accept: application/json, text/event-stream' \
-H 'content-type: application/json' \
The command invokes an unpinned npm executable, not an MCP server, and npx can download and execute package code when it is not installed locally. A compromised or unexpected release could execute with the agent's local privileges in a workflow involving a funded wallet.
The opening assurance says the skill performs only curl requests, but later instructions prescribe npx execution, npm installation, and a Node script that reads a funded wallet's private key. This understates the execution and credential-access boundary and can cause users to authorize substantially more privileged behavior than they expected.
Detected: suspicious.env_credential_access