Web PreviewCAUTION
Mobile client for Codex and Claude — control coding agents from your phone via WebSocket bridge
Overview
Mobile client for Codex and Claude — control coding agents from your phone via WebSocket bridge
6b4afc353bc7OBSERVED · 2026-10-12What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: web-preview description: Flutter Web版をビルドしてユーザーにプレビューURLを案内する。playwright-cliでアクセス確認も行う。 allowed-tools: Bash(bash:*), Bash(playwright-cli:*) --- # Web Preview Flutter Web版をビルド → サーバー起動 → Playwright でアクセス確認 → URLをユーザーに案内する。 ## 手順 ### 1. ビルド & サーバー起動(スクリプト) ```bash bash .claude/skills/web-preview/scripts/web-preview.sh . ``` スクリプトが以下を一括で行う: - `flutter build web --release` - ポート8888の既存プロセスを停止(PIDファイル優先) - `nohup python3 -m http.server` で安定してバックグラウンド起動 - `curl` で起動完了を待機・検証 - `LOCAL_URL`(`127.0.0.1`)と共有用 `URL`(Tailscale優先)を出力 出力例: ```text PID: 12345 LOCAL_URL: http://127.0.0.1:8888 URL: http://<tailscale-ip>:8888 ``` ### 2. Playwright でアクセス確認 Playwright検証は `LOCAL_URL` を優先して実施する: ```bash playwright-cli open <LOCAL_URL> playwright-cli eval "document.title" playwright-cli screenshot --filename=web-preview.png playwright-cli close ``` - `document.title` が `ccpocket` であることを確認する - スクリーンショットを取得してページが正常に表示されることを確認する - エラーがあればユーザーに報告する ### 3. ユーザーへの案内 以下の情報をユーザーに伝える: - ローカル確認URL(`LOCAL_URL`) - 共有用URL(`URL`。通常はTailscale) - スクリーンショット(確認用) - ⚠️ ブラウザキャッシュクリア(Cmd+Shift+R)してからリロードすること ## トラブルシュート - `ERR_CONNECTION_REFUSED` が出る場合: - `curl -I <LOCAL_URL>` でサーバー生存確認 - `lsof -nP -iTCP:8888 -sTCP:LISTEN` で待受確認 - `/tmp/ccpocket-web-preview-8888.log` を確認 - 一部の実行環境では、コマンド終了時にバックグラウンドプロセスが回収されることがある。 その場合は別ターミナルで以下を起動してから Playwright を実行する: ```bash cd apps/mobile/build/web python3 -m http.server 8888 ```
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (5)
.agents/skills
LOCAL_URL: http://127.0.0.1:8888
if curl -fsS --max-time 2 "http://127.0.0.1:${PORT}" >/dev/null 2>&1; thenLOCAL_URL="http://127.0.0.1:${PORT}"AGENTS.md
Gates applied: no_behavioural_pass.
6b4afc353bc7full audit observations/trust-audit/skill/k9i-0__web-preview.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 6b4afc353bc7 | CAUTION | B | 89 | first audit |
Questions
What does the Web Preview skill do?
Mobile client for Codex and Claude — control coding agents from your phone via WebSocket bridge
Is Web Preview safe to install?
With care. The audit graded it B (89/100) and found 5 things worth knowing before you trust this skill, listed below with the exact line each was found on.
What can Web Preview access on my machine?
The audit observed that it reaches the network. Each of those is consistent with what it says it does. Secrets in the source: none found.
How current is this page?
The grade is for one exact copy of the source (6b4afc353bc7), read on 2026-10-12. The repository is watched, and a new audit runs when it changes — this is the first audit.