desktop-commander@0.3.1
CAUTIONPublisher claims: "Search, update, manage files and run terminal commands with AI" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry Docker MCP CatalogPublisher wonderwhy-er · joined 1 days agoInstalls 240KLast detonated 2 h ago
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-26 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Pipe-to-shell pattern; npx invocation of non-well-known package. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.2sprocessscript backend runs setup only
0.2sprocessscript backend runs setup only
Static findings
CRITICAL
Pipe-to-shell patternREADME.md:122 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06CRITICAL
Pipe-to-shell patternscripts/remote/README.md:16 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06HIGH
npx invocation of non-well-known packageplugins/cursor/README.md:7 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Direct script execution from GitHub raw URLREADME.md:296 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06CRITICAL
Pipe-to-shell patternplugins/claude/skills/terminal/SKILL.md:112 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06CRITICAL
Privileged sudo commandsrc/command-manager.ts:225 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05CRITICAL
Pipe-to-shell patternscripts/remote/README.md:22 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06HIGH
File permission modification commandplugins/claude/skills/terminal/SKILL.md:184 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05HIGH
Auto-update or dynamic fetch configurationREADME.md:838 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Process kill commandplugins/cursor/skills/desktop-commander-overview/SKILL.md:28 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Process kill commandplugins/claude/skills/terminal/SKILL.md:16 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05CRITICAL
Pipe-to-shell patternskills/terminal/SKILL.md:112 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06CRITICAL
Pipe-to-shell patternskills/terminal/SKILL.md:166 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06HIGH
npx invocation of non-well-known packageREADME.md:114 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Access to sensitive file pathsplugins/claude/skills/ai-tools-setup/SKILL.md:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05CRITICAL
Pipe-to-shell patternplugins/cursor/skills/terminal/SKILL.md:112 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06HIGH
Direct script execution from GitHub raw URLREADME.md:122 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Direct script execution from GitHub raw URLREADME.md:279 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06CRITICAL
Pipe-to-shell patternplugins/claude/skills/terminal/SKILL.md:166 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06HIGH
npx invocation of non-well-known packageREADME.md:98 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packageplugins/claude/README.md:7 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06CRITICAL
Destructive file system command detectedplugins/cursor/skills/terminal/SKILL.md:158 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05CRITICAL
Destructive file system command detectedskills/terminal/SKILL.md:158 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05CRITICAL
Privileged sudo commandplugins/claude/skills/computer-health-check/SKILL.md:16 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Auto-update or dynamic fetch configurationREADME.md:301 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packageREADME.md:128 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06CRITICAL
Privileged sudo commandplugins/cursor/skills/computer-health-check/SKILL.md:16 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
File permission modification commandplugins/claude/skills/terminal/SKILL.md:164 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05HIGH
File permission modification commandpackage.json:39 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05HIGH
Process kill commandplugins/claude/skills/desktop-commander-overview/SKILL.md:28 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05CRITICAL
Pipe-to-shell patternplugins/cursor/skills/terminal/SKILL.md:166 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06HIGH
npx invocation of non-well-known packageREADME.md:94 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06CRITICAL
Destructive file system command detectedplugins/claude/skills/terminal/SKILL.md:158 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
npx invocation of non-well-known packageREADME.md:103 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Direct script execution from GitHub raw URLREADME.md:276 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Process kill commandREADME.md:53 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Access to sensitive file pathsplugins/cursor/skills/ai-tools-setup/SKILL.md:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Direct script execution from GitHub raw URLREADME.md:203 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Auto-update or dynamic fetch configurationREADME.md:81 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06CRITICAL
Privileged sudo commandskills/computer-health-check/SKILL.md:16 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
npx invocation of non-well-known packagesrc/remote-device/README.md:92 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
Remote installer piped to shellREADME.md:122 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07HIGH
File permission modification commandskills/terminal/SKILL.md:164 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05HIGH
File permission modification commandplugins/cursor/skills/terminal/SKILL.md:164 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
Remote installer piped to shellplugins/claude/skills/terminal/SKILL.md:112 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07HIGH
npx invocation of non-well-known packagescripts/remote/README.md:47 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Process kill commandsrc/terminal-manager.ts:201 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
npx invocation of non-well-known packagesrc/remote-device/README.md:121 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
File permission modification commandplugins/cursor/skills/terminal/SKILL.md:184 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05HIGH
Process kill commandskills/terminal/SKILL.md:16 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Process kill commandsrc/tools/schemas.ts:52 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Access to sensitive file pathsskills/ai-tools-setup/SKILL.md:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathssrc/server.ts:638 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
File type combined with upload actionplugins/claude/skills/desktop-commander-overview/SKILL.md:38 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07HIGH
Direct script execution from GitHub raw URLscripts/remote/README.md:22 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
File type combined with upload actionplugins/cursor/skills/desktop-commander-overview/SKILL.md:38 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07HIGH
npx invocation of non-well-known packagesrc/remote-device/README.md:18 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Process kill commandsrc/terminal-manager.ts:515 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05MEDIUM
Remote installer piped to shellplugins/cursor/skills/terminal/SKILL.md:112 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07HIGH
Direct script execution from GitHub raw URLscripts/remote/README.md:16 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packagesrc/remote-device/README.md:73 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Process kill commandsrc/terminal-manager.ts:297 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Process kill commandskills/desktop-commander-overview/SKILL.md:28 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Process kill commandsrc/tools/process.ts:94 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
File permission modification commandskills/terminal/SKILL.md:184 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
Remote installer piped to shellplugins/claude/skills/terminal/SKILL.md:166 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07HIGH
npx invocation of non-well-known packagesrc/remote-device/README.md:104 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Process kill commandplugins/cursor/skills/terminal/SKILL.md:16 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
File permission modification commandsrc/tools/filesystem.ts:94 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
Remote installer piped to shellscripts/remote/README.md:16 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07MEDIUM
Remote installer piped to shellskills/terminal/SKILL.md:166 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07MEDIUM
File type combined with upload actionskills/desktop-commander-overview/SKILL.md:38 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
File type combined with upload actionscripts/build-mcpb.cjs:204 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
File type combined with upload actionscripts/count-tokens.js:190 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
Remote installer piped to shellscripts/remote/README.md:22 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07MEDIUM
Remote installer piped to shellplugins/cursor/skills/terminal/SKILL.md:166 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07MEDIUM
File type combined with upload actionscripts/build-mcpb.cjs:192 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
Remote installer piped to shellskills/terminal/SKILL.md:112 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Privileged sudo command≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Destructive file system command detected≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Unclaimed publisher≈ +8 on the totalClaim wonderwhy-er: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- npx invocation of non-well-known package≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to Docker MCP Catalog, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim wonderwhy-er