Atlas / Skills / k9i-0 / Web Preview

Web PreviewCAUTION

skills/k9i-0/web-preview

Mobile client for Codex and Claude — control coding agents from your phone via WebSocket bridge

Verdict
CAUTION
Grade
B
Trust score
89 /100
Version
—
Hosts
—
License
MIT
Stars
1,087
01

Overview

Mobile client for Codex and Claude — control coding agents from your phone via WebSocket bridge

Read from source at commit 6b4afc353bc7OBSERVED · 2026-10-12
02

What it tells the agent

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: web-preview
description: Flutter Web版をビルドしてユーザーにプレビューURLを案内する。playwright-cliでアクセス確認も行う。
allowed-tools: Bash(bash:*), Bash(playwright-cli:*)
---

# Web Preview

Flutter Web版をビルド → サーバー起動 → Playwright でアクセス確認 → URLをユーザーに案内する。

## 手順

### 1. ビルド & サーバー起動(スクリプト)

```bash
bash .claude/skills/web-preview/scripts/web-preview.sh .
```

スクリプトが以下を一括で行う:
- `flutter build web --release`
- ポート8888の既存プロセスを停止(PIDファイル優先)
- `nohup python3 -m http.server` で安定してバックグラウンド起動
- `curl` で起動完了を待機・検証
- `LOCAL_URL`(`127.0.0.1`)と共有用 `URL`(Tailscale優先)を出力

出力例:

```text
PID: 12345
LOCAL_URL: http://127.0.0.1:8888
URL: http://<tailscale-ip>:8888
```

### 2. Playwright でアクセス確認

Playwright検証は `LOCAL_URL` を優先して実施する:

```bash
playwright-cli open <LOCAL_URL>
playwright-cli eval "document.title"
playwright-cli screenshot --filename=web-preview.png
playwright-cli close
```

- `document.title` が `ccpocket` であることを確認する
- スクリーンショットを取得してページが正常に表示されることを確認する
- エラーがあればユーザーに報告する

### 3. ユーザーへの案内

以下の情報をユーザーに伝える:

- ローカル確認URL(`LOCAL_URL`)
- 共有用URL(`URL`。通常はTailscale)
- スクリーンショット(確認用)
- ⚠️ ブラウザキャッシュクリア(Cmd+Shift+R)してからリロードすること

## トラブルシュート

- `ERR_CONNECTION_REFUSED` が出る場合:
  - `curl -I <LOCAL_URL>` でサーバー生存確認
  - `lsof -nP -iTCP:8888 -sTCP:LISTEN` で待受確認
  - `/tmp/ccpocket-web-preview-8888.log` を確認
- 一部の実行環境では、コマンド終了時にバックグラウンドプロセスが回収されることがある。
  その場合は別ターミナルで以下を起動してから Playwright を実行する:

```bash
cd apps/mobile/build/web
python3 -m http.server 8888
```
03

Trust audit

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
none-observed
Network
declared (3 observation(s))
Shell
none-observed
Dependencies
pinned
Secrets in source
none-found

Findings (5)

MEDIUMInventory / provenance · inv.symlink · CWE-1104
.agents/skills
.agents/skills
Why it matters. link not followed
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
SKILL.md:30
LOCAL_URL: http://127.0.0.1:8888
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
scripts/web-preview.sh:58
if curl -fsS --max-time 2 "http://127.0.0.1:${PORT}" >/dev/null 2>&1; then
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
scripts/web-preview.sh:76
LOCAL_URL="http://127.0.0.1:${PORT}"
LOWInventory / provenance · inv.symlink · CWE-1104
AGENTS.md
AGENTS.md
Why it matters. link not followed

Gates applied: no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 6b4afc353bc7full audit observations/trust-audit/skill/k9i-0__web-preview.json · Report an issue / request a re-scan
04

Audit history

Every audit this skill has had.

DateSourceVerdictGradeScoreChange
2026-10-126b4afc353bc7CAUTIONB89first audit
05

Questions

What does the Web Preview skill do?

Mobile client for Codex and Claude — control coding agents from your phone via WebSocket bridge

Is Web Preview safe to install?

With care. The audit graded it B (89/100) and found 5 things worth knowing before you trust this skill, listed below with the exact line each was found on.

What can Web Preview access on my machine?

The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.

How current is this page?

The grade is for one exact copy of the source (6b4afc353bc7), read on 2026-10-12. The repository is watched, and a new audit runs when it changes — this is the first audit.

Advertisement