buildkite@r1

CAUTION

Publisher claims: "Buildkite MCP lets agents interact with Buildkite Builds, Jobs, Logs, Packages and Test Suites" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Docker MCP CatalogPublisher buildkite · joined 0 days agoInstalls 13,476Last detonated 1 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

0.1sprocessscript backend runs setup only

Static findings

CRITICAL

Destructive file system command detectedevals/Dockerfile:33 · Destructive file system command detected

AST05

CRITICAL

Destructive file system command detectedevals/Dockerfile:38 · Destructive file system command detected

AST05

CRITICAL

Fake instruction boundary tagevals/evals.yaml:64 · Fake instruction boundary tag

AST01

CRITICAL

Pipe-to-shell patternevals/scripts/babystand.sh:446 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Access to sensitive file pathsevals/scripts/babystand.sh:455 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/babystand.sh:456 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Pipe-to-shell patternevals/Dockerfile:36 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Fake instruction boundary tagevals/evals.yaml:41 · Fake instruction boundary tag

AST01

CRITICAL

Access to sensitive file pathsevals/scripts/bk-request-log-shim.mjs:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Pipe-to-shell patternevals/Dockerfile:101 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Fake instruction boundary tagevals/README.md:194 · Fake instruction boundary tag

AST01

CRITICAL

Fake instruction boundary tagevals/evals.yaml:36 · Fake instruction boundary tag

AST01

CRITICAL

Fake instruction boundary tagevals/prompts/klaren.md:52 · Fake instruction boundary tag

AST01

CRITICAL

Access to sensitive file pathsevals/scripts/bk-request-log-shim.mjs:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/test_bk_request_log.py:82 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/parser.ts:90 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Pipe-to-shell patternevals/scripts/cursor.sh:48 · Pipe-to-shell pattern — downloads and immediately executes remote code

AST06

CRITICAL

Access to sensitive file pathsevals/scripts/parser.ts:188 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/bk-request-log-shim.mjs:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/bk-request-log-shim.mjs:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/test_bk_request_log.py:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/cursor.sh:147 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/bk-request-log-shim.mjs:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/cursor.sh:148 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/test_bk_request_log.py:81 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

File permission modification commandevals/Dockerfile:48 · File permission modification command — agent changes file ownership/permissions

AST05

CRITICAL

Destructive file system command detectedpkg/buildkite/joblogs.go:67 · Destructive file system command detected

AST05

HIGH

Outbound HTTP to raw IP addressevals/scripts/bk-request-log-shim.mjs:285 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

File permission modification commandevals/Dockerfile:91 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandevals/scripts/claude.sh:28 · File permission modification command — agent changes file ownership/permissions

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/test_yilong.py:319 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

File permission modification commandevals/Dockerfile:44 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandevals/scripts/babystand.sh:328 · File permission modification command — agent changes file ownership/permissions

AST05

HIGH

File permission modification commandevals/scripts/babystand.sh:262 · File permission modification command — agent changes file ownership/permissions

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/test_klaren.py:141 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/test_klaren.py:81 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/test_yilong.py:102 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/test_yilong.py:108 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

File permission modification commandevals/scripts/cursor.sh:41 · File permission modification command — agent changes file ownership/permissions

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/test_klaren.py:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Privileged sudo commandevals/scripts/test_tool_audit.py:53 · Privileged sudo command — agent may execute with elevated privileges

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/test_bk_request_log.py:88 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/test_klaren.py:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/test_klaren.py:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

File permission modification commandevals/scripts/babystand.sh:316 · File permission modification command — agent changes file ownership/permissions

AST05

CRITICAL

Access to sensitive file pathsevals/scripts/test_yilong.py:121 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Python subprocess execution detectedevals/scripts/test_api_fanout.py:66 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedevals/scripts/test_bk_request_log.py:134 · Python subprocess execution detected

