kleo-static-filesHost static files on subdomains with optional authentication. Use when you need to serve HTML, images, CSS, JS, or any static content on a dedicated subdomain. Supports file upload, basic auth, quota management, and automatic SSL via Caddy. Commands include sf sites (create/list/delete), sf upload (files/directories), sf files (list/delete).
Install via ClawdBot CLI:
clawdbot install awaaate/kleo-static-filesGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Potentially destructive shell commands in tool definitions
curl -fsSL https://bun.sh/install | bashAccesses system directories or attempts privilege escalation
/var/log/Calls external URL not in known-safe list
https://mysite.498as.comUses known external API (expected, informational)
raw.githubusercontent.comGenerated Mar 21, 2026
Development teams can deploy static documentation sites, such as those generated by tools like Docusaurus or MkDocs, to a dedicated subdomain. This ensures secure, versioned access to API docs, user guides, or internal knowledge bases with optional authentication for sensitive materials.
Law firms can use this skill to host confidential documents like case files, contracts, or reports on private subdomains with basic authentication. It enables controlled sharing with clients or partners via URLs and credentials, maintaining data security and compliance.
Marketing agencies can upload and serve static assets such as images, CSS, and JavaScript for client campaigns or landing pages. The skill supports quick updates and overwrites, making it ideal for A/B testing or distributing promotional materials with automatic SSL.
Educational institutions can create sites to host static learning materials like PDFs, HTML courses, or multimedia content for students. With quota management and authentication, it provides a cost-effective way to manage and share resources securely.
Companies can deploy internal web tools or dashboards built as static applications, such as reporting interfaces or admin panels. The skill allows for easy updates via file uploads and can restrict access with authentication to protect sensitive business data.
Offer basic static file hosting with limited quotas for free, then charge for increased storage, higher file size limits, or additional sites. Revenue can come from monthly subscriptions or pay-as-you-go plans for businesses needing scalable content delivery.
License the skill to IT service providers or web agencies who rebrand it as their own static hosting platform. Revenue is generated through upfront licensing fees or revenue-sharing agreements based on client usage.
Target industries like legal or education with tailored packages that include setup, support, and compliance features. Charge premium rates for managed services, including authentication setup, quota management, and troubleshooting assistance.
💬 Integration Tip
Set environment variables SF_API_URL and SF_API_KEY after installation to quickly start using CLI commands; use the health check endpoint to verify connectivity before deploying sites.
Scored Apr 19, 2026
AI Analysis
The skill's core functionality is consistent with its stated purpose of hosting static files, and the external API usage appears legitimate for this service. The primary risk is the potential for misuse if the API endpoint is maliciously configured, but the skill definition itself does not contain hidden instructions, credential harvesting, or obfuscation.
Audited Apr 16, 2026 · audit v1.0
Self-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.
Clerk integration. Manage Users, Organizations. Use when the user wants to interact with Clerk data.
Clerk auth with API Keys beta (Dec 2025), Next.js 16 proxy.ts (March 2025 CVE context), API version 2025-11-10 breaking changes, clerkMiddleware() options, webhooks, production considerations (GCP outages), and component reference. Prevents 15 documented errors. Use when: API keys for users/orgs, Next.js 16 middleware filename, troubleshooting JWKS/CSRF/JWT/token-type-mismatch errors, webhook verification, user type inconsistencies, or testing with 424242 OTP.
Use when auditing Go code involving authentication flows, RBAC policies, Kubernetes admission webhooks, JWT/OAuth token validation, or privilege escalation i...
Agent verification via ClawX OAuth system. Use when checking agent verification status, embedding verification widgets, or working with agent identity/trust tiers.
Complete Reva wallet management - passwordless authentication, PayID name claiming, multi-chain crypto transfers to PayIDs or wallet addresses, balance track...