mc-server-plugin-security@0.1.5
VERIFIED· install onlyPublisher claims: "我的世界（Minecraft）服务器插件安全经验库。记录已验证有效的加固做法（经验）和踩过的安全坑（漏洞原理+判定+解法），全部脱敏。涉及 AuthMe 登录插件、Bukkit/Spigot/Paper/Leaf/Folia/Arclight/NeoForge 插件安全、登录绕过、session 劫持、ForceOp、插件消息伪造、权限漏洞、0day 排查、jar 静态检查、插件版本比对与升级时使用；搭建或维护 MC 服务器前先查看，避免重蹈覆辙。触发词：AuthMe、登录插件、MC 插件安全、ForceOp、session 劫持、插件 0day、绕登录、Bukkit、Paper、Leaf、插件升级、jar 检查。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 92/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
**应对**：偶发十几条 → 直接忽略；持续刷屏提到某个坐标 → 去该坐标看是否有自动化掉落回收装置，`kill @e[type=item,distance=..30]` 清场。优先级低于 1.6/1.7。Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.No other findings across 467 lines in 4 files.
Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.