Skills/Docker MCP Catalog/buildkite

buildkite@r5

CAUTION

Publisher claims: "Buildkite MCP lets agents interact with Buildkite Builds, Jobs, Logs, Packages and Test Suites" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Docker MCP CatalogPublisher buildkite · joined 12 days agoInstalls 13,630Last detonated 1 h ago
What would fix thisWatchDispute verdict

Is buildkite@r5 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-06 and scored it 65/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Fake instruction boundary tag; Destructive file system command detected; Hidden zero-width characters detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

CRITICAL
Fake instruction boundary tagevals/prompts/klaren.md:52 · Fake instruction boundary tagFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST01
HIGH
Destructive file system command detectedpkg/buildkite/joblogs.go:67 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellevals/Dockerfile:101 · Remote installer piped to shellFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hidden zero-width characters detectedevals/scripts/yilong.sh:380 · Hidden zero-width characters detected — may conceal contentFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File permission modification commandevals/Dockerfile:91 · File permission modification command — agent changes file ownership/permissionsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Pipe-to-shell patternevals/Dockerfile:36 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST06
MEDIUM
Remote installer piped to shellevals/Dockerfile:36 · Remote installer piped to shellFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hidden zero-width characters detectedevals/scripts/yilong.sh:347 · Hidden zero-width characters detected — may conceal contentFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
CRITICAL
Pipe-to-shell patternevals/scripts/babystand.sh:446 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST06
MEDIUM
File permission modification commandevals/Dockerfile:48 · File permission modification command — agent changes file ownership/permissionsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
CRITICAL
Pipe-to-shell patternevals/scripts/cursor.sh:48 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST06
MEDIUM
Destructive file system command detectedevals/Dockerfile:38 · Destructive file system command detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
HIGH
Outbound HTTP to raw IP addressevals/scripts/bk-request-log-shim.mjs:285 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Destructive file system command detectedevals/Dockerfile:33 · Destructive file system command detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
File permission modification commandevals/Dockerfile:44 · File permission modification command — agent changes file ownership/permissionsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedevals/scripts/test_tool_audit.py:96 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Outbound HTTP to raw IP addressevals/scripts/test_bk_request_log.py:160 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedevals/scripts/test_klaren.py:66 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedevals/scripts/test_klaren.py:80 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedevals/scripts/test_yilong.py:107 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedevals/scripts/test_klaren.py:308 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedevals/scripts/test_yilong.py:120 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
File type combined with upload actionevals/scripts/parser.ts:682 · File type combined with upload action — agent may exfiltrate local data filesFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedevals/scripts/test_bk_request_log.py:103 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedevals/scripts/test_bk_request_log.py:129 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
File type combined with upload actionevals/scripts/parser.ts:681 · File type combined with upload action — agent may exfiltrate local data filesFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
URL using raw IP addressevals/scripts/test_bk_request_log.py:168 · URL using raw IP address — may bypass domain-based filteringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
URL with embedded credentialsevals/scripts/test_bk_request_log.py:199 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Outbound HTTP to raw IP addressevals/scripts/test_bk_request_log.py:127 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File permission modification commandevals/scripts/babystand.sh:316 · File permission modification command — agent changes file ownership/permissionsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
File permission modification commandevals/scripts/babystand.sh:328 · File permission modification command — agent changes file ownership/permissionsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
File type combined with upload actionevals/scripts/parser.ts:683 · File type combined with upload action — agent may exfiltrate local data filesFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Outbound HTTP to raw IP addressevals/scripts/test_bk_request_log.py:151 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedevals/scripts/test_bk_request_log.py:134 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
File permission modification commandevals/scripts/babystand.sh:262 · File permission modification command — agent changes file ownership/permissionsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedevals/scripts/test_api_fanout.py:82 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
URL using raw IP addressevals/scripts/bk-request-log-shim.mjs:285 · URL using raw IP address — may bypass domain-based filteringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File permission modification commandevals/scripts/claude.sh:28 · File permission modification command — agent changes file ownership/permissionsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Remote installer piped to shellevals/scripts/cursor.sh:48 · Remote installer piped to shellFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Pipe-to-shell patternevals/Dockerfile:101 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST06
MEDIUM
Python subprocess execution detectedevals/scripts/test_yilong.py:416 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Outbound HTTP to raw IP addressevals/scripts/test_bk_request_log.py:117 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
URL using raw IP addressevals/scripts/test_bk_request_log.py:117 · URL using raw IP address — may bypass domain-based filteringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedevals/scripts/test_bk_request_log.py:142 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
File type combined with upload actionevals/scripts/parser.ts:686 · File type combined with upload action — agent may exfiltrate local data filesFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedevals/scripts/test_klaren.py:216 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedevals/scripts/test_yilong.py:359 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Privileged sudo commandevals/scripts/test_tool_audit.py:53 · Privileged sudo command — agent may execute with elevated privilegesFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedevals/scripts/test_yilong.py:423 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedevals/scripts/test_tool_audit.py:72 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Outbound HTTP to raw IP addressevals/scripts/test_bk_request_log.py:168 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedevals/scripts/test_cli_token.py:48 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
File permission modification commandevals/scripts/cursor.sh:41 · File permission modification command — agent changes file ownership/permissionsFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Python subprocess execution detectedevals/scripts/test_api_fanout.py:90 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
URL using raw IP addressevals/scripts/test_bk_request_log.py:127 · URL using raw IP address — may bypass domain-based filteringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
URL using raw IP addressevals/scripts/test_bk_request_log.py:160 · URL using raw IP address — may bypass domain-based filteringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedevals/scripts/test_api_fanout.py:66 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Remote installer piped to shellevals/scripts/babystand.sh:446 · Remote installer piped to shellFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
URL using raw IP addressevals/scripts/test_bk_request_log.py:151 · URL using raw IP address — may bypass domain-based filteringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedevals/scripts/test_api_fanout.py:35 · Python subprocess execution detectedFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
LOW
Fake instruction boundary tagevals/evals.yaml:41 · Fake instruction boundary tag · informational: not an instruction fileFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST01
LOW
Fake instruction boundary tagevals/README.md:194 · Fake instruction boundary tag · informational: not an instruction fileFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST01
MEDIUM
Outbound HTTP to raw IP addressevals/scripts/test_yilong.py:104 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
LOW
Fake instruction boundary tagevals/evals.yaml:64 · Fake instruction boundary tag · informational: not an instruction fileFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST01
MEDIUM
Outbound HTTP to raw IP addressevals/scripts/test_yilong.py:103 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionevals/scripts/test_yilong.py:39 · File type combined with upload action — agent may exfiltrate local data filesFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
LOW
Fake instruction boundary tagevals/evals.yaml:36 · Fake instruction boundary tag · informational: not an instruction fileFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST01
MEDIUM
URL using raw IP addressevals/scripts/test_yilong.py:104 · URL using raw IP address — may bypass domain-based filteringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
URL using raw IP addressevals/scripts/test_yilong.py:103 · URL using raw IP address — may bypass domain-based filteringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

Cost to the agent

Instructions loaded
≈1,413 tok
3 files · 79 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

15 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim buildkite: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Hidden zero-width characters detected≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  4. Outbound HTTP to raw IP address≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  5. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  6. Remote installer piped to shell≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to Docker MCP Catalog, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim buildkitePropose a patch to the maintainer