tapo@0.6.0

CAUTION

Publisher claims: "Control TP-Link Tapo smart home devices (lights, plugs, power strips, hubs and their child devices, cameras) via [Tapo MCP](https://github.com/mihai-dinculescu/tapo/tree/main/tapo-mcp)." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher mihai-dinculescu · joined 0 days agoInstalls 2,182Last detonated 1 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

HIGH

npx invocation of non-well-known packagereferences/setup.md:38 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:57 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:47 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/setup.md:64 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/setup.md:17 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Destructive file system command detectedreferences/tapo-mcp-setup.md:82 · Destructive file system command detected

AST05

HIGH

npx invocation of non-well-known packageSKILL.md:34 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/setup.md:58 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:26 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packageSKILL.md:17 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/setup.md:55 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

File permission modification commandreferences/setup.md:32 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

Outbound HTTP to raw IP addressreferences/setup.md:10 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addressreferences/tapo-mcp-setup.md:176 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressreferences/tapo-mcp-setup.md:189 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addressreferences/tapo-mcp-setup.md:181 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/tapo-mcp-setup.md:194 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressreferences/tapo-mcp-setup.md:189 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressreferences/tapo-mcp-setup.md:194 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Outbound HTTP to raw IP addressreferences/tapo-mcp-setup.md:176 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

URL using raw IP addressreferences/setup.md:10 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressreferences/tapo-mcp-setup.md:181 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07