← Back to Skills Marketplace
631
Downloads
0
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install ngrok-preview
Description
Generate short-lived, mobile-friendly ngrok preview links for local artifacts and share them in Telegram. Use when OpenClaw produces images/charts/generated...
Usage Guidance
This skill appears to do what it says: create short-lived ngrok previews of files you explicitly provide. Before installing/using it: 1) Install ngrok from the official site and provide NGROK_AUTHTOKEN securely if you want authenticated tunnels. 2) Only pass specific artifact paths (not broad or system dirs) — the script will copy whatever paths you give into ~/.cache/openclaw-ngrok-preview, so do not include secrets (SSH keys, config dirs, root of workspace). 3) Run the provided cleanup/down commands after the preview is no longer needed to remove local copies. 4) Verify the preview URL before sharing (it exposes files over the internet). If you want automated Telegram posting, note the skill does not contain Telegram integration or request a Telegram token — sharing must be done by the agent/user via their existing channel.
Capability Analysis
Type: OpenClaw Skill
Name: ngrok-preview
Version: 1.0.2
The 'ngrok-preview' skill is designed to expose local files and directories via ngrok, which is an inherently high-risk capability. While the SKILL.md explicitly instructs the AI agent to only publish 'task-specific outputs' and 'never broad directories', the underlying `scripts/ngrok_preview.py` script's `copy_sources` function will copy and serve any path provided to its `--source` argument. This creates a significant prompt injection vulnerability, allowing a malicious user to instruct the AI agent to expose sensitive local files (e.g., `~/.ssh`, `/etc/passwd`) or entire directories, leading to data exfiltration. The script uses `subprocess.Popen` to run a local HTTP server and the ngrok client, providing the mechanism for this exposure.
Capability Assessment
Purpose & Capability
Name/description match the included script and SKILL.md: the script packages task artifacts, starts an ngrok tunnel, and exposes a temporary preview. The README mentions Telegram only as the delivery channel; the skill does not require Telegram credentials (it expects the agent or user to share the link) which is reasonable.
Instruction Scope
SKILL.md keeps scope narrow (collect task artifacts, create a session, publish link, clean up). The script follows that: it copies only the explicitly passed --source paths and serves them. However, the script will copy arbitrary filesystem paths you pass (absolute or relative), so a careless invocation could expose sensitive files. SKILL.md warns not to publish broad directories, but the mechanism does allow copying anything the agent/user specifies.
Install Mechanism
No install spec; instructions require a user-installed ngrok binary (official site) and optionally an auth token. Nothing is downloaded or executed from unknown remote URLs by the skill itself.
Credentials
No required environment variables are declared. The script optionally reads NGROK_AUTHTOKEN (or accepts --auth-token) which is appropriate for using ngrok. No other secrets or unrelated credentials are requested.
Persistence & Privilege
The skill writes session state and copied artifacts under ~/.cache/openclaw-ngrok-preview (per-session dirs stored until cleaned). always:false and no privileged flags are set. Users should be aware that copied artifacts persist until 'down' or 'cleanup' is run and that stale sessions can retain files.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install ngrok-preview - After installation, invoke the skill by name or use
/ngrok-preview - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.2
Revert SKILL.md description update; keep README-only messaging
v1.0.1
Update published description and positioning
v1.0.0
Initial release
Metadata
Frequently Asked Questions
What is Ngrok Preview?
Generate short-lived, mobile-friendly ngrok preview links for local artifacts and share them in Telegram. Use when OpenClaw produces images/charts/generated... It is an AI Agent Skill for Claude Code / OpenClaw, with 631 downloads so far.
How do I install Ngrok Preview?
Run "/install ngrok-preview" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Ngrok Preview free?
Yes, Ngrok Preview is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Ngrok Preview support?
Ngrok Preview is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Ngrok Preview?
It is built and maintained by Yong (@wynnsu); the current version is v1.0.2.
More Skills