exe
Automates the deployment of Vibes apps to exe.dev with SSH, nginx, and multi-tenancy support for seamless hosting.
Install this skill
Security score
The exe skill was audited on Feb 9, 2026 and we found 26 security issues across 4 threat categories, including 1 critical. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 48 | ```bash |
Template literal with variable interpolation in command context
| 66 | ```bash |
Template literal with variable interpolation in command context
| 82 | ```bash |
Template literal with variable interpolation in command context
| 90 | ```bash |
Template literal with variable interpolation in command context
| 175 | const dbName = `myapp-${subdomain}`; |
Template literal with variable interpolation in command context
| 184 | ```bash |
Template literal with variable interpolation in command context
| 223 | ```bash |
Template literal with variable interpolation in command context
| 278 | ```bash |
Template literal with variable interpolation in command context
| 308 | ``` |
Template literal with variable interpolation in command context
| 323 | ``` |
Template literal with variable interpolation in command context
| 328 | - "Continue on VM" → Provide: `ssh ${name}.exe.dev -t "cd /var/www/html && claude"` |
Curl to non-GitHub URL
| 124 | curl https://YOUR_CLERK_DOMAIN/.well-known/jwks.json |
Curl to non-GitHub URL
| 274 | | Verifying deploy | ❌ | ✅ `curl https://vm.exe.xyz` | |
Webhook reference - potential data exfiltration
| 43 | 2. If Registry enabled, ask for Clerk PEM public key and webhook secret |
Webhook reference - potential data exfiltration
| 93 | --clerk-webhook-secret "whsec_xxx" \ |
Webhook reference - potential data exfiltration
| 101 | 4. Adds nginx proxy for `/registry.json`, `/check/*`, `/claim`, `/webhook` |
Webhook reference - potential data exfiltration
| 110 | | `/webhook` | POST | Svix sig | Clerk subscription events | |
Webhook reference - potential data exfiltration
| 213 | | `--clerk-webhook-secret <secret>` | Clerk webhook signing secret | |
Access to hidden dotfiles in home directory
| 12 | 1. **SSH key** in `~/.ssh/` (id_ed25519, id_rsa, or id_ecdsa) |
Access to SSH directory
| 12 | 1. **SSH key** in `~/.ssh/` (id_ed25519, id_rsa, or id_ecdsa) |
Access to .env file
| 140 | sudo nano /etc/registry.env |
External URL reference
| 60 | 6. **Verifies** public access at `https://myapp.exe.xyz` |
External URL reference
| 124 | curl https://YOUR_CLERK_DOMAIN/.well-known/jwks.json |
External URL reference
| 274 | | Verifying deploy | ❌ | ✅ `curl https://vm.exe.xyz` | |
External URL reference
| 309 | Question: "Your app is live at https://${name}.exe.xyz! What's next?" |
External URL reference
| 326 | - "Share URL" → Confirm "Your app is live at https://${name}.exe.xyz - share this link!" |