deed.page publish

Overview

deed.page hosts static files (HTML, CSS, JS, images) at https://<slug>.deed.page/. A publish
is one curl request: no account, API key, email code, or claim link. The agent picks the slug,
and the site stays up until someone deletes it. The first publish returns a token, which is the
only key that can update or delete that site. Adapted from the official skill:
https://github.com/f-o-x11/deed-page-skill

When to Use This Skill

• Use when the user asks to publish, host, deploy, share online, "put this online" or "give me a

link" for something the agent generated: an HTML report, dashboard, slide deck, landing page,
prototype, game, or docs folder.

• Use when the user wants deed.page, or wants a link without creating an account and has not

picked another host.

• Use when the agent runs unattended and cannot ask a human for a code or a click.
• Do not use for secrets or private data: Free sites are public.
• Do not use for apps that need a server at runtime (SSR, API routes, databases). deed.page serves

static files only.

How It Works

Step 1: Pick a slug

Lowercase letters, digits and hyphens, 1 to 63 characters, no leading or trailing hyphen. Add a
random suffix so the name is unlikely to be taken. hello, my-page, my-app and my-site are
reserved.

set -e
UPLOAD_DIR="$(mktemp -d)" || exit 1
SLUG="report-$(head -c4 /dev/urandom | od -An -tx1 | tr -d ' \n')"
REF="${DEED_REF:-skill-agentic-awesome-skills}"

REF is stored for attribution only and does not change the publish. Set the X-Client header
to the agent's name, for example Claude Code, Codex or Cursor.

Step 2: Confirm what goes public

Before the first publish, tell the user the file or folder will be public at a guessable URL, and
check that it holds no .env files, keys, tokens or personal data.

Step 3: Publish

Do not expose the returned token in shared tool logs. Capture responses into an owner-only private file, parse only public status/URL fields and retain the token through an approved secret mechanism. Build the optional authorization header as a protected curl config file rather than shell word-splitting an expanded string:

umask 077
: > "$UPLOAD_DIR/headers.conf"
if [ -n "${DEEDPAGE_TOKEN:-}" ]; then
  case "$DEEDPAGE_TOKEN" in *[!A-Za-z0-9._~-]*) echo "Unexpected token characters" >&2; exit 1;; esac
  printf 'header = "Authorization: Bearer %s"\n' "$DEEDPAGE_TOKEN" > "$UPLOAD_DIR/headers.conf"
fi

The upload snippets below illustrate the request; add protected response capture before running them. Verify current provider limits, privacy and retention; “permanent” is a provider claim, not an availability guarantee.

A single HTML file is stored as index.html:

curl -sS -T report.html "https://deed.page/v1/sites?slug=$SLUG&ref=$REF" \
  -H "X-Client: <agent name>" \
  --config "$UPLOAD_DIR/headers.conf"

A folder: its contents go to the site root, so it should contain index.html:

tar -C ./site -czf "$UPLOAD_DIR/site.tar.gz" . &&
curl -sS -T "$UPLOAD_DIR/site.tar.gz" "https://deed.page/v1/sites?slug=$SLUG&ref=$REF" \
  -H "X-Client: <agent name>" \
  --config "$UPLOAD_DIR/headers.conf"

A successful response:

{"ok":true,"url":"https://<slug>.deed.page/","slug":"<slug>","version":"v1","permanent":true,"token":"<returned once>"}

Step 4: Answer the user

• Reply with the url field.
• The first publish returns token once. Keep it in the session environment as DEEDPAGE_TOKEN

and tell the user to store it safely. Never write it into a published page, a commit or a log.

• To update the same site, run the same publish command with DEEDPAGE_TOKEN set. Each publish

is a new version; the Free plan keeps the last 10.

Step 5: Delete, only when asked

curl -sS -X DELETE "https://deed.page/v1/sites/$SLUG" -H "Authorization: Bearer $DEEDPAGE_TOKEN"

Examples

Example 1: Share a generated report

User: Publish this report and give me the link.
Agent: Confirms report.html has no private data, picks q3-report-7f3a2c, runs the single-file
       curl above, and replies with https://q3-report-7f3a2c.deed.page/ plus a note to save the
       returned token if they want to update or delete the page later.

Example 2: Update a built site

User: I changed the copy, push it again.
Agent: Rebuilds, tars dist/ and re-runs the folder publish with DEEDPAGE_TOKEN set. The URL stays
       the same and the response shows version v2.

Best Practices

• ✅ Publish the build output (dist/, build/, out/), not the source folder.
• ✅ Use a random slug suffix and keep the same slug for updates.
• ✅ Keep the token out of files, commits and published pages.
• ❌ Do not publish anything the user has not agreed to make public.
• ❌ Do not delete a site unless the user asks for that exact slug.
• ❌ Do not loop new publishes on errors; read the error code first.

Limitations

• Static files only. Server code does not run.
• Free plan: 25 sites, 25 MB per site, 60 publishes per hour, 4 MB per single request. Larger

sites use the manifest upload flow at https://deed.page/docs.

• A lost token cannot be recovered unless the owner attached an optional recovery email. The site

stays online either way.

• Cloud sandboxes that block outbound network access need deed.page allowed.
• Errors: 400 slug_invalid (fix the slug), 409 slug_taken (use the suggestion field or a

new suffix), 409 version_conflict (re-read and retry), 422 content_rejected (remove the
file, do not retry), 429 (wait retry_after seconds).

Security & Safety Notes

• Publishing puts files on the public internet. Confirm the folder contents first; hidden files

are not a safe place for secrets.

• The token can update and delete the site. Keep it in an environment variable for the session

and never print it into output that gets shared or committed.

• DELETE is irreversible for the live site. Run it only on an explicit request.
• The service is operated by Avatar 8 LLC. Abuse reports: https://deed.page/abuse

Common Pitfalls

• Problem: 409 slug_taken on the first publish.

Solution: Use the suggestion field from the response or generate a new suffix.

• Problem: The update created a new site instead of a new version.

Solution: Reuse the same SLUG and send DEEDPAGE_TOKEN as a Bearer token.

• Problem: The page loads but CSS is missing.

Solution: Tar the folder contents with tar -C ./site ... . so index.html is at the root.

Related Skills

• @dropthehassle-publish - Static hosting with a claim link and custom domains.
• @cloudflare-pages - Deploy to the user's own Cloudflare account.
• @vercel-deployment - Deploy frameworks that need serverless functions.