Skills/Docker MCP Catalog/desktop-commander

desktop-commander@0.3.3

CAUTION· install only

Publisher claims: "Search, update, manage files and run terminal commands with AI" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Docker MCP CatalogPublisher wonderwhy-er · publishing for 674 daysInstalls 245KLast detonated 38 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
no vendor host named in the codeAlso tally.so, claude.ai, desktopcommander.app, run.app, openxmlformats.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
use of the skill by an agent

Connect it under the guard. Nothing executable in the bundle ran; the trace covers the install step only. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- docker run -i --rm mcp/desktop-commander

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 64/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Collapsed <details> block carrying instructions; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 1 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessscript backend runs setup only
0.2sprocessscript backend runs setup only
0.3sprocesssecond launch, clock +45 days, CI unset

Static findings

HIGH
Destructive file system command detectedplugins/claude/skills/terminal/SKILL.md:158 · Destructive file system command detected- Recursive/forced deletes: `rm -rf`, `Remove-Item -Recurse -Force`, `del /s`,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:215 · Collapsed <details> block carrying instructions<summary>Manual Docker Configuration</summary> **Basic setup (no file access):** ```json { "mcpServers": { "desktop-commander-in-docker": { "command": "docker",Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsplugins/claude/skills/ai-tools-setup/SKILL.md:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconfig or `.env` file* — never repeated back in chat. If a user pastes a liveFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
README links to a committed installerscripts/remote/README.md → remote-windows.cmdremote-windows.cmdFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Collapsed <details> block carrying instructionsREADME.md:146 · Collapsed <details> block carrying instructions<summary><b>Option 4: Add to claude_desktop_config manually ⭐ Auto-Updates (Requires Node.js)</b></summary> Add this entry to your claude_desktop_config.json: -Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsplugins/cursor/skills/ai-tools-setup/SKILL.md:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconfig or `.env` file* — never repeated back in chat. If a user pastes a liveFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:176 · Collapsed <details> block carrying instructions<summary><b>Option 5: Checkout locally ❌ Manual Updates (Requires Node.js)</b></summary> ```bash git clone https://github.com/wonderwhy-er/DesktopCommanderMCP.gFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Pipe-to-shell patternplugins/cursor/skills/terminal/SKILL.md:166 · Pipe-to-shell pattern — downloads and immediately executes remote code- Anything piping remote content into a shell (`curl ... | sh`).Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Pipe-to-shell patternplugins/claude/skills/terminal/SKILL.md:112 · Pipe-to-shell pattern — downloads and immediately executes remote code(`curl ... | sh`) — that's untrusted code execution; show it and confirm first.Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Destructive file system command detectedplugins/cursor/skills/terminal/SKILL.md:158 · Destructive file system command detected- Recursive/forced deletes: `rm -rf`, `Remove-Item -Recurse -Force`, `del /s`,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Pipe-to-shell patternplugins/claude/skills/terminal/SKILL.md:166 · Pipe-to-shell pattern — downloads and immediately executes remote code- Anything piping remote content into a shell (`curl ... | sh`).Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Pipe-to-shell patternplugins/cursor/skills/terminal/SKILL.md:112 · Pipe-to-shell pattern — downloads and immediately executes remote code(`curl ... | sh`) — that's untrusted code execution; show it and confirm first.Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Image alt text carrying instructionsREADME.md:1076 · Image alt text carrying instructionsIt's a life saver! I paid Claude + Cursor currently which I always feel it's kind of duplicated. This solves the problem ultimately. I am so happy. Thanks so muFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Privileged sudo commandplugins/claude/skills/computer-health-check/SKILL.md:16 · Privileged sudo command — agent may execute with elevated privilegesdefault — it never needs sudo and only performs cleanups the user explicitly approves.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:93 · Collapsed <details> block carrying instructions<summary><b>Option 1: Install through npx ⭐ Auto-Updates (Requires Node.js)</b></summary> Just run this in terminal: ``` npx @wonderwhy-er/desktop-commander@latFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Image alt text carrying instructionsREADME.md:1084 · Image alt text carrying instructionsGreat! I just used Windsurf, bought license a week ago, for upgrading old fullstack socket project and it works many times good or ok but also many times runs aFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Privileged sudo commandplugins/cursor/skills/computer-health-check/SKILL.md:16 · Privileged sudo command — agent may execute with elevated privilegesdefault — it never needs sudo and only performs cleanups the user explicitly approves.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:118 · Collapsed <details> block carrying instructions<summary><b>Option 2: Using bash script installer (macOS) ⭐ Auto-Updates (Installs Node.js if needed)</b></summary> ``` curl -fsSL https://raw.githubusercontentFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Remote installer piped to shellskills/terminal/SKILL.md:166 · Remote installer piped to shell- Anything piping remote content into a shell (`curl ... | sh`).Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File type combined with upload actionplugins/cursor/skills/desktop-commander-overview/SKILL.md:38 · File type combined with upload action — agent may exfiltrate local data files…SSH session and returns a PID. `interact_with_process(pid, "tail -f /var/log/app.log\n")` starts streaming logs. Subsequent turns: `read_process_output(pid, offset=-50)` to see the last 50 lines as they arrive, `interact_with_proce…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsskills/ai-tools-setup/SKILL.md:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconfig or `.env` file* — never repeated back in chat. If a user pastes a liveFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellplugins/cursor/skills/terminal/SKILL.md:112 · Remote installer piped to shell(`curl ... | sh`) — that's untrusted code execution; show it and confirm first.Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandplugins/claude/skills/terminal/SKILL.md:184 · File permission modification command — agent changes file ownership/permissionsfor safety, comments explaining each step; make it executable (`chmod +x`).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actionscripts/build-mcpb.cjs:191 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`📁 Bundle location: ${outputFile}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Pipe-to-shell patternskills/terminal/SKILL.md:112 · Pipe-to-shell pattern — downloads and immediately executes remote code(`curl ... | sh`) — that's untrusted code execution; show it and confirm first.Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File type combined with upload actionplugins/claude/skills/desktop-commander-overview/SKILL.md:38 · File type combined with upload action — agent may exfiltrate local data files…SSH session and returns a PID. `interact_with_process(pid, "tail -f /var/log/app.log\n")` starts streaming logs. Subsequent turns: `read_process_output(pid, offset=-50)` to see the last 50 lines as they arrive, `interact_with_proce…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandplugins/cursor/skills/desktop-commander-overview/SKILL.md:28 · Process kill command — agent can terminate processes…thout reconnecting each step. **Process management.** List, inspect, tail, and kill accessible processes (subject to OS permissions). Useful for cleaning up stale d…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandskills/computer-health-check/SKILL.md:16 · Privileged sudo command — agent may execute with elevated privilegesdefault — it never needs sudo and only performs cleanups the user explicitly approves.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionscripts/count-tokens.js:190 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(JSON.stringify(output, null, 2));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Remote installer piped to shellplugins/claude/skills/terminal/SKILL.md:166 · Remote installer piped to shell- Anything piping remote content into a shell (`curl ... | sh`).Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Remote installer piped to shellplugins/claude/skills/terminal/SKILL.md:112 · Remote installer piped to shell(`curl ... | sh`) — that's untrusted code execution; show it and confirm first.Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Remote installer piped to shellskills/terminal/SKILL.md:112 · Remote installer piped to shell(`curl ... | sh`) — that's untrusted code execution; show it and confirm first.Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Remote installer piped to shellplugins/cursor/skills/terminal/SKILL.md:166 · Remote installer piped to shell- Anything piping remote content into a shell (`curl ... | sh`).Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Access to sensitive file pathssrc/server.ts:638 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- Looking for configuration/setup files: ".env", "dockerfile", "tsconfig.json"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)package.json:73 · MCP server using network transport (SSE/HTTP) — data sent over network"device:start:local": "npm run build && DC_ENV=development MCP_SERVER_URL=http://mcp.localhost:3007 npm run device:start:dev"Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Privileged sudo commandsrc/command-manager.ts:260 · Privileged sudo command — agent may execute with elevated privileges// strip path prefix so /usr/bin/sudo gets caught as "sudo"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandplugins/cursor/skills/terminal/SKILL.md:184 · File permission modification command — agent changes file ownership/permissionsfor safety, comments explaining each step; make it executable (`chmod +x`).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Pipe-to-shell patternskills/terminal/SKILL.md:166 · Pipe-to-shell pattern — downloads and immediately executes remote code- Anything piping remote content into a shell (`curl ... | sh`).Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Process kill commandplugins/claude/skills/desktop-commander-overview/SKILL.md:28 · Process kill command — agent can terminate processes…thout reconnecting each step. **Process management.** List, inspect, tail, and kill accessible processes (subject to OS permissions). Useful for cleaning up stale d…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandplugins/cursor/skills/terminal/SKILL.md:16 · Process kill command — agent can terminate processeson intents like "what's using port 3000", "kill that process", "ssh into myFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandplugins/cursor/skills/terminal/SKILL.md:164 · File permission modification command — agent changes file ownership/permissions- `chmod -R` / `chown -R` on broad paths, `killall`, mass process kills.