web-publisher@ 0.9.18
github.com/clawhub.ai/web-publisherVerdict: Safe to install
0 critical0 high2 medium
A
SCORE 95 / 100
$skillox install web-publisherSoon
Sign in to followFollowing emails you when a re-scan drops the grade. Opt-out is per-creator on /account/billing.
Why grade A?
score · 95 / 100The current grade reflects 2 minor findings below all thresholds.
0 CRIT0 HIGH2 MED0 LOW
Already at the top grade — no further rules to pass.
Latest scan findings
Scan crawl-wcsovd4f4b0kluqaezml7ymz · Thu, 28 May 2026 15:56:46 GMT · 7ms
medArbitrary subprocess execution detectedThe skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.▾
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
275- 0.7.x：`login` 在前台阻塞 5 分钟轮询。被 IDE / agent shell wrapper（Cursor / Claude / OpenClaw 等）包起来时，wrapper 把长任务标成已完成 / 转后台，输出全部丢失，用户以为失败。
276- 0.8.x：`login` 改成 fire-and-forget + 后台 daemon。前台 ~1s 退出，daemon 自动写凭证；后台进程难以审计，已弃用。
277- **0.9.0：checkpoint-file 模型。** 没有后台进程，没有 child_process。`login` 写 pending 文件就退出；`login-status` 读 pending → 一次性 poll → 写凭证。流程更简单、可审计。← spawns a subprocess outside declared capabilities
278
279AI 必须按这两步走：
medNo capability manifest declaredThe skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.rule: no-manifest▾
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule:
no-manifestskillox.io/c/web-publisher