here-now
here.now lets agents publish websites and files to live URLs in seconds. Publish HTML, documents, images, PDFs, videos, and static files to live URLs at {slug}.here.now or custom domains. Use when asked to "publish this", "host this", "deploy this", "share this on the web", "make a website", "put this online", "create a webpage", "generate a URL", "build a chatbot", "password protect this site", "make this site private", or "share this site with only certain people". here.now also includes workspaces — shared team accounts where Sites belong to the team and serve at {label}.{workspace}.here.now — use when asked to "publish this to our team workspace", "share this with my team", or "put this in our company workspace". Agents can also buy a domain for a Site through here.now (no markup, DNS and SSL automatic) — use when asked to "buy a domain", "get me a .com for this", or "register a domain".
94%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
High
Do not use without reviewing
The canonical home for this skill is here-now in heredotnow/skill
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill prompt instructs the AI agent to ask the user for verification codes, obtain an API key, and directly write that API key into a local credentials file via shell commands (`echo "{API_KEY}" > ~/.herenow/credentials`). Handling and persisting user-supplied secrets directly in this manner creates a credential exposure risk as secrets pass through the LLM's context and execution environment.
W009: Direct money access capability detected (payment gateways, crypto, banking).
What this means
The skill is specifically designed for direct financial operations, giving the agent the ability to move money or execute financial transactions — such as payment processing, cryptocurrency operations, banking integrations, or market order execution.
Why it was flagged
The skill documents buying a domain through here.now ("Agents can also buy a domain for a Site through here.now") at lines 14-16 and 56, which constitutes a direct financial operation (purchases). There is no qualifying independent access control documented for this purchase flow (only search, quote, and getting explicit yes before calling purchase). Therefore, the security tier is high.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The skill instructs installation via `npx skills add heredotnow/skill --skill here-now -g`, which pulls runtime code and configuration from an external GitHub repository (heredotnow/skill) governed by an independent publisher.
- Repository
heredotnow/skill
- Revision
a85fa61
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.