Scan Report
0 /100
todo-webapp
Deploy a local TODO web app that reads and writes a Markdown TODO.md file. Serves a beautiful dark-themed, glassmorphism UI on the LAN.
A legitimate zero-dependency Node.js TODO web app that reads/writes local Markdown files and serves a web UI over LAN. No malicious behavior detected.
Safe to install
No action needed. This skill is safe to use as described.
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Filesystem | NONE | READ+WRITE | ✓ Aligned | SKILL.md: 'reads and writes a Markdown TODO.md file'; server.js: lines 15, 42, 5… |
| Network | NONE | READ+WRITE | ✓ Aligned | SKILL.md: 'Serves a beautiful dark-themed, glassmorphism UI on the LAN'; server.… |
| Shell | NONE | NONE | — | No child_process, exec, spawn, or shell invocation found |
| Environment | NONE | NONE | — | No os.environ or process.env access beyond standard Node.js |
| Skill Invoke | NONE | NONE | — | No skill-to-skill invocation |
| Clipboard | NONE | NONE | — | No clipboard access |
| Browser | NONE | NONE | — | No browser automation |
| Database | NONE | NONE | — | No database access |
1 findings
Medium External URL 外部 URL
https://i.imgur.com/noOCejM.jpeg SKILL.md:10 File Tree
2 files · 17.1 KB · 565 lines JavaScript 1f · 485L
Markdown 1f · 80L
├─
▾
scripts
│ └─
server.js
JavaScript
└─
SKILL.md
Markdown
Security Positives
✓ Zero dependencies — no external packages to audit, eliminates supply chain risk
✓ No shell execution — pure Node.js built-in modules only (http, fs, path)
✓ No credential access — does not read .env, ~/.ssh, or any sensitive paths
✓ No external network requests — serves only on local LAN (0.0.0.0:3456)
✓ No obfuscation — all code is readable and human-understandable
✓ SKILL.md accurately describes all behavior — no hidden functionality
✓ Input sanitization via escHtml() prevents XSS in rendered output
✓ Local-only file operations with predictable paths (TODO.md, TODO-done.md, bg.jpg)
✓ HTML output uses Content-Type headers appropriately
✓ SSE connections properly cleaned up on client disconnect