# Framejs Origins

> >

- **Type:** Skill
- **Install:** `agentstack add skill-metapages-framejs-io-framejs-origins`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [metapages](https://agentstack.voostack.com/s/metapages)
- **Installs:** 0
- **Category:** [Data & Analytics](https://agentstack.voostack.com/c/data-and-analytics)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [metapages](https://github.com/metapages)
- **Source:** https://github.com/metapages/framejs.io/tree/main/.claude/skills/framejs-origins
- **Website:** https://framejs.io/docs

## Install

```sh
agentstack add skill-metapages-framejs-io-framejs-origins
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# framejs.io / framejs.app origin map

This repo (`metaframe-js`) serves **framejs.io** — the public rendering
runtime (uploads, screenshots, the metaframe that actually executes user
code). Docker Compose + Traefik stack (`worker/`).

Its sibling, `framejs-nhost`, at
`/Users/dion/dev/git/metapages/framejs-nhost`, serves **framejs.app** — the
account layer: auth, frame storage, Hasura/nhost backend (`api/`) + Deno Fresh
worker (`frontend/worker/`).

| App         | Repo (this machine)                             | Production            | Local dev                            |
| ----------- | ------------------------------------------------- | ---------------------- | ------------------------------------- |
| framejs.io  | `metaframe-js` (here)                              | `https://framejs.io`   | `https://framejs-io.localhost:4470`   |
| framejs.app | `framejs-nhost` (`.../framejs-nhost`)              | `https://framejs.app`  | `https://framejs-app.localhost:5173`  |

**Source of truth, don't hardcode:** local ports/hosts can drift from the table
above. Check this repo's `.env` (`FRAMEJS_APP_ORIGIN`) for what it currently
points at for framejs.app, and the sibling repo's `frontend/worker/.env`
(`FRAMEJS_IO_ORIGIN`) for what it points at here. Both vars are read live by
the `framejs` Agent Skill helper
(`worker/static/skill/framejs/scripts/framejs.mjs`) — see
`worker/static/skill/README.md` for the canonical table and the skill-dev
workflow that consumes it.

Run both stacks locally:
- framejs.io (here): `just dev` → `https://framejs-io.localhost:4470`
- framejs.app (sibling): `cd .../framejs-nhost/api && just dev` (nhost stack),
  then `cd frontend/worker && just dev` → `https://framejs-app.localhost:5173`

Both bind dedicated `*.localhost` hosts (never bare `localhost`) over HTTPS via
mkcert, so the two apps' cookies/sessions don't collide. If a host doesn't
resolve, see that repo's `_hostcheck` justfile recipe.

For the mirror of this file, see
`framejs-nhost/.claude/skills/framejs-origins/SKILL.md`.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [metapages](https://github.com/metapages)
- **Source:** [metapages/framejs.io](https://github.com/metapages/framejs.io)
- **License:** MIT
- **Homepage:** https://framejs.io/docs

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-metapages-framejs-io-framejs-origins
- Seller: https://agentstack.voostack.com/s/metapages
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.