hushdrop-9c53c0 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited hushdrop-9c53c0 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Open-source artifact sharing on your own domain. Drop a file → it's branded, optionally password-locked (AES-256, client-side), and live at a clean URL in ~1 second. No git, no deploy-per-file — it's object storage (Vercel Blob) behind a one-line edge proxy.
Reach for drop when the user asks to publish / share / host / send something, or whenever you've generated an HTML page (report, dashboard, mockup, doc) they'll want to view in a browser. Pipe the artifact to drop and hand back the URL (and password, if locked).
hush file.html --managed — no token, no Vercel. Publishes to themanaged tier (HTML/markdown, auto-expires in 24h). Easiest start.
hush init once (BYO Vercel Blob + domain, see SETUP.md), then hush file.html.Locked by default (AES-256, client-side — the server only stores ciphertext). Every drop is served noindex so leaked URLs never get indexed. Use a long password for anything sensitive.
hush report.html # brand + lock (auto password) + upload → https://<domain>/report-a1b2
drop notes.md # markdown → rendered, branded HTML page
hush report.html -p secret # use your own password
hush report.html --no-lock # branded, no password (renders for anyone with the link)
hush report.html --expire 7d # auto-expire (7d/24h/2w/date); enforce deletion with `hush gc`
drop bundle.zip # raw file, unguessable URL → /bundle-x7f2k9.zip
drop file.pdf --page # generate a branded download page wrapping the file
drop file.pdf --page -p secret # password-protect that download page
drop -s q3-deck deck.html # force the slug → /q3-deck
hush list # list live drops + their passwords
hush rm q3-deck # delete a drop
hush gc # delete drops whose --expire has passed (cron-friendly)MCP server: node skill/mcp.mjs exposes publish_html, publish_file, update_site, list_sites, delete_site over stdio. Wire it into agents with node skill/install.mjs.
The URL (and password, if locked) is printed and copied to the clipboard.
<head> (favicon + OG/Twitter card so pasted links show a brandedpreview) + a subtle corner badge before </body>.
baked into the content before encryption, so it survives decryption.
middleware.js on the configured domain(rewrites Blob headers so encrypted HTML renders instead of downloading).
brand/brand.json (name, colors, owner, social links) + swap brand/logo-white.pngand brand/favicon.png. Applied automatically to gate, badge, download pages, and link cards.
~/.hushdrop/config.json (domain, blob host, Vercel project/org), written by hush init.~/.hushdrop/.env → BLOB_READ_WRITE_TOKEN, written by hush setup.DROP_DOMAIN, DROP_BLOB_HOST.hush init --domain share.yoursite.com \
--blob-host <id>.public.blob.vercel-storage.com --project prj_xxx --org team_xxx
hush setup --token vercel_blob_rw_... # or: vercel login, then `hush setup`hush setup auto-installs @vercel/blob and verifies the store. See SETUP.md to stand up the Vercel Blob store + domain rewrite first. The backend is shared — set up once, then hush list/rm work from any machine; passwords stay local in ~/.hushdrop/manifest.json.
encrypted blob is downloadable, so use long passwords for anything sensitive (it's not a vault).
protection on a file, use --page -p <pw> (gated page).
~/.hushdrop/manifest.json is plaintext on this machine only.node ≥ 18, npx (StatiCrypt is pulled on demand); vercel CLI for hush setup token pull@vercel/blob — auto-installed on first run (gitignored, not committed)pbcopy (mac), clip/clip.exe (windows/WSL), xclip/wl-copy (linux)~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.