kleo-static-filesHost static files on subdomains with optional authentication. Use when you need to serve HTML, images, CSS, JS, or any static content on a dedicated subdomain. Supports file upload, basic auth, quota management, and automatic SSL via Caddy. Commands include sf sites (create/list/delete), sf upload (files/directories), sf files (list/delete).
Install via ClawdBot CLI:
clawdbot install awaaate/kleo-static-filesGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Potentially destructive shell commands in tool definitions
curl -fsSL https://bun.sh/install | bashAccesses system directories or attempts privilege escalation
/var/log/Calls external URL not in known-safe list
https://mysite.498as.comUses known external API (expected, informational)
raw.githubusercontent.comGenerated Mar 21, 2026
Development teams can deploy static documentation sites, such as those generated by tools like Docusaurus or MkDocs, to a dedicated subdomain. This ensures secure, versioned access to API docs, user guides, or internal knowledge bases with optional authentication for sensitive materials.
Law firms can use this skill to host confidential documents like case files, contracts, or reports on private subdomains with basic authentication. It enables controlled sharing with clients or partners via URLs and credentials, maintaining data security and compliance.
Marketing agencies can upload and serve static assets such as images, CSS, and JavaScript for client campaigns or landing pages. The skill supports quick updates and overwrites, making it ideal for A/B testing or distributing promotional materials with automatic SSL.
Educational institutions can create sites to host static learning materials like PDFs, HTML courses, or multimedia content for students. With quota management and authentication, it provides a cost-effective way to manage and share resources securely.
Companies can deploy internal web tools or dashboards built as static applications, such as reporting interfaces or admin panels. The skill allows for easy updates via file uploads and can restrict access with authentication to protect sensitive business data.
Offer basic static file hosting with limited quotas for free, then charge for increased storage, higher file size limits, or additional sites. Revenue can come from monthly subscriptions or pay-as-you-go plans for businesses needing scalable content delivery.
License the skill to IT service providers or web agencies who rebrand it as their own static hosting platform. Revenue is generated through upfront licensing fees or revenue-sharing agreements based on client usage.
Target industries like legal or education with tailored packages that include setup, support, and compliance features. Charge premium rates for managed services, including authentication setup, quota management, and troubleshooting assistance.
💬 Integration Tip
Set environment variables SF_API_URL and SF_API_KEY after installation to quickly start using CLI commands; use the health check endpoint to verify connectivity before deploying sites.
Scored Apr 19, 2026
AI Analysis
The skill's core functionality is consistent with its stated purpose of hosting static files, and the external API usage appears legitimate for this service. The primary risk is the potential for misuse if the API endpoint is maliciously configured, but the skill definition itself does not contain hidden instructions, credential harvesting, or obfuscation.
Audited Apr 16, 2026 · audit v1.0
Use when reviewing code for security vulnerabilities, implementing authentication flows, auditing OWASP Top 10, configuring CORS/CSP headers, handling secrets, input validation, SQL injection prevention, XSS protection, or any security-related code review.
gws CLI: Shared patterns for authentication, global flags, and output formatting.
Set up Gmail API access via gog CLI with manual OAuth flow. Use when setting up Gmail integration, renewing expired OAuth tokens, or troubleshooting Gmail authentication on headless servers.
Automate OAuth login flows with user confirmation via Telegram. Supports 7 providers: Google, Apple, Microsoft, GitHub, Discord, WeChat, QQ. Features: - Auto-detect available OAuth options on login pages - Ask user to choose via Telegram when multiple options exist - Confirm before authorizing - Handle account selection and consent pages automatically
Self-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.
Build secure authentication with sessions, JWT, OAuth, passwordless, MFA, and SSO for web and mobile apps.