📦 PostMe Deploy — 一键前端上线
v1.0.3把本地 HTML/前端文件秒级部署到 PostMe（dele.fun），自动生成可访问的在线链接，省去服务器配置，适合快速预览、分享与协作。
0· 134·0 当前·0 累计
by @del-zhenwu下载技能包
最后更新
2026/3/30
安全扫描
OpenClaw
安全
medium confidenceThe skill's requests and instructions are coherent with its stated purpose (upload local frontend files to PostMe) but there are a few minor metadata and operational notes you should review before use.
评估建议
This skill does what it says: it will read files under whatever path you pass it and upload them to the PostMe API using a POSTME_API_KEY. Before installing or enabling it: (1) confirm the skill's source/trustworthiness (homepage is missing), (2) only provide a target_path that contains non-sensitive files (do not point it at your home directory), (3) store the POSTME_API_KEY in a secure place and consider using a scoped/temporary key if PostMe supports it, (4) be aware the registry metadata inc...详细分析 ▾
✓ 用途与能力
The skill declares and implements a deploy-to-PostMe workflow: it reads local files, bundles them, and POSTs them to a PostMe upload endpoint. Requiring a POSTME_API_KEY and optionally POSTME_API_URL is proportionate for that purpose. One inconsistency: the registry metadata above says "Required env vars: none" while SKILL.md explicitly requires POSTME_API_KEY — this appears to be a metadata oversight.
ℹ 指令范围
The SKILL.md instructs the agent to determine an absolute target_path and upload every file found under it. That scope is appropriate for deploying a project folder, but the allowed-tools (read(*), glob(*)) and the implementation mean the agent could read and upload any path the caller supplies. The instructions do not attempt to read unrelated system configuration or credentials.
✓ 安装机制
This is an instruction-only skill with no install spec and no remote downloads. It mentions a normal Python dependency (requests) which the README asks the operator to pip install; there is no embedded/install-time network fetch of arbitrary code.
ℹ 凭证需求
The skill requires a single service credential (POSTME_API_KEY) and optionally a custom API URL — both are expected for an API-based deployer. The required secret is proportional, but because it is sensitive, you should only set it for a trusted agent and consider scoping or rotating the key. Also note the registry metadata does not reflect this required env var, which could confuse users.
✓ 持久化与权限
The skill does not request permanent/always-on presence (always: false) and does not modify other skills or system-wide config. Autonomous invocation is permitted by default (disable-model-invocation: false) which is normal for skills; combine this with the fact the skill can read local paths only when invoked.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.32026/3/29
- Added a skill metadata header (YAML frontmatter) specifying name, description, allowed-tools, and environment variables. - No changes made to the code or usage instructions. - Environment variable requirements now clearly listed in the metadata section at the top. - No functional changes in this version; documentation and metadata update only.
● 无害
安装命令
点击复制官方npx clawhub@latest install postme-deploy
镜像加速npx clawhub@latest install postme-deploy --registry https://cn.longxiaskill.com