kleo-static-filesHost static files on subdomains with optional authentication. Use when you need to serve HTML, images, CSS, JS, or any static content on a dedicated subdomain. Supports file upload, basic auth, quota management, and automatic SSL via Caddy. Commands include sf sites (create/list/delete), sf upload (files/directories), sf files (list/delete).
Install via ClawdBot CLI:
clawdbot install awaaate/kleo-static-filesGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Potentially destructive shell commands in tool definitions
curl -fsSL https://bun.sh/install | bashAccesses system directories or attempts privilege escalation
/var/log/Calls external URL not in known-safe list
https://mysite.498as.comUses known external API (expected, informational)
raw.githubusercontent.comGenerated Mar 21, 2026
Development teams can deploy static documentation sites, such as those generated by tools like Docusaurus or MkDocs, to a dedicated subdomain. This ensures secure, versioned access to API docs, user guides, or internal knowledge bases with optional authentication for sensitive materials.
Law firms can use this skill to host confidential documents like case files, contracts, or reports on private subdomains with basic authentication. It enables controlled sharing with clients or partners via URLs and credentials, maintaining data security and compliance.
Marketing agencies can upload and serve static assets such as images, CSS, and JavaScript for client campaigns or landing pages. The skill supports quick updates and overwrites, making it ideal for A/B testing or distributing promotional materials with automatic SSL.
Educational institutions can create sites to host static learning materials like PDFs, HTML courses, or multimedia content for students. With quota management and authentication, it provides a cost-effective way to manage and share resources securely.
Companies can deploy internal web tools or dashboards built as static applications, such as reporting interfaces or admin panels. The skill allows for easy updates via file uploads and can restrict access with authentication to protect sensitive business data.
Offer basic static file hosting with limited quotas for free, then charge for increased storage, higher file size limits, or additional sites. Revenue can come from monthly subscriptions or pay-as-you-go plans for businesses needing scalable content delivery.
License the skill to IT service providers or web agencies who rebrand it as their own static hosting platform. Revenue is generated through upfront licensing fees or revenue-sharing agreements based on client usage.
Target industries like legal or education with tailored packages that include setup, support, and compliance features. Charge premium rates for managed services, including authentication setup, quota management, and troubleshooting assistance.
💬 Integration Tip
Set environment variables SF_API_URL and SF_API_KEY after installation to quickly start using CLI commands; use the health check endpoint to verify connectivity before deploying sites.
Scored Apr 19, 2026
AI Analysis
The skill's core functionality is consistent with its stated purpose of hosting static files, and the external API usage appears legitimate for this service. The primary risk is the potential for misuse if the API endpoint is maliciously configured, but the skill definition itself does not contain hidden instructions, credential harvesting, or obfuscation.
Audited Apr 16, 2026 · audit v1.0
Self-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.
Clerk integration. Manage Users, Organizations. Use when the user wants to interact with Clerk data.
Clerk auth with API Keys beta (Dec 2025), Next.js 16 proxy.ts (March 2025 CVE context), API version 2025-11-10 breaking changes, clerkMiddleware() options, webhooks, production considerations (GCP outages), and component reference. Prevents 15 documented errors. Use when: API keys for users/orgs, Next.js 16 middleware filename, troubleshooting JWKS/CSRF/JWT/token-type-mismatch errors, webhook verification, user type inconsistencies, or testing with 424242 OTP.
Sentry API integration with managed authentication. Monitor errors, issues, and application performance. Use this skill when users want to list issues, retrieve events, manage projects, teams, or releases in Sentry. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Sentry connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Sentry action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Sentry examples; they add no Sentry capability - Sentry is not an event source, a trigger cannot read Sentry data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
Square API integration with managed OAuth. Install only if you need Square administration. Connect with the least-privileged Square account and OAuth scopes available, verify the intended connection ID before each request, and revoke unused connections promptly. This integration can mutate Square data — approve only specific write actions after checking the exact endpoint, account, resource ID, and consequence. For other third party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Requires network access and valid Maton API key. Calls run through the `maton` CLI with OAuth login, or over raw HTTP with a Maton API key where the CLI cannot be installed. Every call is authenticated as the user's connection and reaches only what that connection's authorization allows, which the provider enforces on every request; the endpoints documented here are the ones this skill uses, and any other endpoint of this app needs the user to ask for it by name. Default to read and list calls, and confirm every write or new connection with the user. This file also documents the three constructs that turn a Square connection into automation, in the order they are used: the connection (the first step), a hosted function that runs a Square action through the Maton SDK, and a trigger that calls that function on a schedule or on an event. Those sections are the platform's own reference text, shared with the api-gateway skill, with Square examples; they add no Square capability - Square is not an event source, a trigger cannot read Square data, and the files under `references/<source>/triggers.md` are the platform's event catalogues for the sources Maton offers (time, Calendly, GitHub, Gmail, HubSpot, Linear, Notion, Slack, Stripe).
Download YouTube videos by URL in various resolutions using a pay-per-use API with credit-based authentication and no charge on failed downloads.