AST05

HIGH

Outbound HTTP to raw IP addressevals/scripts/test_bk_request_log.py:117 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Python subprocess execution detectedevals/scripts/test_api_fanout.py:35 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedevals/scripts/test_cli_token.py:48 · Python subprocess execution detected

AST05

HIGH

Outbound HTTP to raw IP addressevals/scripts/test_bk_request_log.py:151 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Python subprocess execution detectedevals/scripts/test_bk_request_log.py:129 · Python subprocess execution detected

AST05

HIGH

Outbound HTTP to raw IP addressevals/scripts/test_bk_request_log.py:127 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Python subprocess execution detectedevals/scripts/test_yilong.py:107 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedevals/scripts/test_api_fanout.py:90 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedevals/scripts/test_tool_audit.py:96 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedevals/scripts/test_klaren.py:216 · Python subprocess execution detected

AST05

HIGH

Outbound HTTP to raw IP addressevals/scripts/test_bk_request_log.py:160 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Python subprocess execution detectedevals/scripts/test_api_fanout.py:82 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedevals/scripts/test_tool_audit.py:72 · Python subprocess execution detected

AST05

HIGH

URL with embedded credentialsevals/scripts/test_bk_request_log.py:199 · URL with embedded credentials — may be phishing or credential leaking

AST07

HIGH

Python subprocess execution detectedevals/scripts/test_klaren.py:80 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedevals/scripts/test_bk_request_log.py:142 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedevals/scripts/test_klaren.py:66 · Python subprocess execution detected

AST05

HIGH

Outbound HTTP to raw IP addressevals/scripts/test_bk_request_log.py:168 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Python subprocess execution detectedevals/scripts/test_yilong.py:120 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedevals/scripts/test_klaren.py:308 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedevals/scripts/test_yilong.py:359 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedevals/scripts/test_bk_request_log.py:103 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedevals/scripts/test_yilong.py:423 · Python subprocess execution detected

AST05

HIGH

Outbound HTTP to raw IP addressevals/scripts/test_yilong.py:103 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:108 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

HIGH

Hidden zero-width characters detectedevals/scripts/yilong.sh:380 · Hidden zero-width characters detected — may conceal content

AST07

HIGH

Hidden zero-width characters detectedevals/scripts/yilong.sh:347 · Hidden zero-width characters detected — may conceal content

AST07

MEDIUM

Remote installer piped to shellevals/Dockerfile:36 · Remote installer piped to shell

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:98 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

Remote installer piped to shellevals/scripts/babystand.sh:446 · Remote installer piped to shell

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)README.md:7 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

File type combined with upload actionevals/README.md:101 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

Remote installer piped to shellevals/Dockerfile:101 · Remote installer piped to shell

AST07

HIGH

Outbound HTTP to raw IP addressevals/scripts/test_yilong.py:104 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Python subprocess execution detectedevals/scripts/test_yilong.py:416 · Python subprocess execution detected

AST05

MEDIUM

URL using raw IP addressevals/scripts/bk-request-log-shim.mjs:285 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

File type combined with upload actionevals/scripts/parser.ts:682 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actionevals/scripts/parser.ts:681 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actionevals/scripts/parser.ts:686 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actionevals/scripts/parser.ts:683 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

Remote installer piped to shellevals/scripts/cursor.sh:48 · Remote installer piped to shell

AST07

MEDIUM

URL using raw IP addressevals/scripts/test_bk_request_log.py:127 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressevals/scripts/test_bk_request_log.py:168 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressevals/scripts/test_bk_request_log.py:117 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressevals/scripts/test_bk_request_log.py:160 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressevals/scripts/test_yilong.py:103 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

URL using raw IP addressevals/scripts/test_bk_request_log.py:151 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

File type combined with upload actionevals/scripts/test_yilong.py:39 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

URL using raw IP addressevals/scripts/test_yilong.py:104 · URL using raw IP address — may bypass domain-based filtering

AST07