Search skills/

PinMe Claude skills

Seven skills for the PinMe deployment CLI: upload static sites to IPFS or ship a React + Cloudflare Worker + D1 project, plus auth, email, LLM, R2 and payments helpers.

glitternetwork/pinme 7 skills Cloud & DevOpsBackend & databases
Our verdict Recommended with caveats

Reasonable, concise skills for a specific hosting service; you are tied to PinMe's platform and public IPFS uploads.

2/5 Depth expertise shipped Note Security Review before installing 47d Maintenance Updated 2 mo ago 3.8K Adoption stars OK License MIT, commercial OK

What PinMe does

PinMe is a deployment CLI, and this repository adds seven agent skills for it. The main pinme skill decides between two paths. For a static site it checks that pinme is current, authenticates, finds the build folder (dist, build, out or public) and runs pinme upload, then returns the URL. For anything needing a backend it creates a project from a template with a React and Vite frontend, a Cloudflare Worker and a D1 database, and deploys with pinme save or the narrower update-worker, update-db and update-web commands.

The other six skills guide the agent in writing Worker TypeScript for specific PinMe services: user authentication, email sending, OpenRouter-backed LLM calls, R2 object storage, UniwebPay payments, and a share skill that packages a result as a static page and publishes it. Each skill is a single Markdown file of roughly 5 to 15 KB, with no scripts or references. The README also lists guardrails: never upload src, node_modules, .git or .env. Some features need a PinMe login, and custom domains need wallet balance. Content uploaded to IPFS should be treated as public.

Good for

  • Quickly publishing a static build and getting a shareable URL
  • Prototype full-stack apps on PinMe's Worker and D1 template
  • Agents that need correct PinMe-specific Worker code for auth, email or storage

Not for

  • Private or sensitive content, since uploads go to IPFS
  • Teams that do not want to depend on the PinMe platform

What's inside depth 2/5

Seven single-file skills averaging 13 KB, no references, scripts or evals.

Skills
7
Reference docs
0
Scripts
0
Tests / evals
0
Templates
0
Avg SKILL.md
12.8 KB

Counted from the repository file tree. How we score depth.

Dependencies and costs

  • pinme CLI from npm (Node.js 16.13 or newer)
  • PinMe account (pinme login or an AppKey)
  • Wallet balance for custom domains
  • OpenRouter, UniwebPay and Cloudflare services through the PinMe platform for the matching skills

Security review

Review before installing

A deployment CLI and skills that upload sites to IPFS or create full-stack projects on Cloudflare via the PinMe platform. The CLI sends usage events by default (with your wallet address or a device id), stores your login token in plain text under ~/.pinme, and the main skill reinstalls pinme@latest globally before use. Uploaded content is public.

Worth knowing

  • Sends usage data by default (can be turned off)The CLI sends a best-effort detached GET to https://pinme.dev/track.gif for every login, upload, domain, wallet and project command, with a user id (your wallet address once logged in, otherwise a random device id in ~/.pinme/device-id), project name and directory name, error reasons, CLI/Node versions, OS and architecture; set PINME_TRACKING_DISABLED=1 or DO_NOT_TRACK=1 to stop it, which we found only in the source, not in the docs.bin/utils/tracker.ts:56
  • Needs an API key for its own serviceThe AppKey/login token is saved unencrypted in ~/.pinme/auth.json and sent as token-address / authentication-tokens headers to the PinMe API.bin/utils/auth.ts:52
  • Makes network requestsUpload, create, save, domain and wallet commands call the PinMe API and an IPFS/CAR proxy (default CAR_API_BASE is the plain-http ipfs-proxy.opena.chat) with axios; uploaded files become publicly reachable on IPFS.bin/utils/apiClient.ts:1
  • Runs remote code at an unpinned versionThe main skill tells the agent to compare versions and run npm install -g pinme@latest before use, so the globally installed CLI is replaced with the newest published version.skills/pinme/SKILL.md:48
  • Installs packages or toolspinme create/save spawn npm ci or npm install in the project in the background with an isolated cache.bin/utils/installProjectDependencies.ts:5
  • Changes files outside your projectCreates ~/.pinme/ with auth.json, device-id and upload history.bin/utils/getDeviceId.ts:8
  • Relies on a CLI or package we could not reviewThe skills drive the pinme CLI (npm package pinme), which deploys to Cloudflare Workers/D1, PinMe-hosted LLM, email, R2 and UniwebPay services; the published package is not the same artifact as this source tree.skills/pinme/SKILL.md:27

What we checked

The repository (159 files) on Oct 29, 2026. Not a full review: we read 3 of 83 code files; it relies on code outside the repository: npm package pinme as published, PinMe/IPFS/Cloudflare back-end services (pinme.dev, pinme.cloud, ipfs-proxy.opena.chat); Not read in full: bin/ command files, uploadService, webLogin, pinmeApi, installProjectDependencies, history, decrypt and the test suite (inspected by grep for network, spawn, token and file writes).

NVIDIA SkillSpector static scan: 54 pattern hits (Supply Chain 42, Privilege Escalation 5, Data Exfiltration 3, MCP Rug Pull 2, Excessive Agency 2). Most hits are known-vulnerable dev dependencies in package-lock.json (vite, glob, minimatch, adm-zip), '.env' handling in pinme create, test fixtures against api.pinme.test, and 'Do not ask the user for the wallet secret' guidance in the UniwebPay skill (a restriction, not a bypass). The tracker module is real usage telemetry, as described above.

A review, not a certification. Skills change after we check them — read the files before installing.

License

MIT — commercial use allowed.

Can it run unattended?

Not really. Deploy steps are short and interactive, with login and URL reporting; there is no loop or recovery state.

Alternatives to PinMe

Cloudflare Skills

cloudflare/skills

Cloudflare's official 19-skill pack for building on Workers, Durable Objects, the Agents SDK, Cloudflare One and more, with an optional bundled MCP server.

Recommended Check first Depth 4/5

Vercel Agent Skills

vercel-labs/agent-skills

Vercel's official 9-skill pack: React and Next.js performance rules, composition patterns, UI and writing review, React Native, deploy and cost audit.

Recommended Broad access Depth 3/5

FAQ

What is PinMe?

PinMe is a deployment CLI that uploads static sites to IPFS and can create and deploy a React, Cloudflare Worker and D1 project from one tool. This repo adds seven agent skills that tell a coding agent how to use it.

How do I install the PinMe skill?

Run npx skills add glitternetwork/pinme, then install the CLI with npm install -g pinme and sign in with pinme login.

Is it safe to upload with PinMe?

The skills do not contain hidden calls, and they tell the agent not to upload source folders, .git or .env files. Anything you upload to IPFS should still be treated as public.

Sources: GitHub repository (stars, license, file tree, last push Sep 12, 2026). Review based on the README and SKILL.md files as published.