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandskills/desktop-commander-overview/SKILL.md:28 · Process kill command — agent can terminate processes…thout reconnecting each step. **Process management.** List, inspect, tail, and kill accessible processes (subject to OS permissions). Useful for cleaning up stale d…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandplugins/claude/skills/terminal/SKILL.md:16 · Process kill command — agent can terminate processeson intents like "what's using port 3000", "kill that process", "ssh into myFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandsrc/utils/shell.ts:209 · Privileged sudo command — agent may execute with elevated privileges* WSL_DISTRO_NAME for what it starts. What runs without it, through sudoFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandplugins/claude/skills/terminal/SKILL.md:164 · File permission modification command — agent changes file ownership/permissions- `chmod -R` / `chown -R` on broad paths, `killall`, mass process kills.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandpackage.json:38 · File permission modification command — agent changes file ownership/permissions…-claude-server.js uninstall-claude-server.js track-installation.js dist/ && shx chmod +x dist/*.js && shx mkdir -p dist/data && shx cp src/data/onboarding-prompts.jso…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actionskills/desktop-commander-overview/SKILL.md:38 · File type combined with upload action — agent may exfiltrate local data files…SSH session and returns a PID. `interact_with_process(pid, "tail -f /var/log/app.log\n")` starts streaming logs. Subsequent turns: `read_process_output(pid, offset=-50)` to see the last 50 lines as they arrive, `interact_with_proce…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Destructive file system command detectedskills/terminal/SKILL.md:158 · Destructive file system command detected- Recursive/forced deletes: `rm -rf`, `Remove-Item -Recurse -Force`, `del /s`,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionscripts/build-mcpb.cjs:203 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`2. Select the file: ${outputFile}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandsrc/tools/process.ts:100 · Process kill command — agent can terminate processescontent: [{ type: "text", text: `Error: Failed to kill process: ${error instanceof Error ? error.message : String(error)}` }],Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandskills/terminal/SKILL.md:164 · File permission modification command — agent changes file ownership/permissions- `chmod -R` / `chown -R` on broad paths, `killall`, mass process kills.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandsrc/terminal-manager.ts:199 · Process kill command — agent can terminate processes// on Windows — used to kill the entire MCP server one tick AFTER thisFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/terminal-manager.ts:295 · Process kill command — agent can terminate processes// has exited: Node also emits 'error' when a kill fails or a message can'tFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/tools/schemas.ts:52 · Process kill command — agent can terminate processes// process.kill reads 0 and negative PIDs as process groups: 0 is the server'sFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandskills/terminal/SKILL.md:184 · File permission modification command — agent changes file ownership/permissionsfor safety, comments explaining each step; make it executable (`chmod +x`).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandskills/terminal/SKILL.md:16 · Process kill command — agent can terminate processeson intents like "what's using port 3000", "kill that process", "ssh into myFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiontest/README.md:61 · File type combined with upload action — agent may exfiltrate local data files| `junit.xml` | JUnit XML: a testcase per file; a failed file's last output lines in its `<failure>`; a skipped testcase per skipped check; the tests of `node:test` files |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandsrc/terminal-manager.ts:513 · Process kill command — agent can terminate processes// can never throw "Invalid string length" and kill the server.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandsrc/tools/filesystem.ts:94 · File permission modification command — agent changes file ownership/permissions` 4. File has restricted permissions (e.g. system file, locked by another process, or chmod 000).`,Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actiontest/README.md:62 · File type combined with upload action — agent may exfiltrate local data files| `results.json` | the same as JSON: each file's result, exit code, time, skipped checks and, on a failure, its last output lines; and the tests `test/excluded.txt` left out, with their reasons |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiontest/README.md:146 · File type combined with upload action — agent may exfiltrate local data files…ults/review/` unless `--out` names another one. It contains `review.md`, `review.json`, `diff.patch`, `answer.json` and a redacted `session.jsonl`. Missing credentials or an incomplete API response fail the review. The broker reads only th…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈41,090 tok
18 files · 80 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

16 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. README links to a committed installer≈ +9 on the totalPin versions and sources; vendor anything fetched at install time.
  2. Unclaimed publisher≈ +8 on the totalClaim wonderwhy-er: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Pipe-to-shell pattern≈ +4 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to Docker MCP Catalog, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim wonderwhy-erPropose a patch to the maintainer