Skills/Docker MCP Catalog/ramparts

ramparts@r1

CAUTION

Publisher claims: "A comprehensive security scanner for MCP servers with YARA rules and static analysis capabilities." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry Docker MCP CatalogPublisher getjavelin · joined 0 days agoInstalls 35,607Last detonated 2 h ago
What would fix thisWatchDispute verdict

Is ramparts@r1 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-26 and scored it 59/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Prompt injection; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
Privileged sudo command.github/workflows/pr-check.yml:45 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Privileged sudo command.github/workflows/pr-check.yml:46 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Privileged sudo command.github/workflows/release.yml:152 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Privileged sudo command.github/workflows/pr-check.yml:129 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Privileged sudo command.github/workflows/release-k8s.yml:66 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell pattern.cursor/rules/mcp.json:6 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Privileged sudo command.github/workflows/pr-check.yml:128 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Privileged sudo command.github/workflows/pr-check.yml:208 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandMakefile:471 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Prompt injectionconfig.yaml:32 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Pipe-to-shell patterntests/corpus/malicious.json:137 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Destructive file system command detectedsrc/config.rs:1431 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Reads credential paths from the home directorytests/fixtures/agentskills/my-skill/scripts/exfil.py:20 · Reads credential paths from the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
CRITICAL
Pipe-to-shell patternsrc/normalize.rs:236 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Prompt injection attempttests/corpus/malicious.json:217 · Prompt injection attempt — 'ignore previous instructions'Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injectiondocs/security-features.md:123 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Privileged sudo command.github/workflows/release.yml:286 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Prompt injectiondocs/security-features.md:127 · Prompt injection — explicit attempt to bypass safety measuresFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injectiondocs/configuration.md:403 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Process kill command.github/workflows/e2e.yml:70 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Prompt injectiondocs/security-features.md:380 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Prompt injection attempttests/corpus/malicious.json:25 · Prompt injection attempt — 'ignore previous instructions'Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Destructive file system command detectedtests/corpus/malicious.json:101 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandMakefile:459 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternsrc/normalize.rs:232 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Reads credential paths from the home directorytests/corpus/malicious.json:274 · Reads credential paths from the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Process kill commandMakefile:462 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Privileged sudo command.github/workflows/release.yml:153 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Reads credential paths from the home directorytests/corpus/malicious.json:7 · Reads credential paths from the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
CRITICAL
Prompt injectiondocs/security-features.md:382 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Process kill command.github/workflows/e2e.yml:84 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Reads credential paths from the home directorytests/fixtures/agentskills/my-skill/scripts/exfil.py:17 · Reads credential paths from the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Privileged sudo commandMakefile:357 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedMakefile:581 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill command.github/workflows/e2e.yml:82 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Prompt injectiondocs/configuration.md:71 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Prompt injectiontests/corpus/malicious.json:25 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Privileged sudo command.github/workflows/release.yml:285 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandMakefile:356 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill command.github/workflows/e2e.yml:74 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedsrc/normalize.rs:244 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Prompt injection attempttests/corpus/malicious.json:246 · Prompt injection attempt — 'ignore previous instructions'Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Prompt injectiontests/corpus/malicious.json:213 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injectiondocs/configuration.md:202 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injectiondocs/cli.md:326 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Process kill command.github/workflows/e2e.yml:81 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Prompt injectiondocs/configuration.md:216 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injectiondocs/security-features.md:125 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Destructive file system command detectedsrc/main.rs:317 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/osv.rs:44 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
AWS access key pattern detectedtests/corpus/malicious.json:147 · AWS access key pattern detected — possible hardcoded or harvested keyFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathstests/fixtures/agentskills/my-skill/references/api.md:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/deployed_entrypoint.rs:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/skills.rs:3137 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Outbound HTTP to raw IP addresstests/deployed_entrypoint.rs:45 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathssrc/skills.rs:1234 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Outbound HTTP to raw IP addresssrc/server.rs:900 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
References a credential file in the home directorysrc/skills.rs:3108 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Outbound HTTP to raw IP addresssrc/server.rs:907 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Hidden zero-width characters detectedtests/corpus/malicious.json:253 · Hidden zero-width characters detected — may conceal contentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
npx invocation of non-well-known packagesrc/mcp_client.rs:400 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/deployed_entrypoint.rs:140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
References a credential file in the home directorytests/corpus/malicious.json:7 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
References a credential file in the home directorytests/fixtures/agentskills/my-skill/references/api.md:18 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Access to sensitive file pathstests/corpus/malicious.json:208 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/deployed_entrypoint.rs:139 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Outbound HTTP to raw IP addresssrc/config.rs:2665 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandMakefile:468 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/corpus/malicious.json:198 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Instructs the agent to modify its persistent memory or instruction filessrc/skills.rs:2578 · Instructs the agent to modify its persistent memory or instruction filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
References a credential file in the home directorytests/corpus/malicious.json:274 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Access to sensitive file pathstests/deployed_entrypoint.rs:84 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/skills.rs:3108 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandMakefile:469 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/scanner.rs:1633 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Outbound HTTP to raw IP addresssrc/config.rs:2661 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
References a credential file in the home directorytests/fixtures/agentskills/my-skill/scripts/exfil.py:17 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathssrc/skills.rs:2410 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Outbound HTTP to raw IP addresssrc/server.rs:906 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addresssrc/server.rs:349 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
GitHub token pattern detectedtests/corpus/malicious.json:177 · GitHub token pattern detected — possible hardcoded or harvested tokenFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
References a credential file in the home directorytests/fixtures/agentskills/my-skill/references/api.md:12 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Access to sensitive file pathstests/corpus/malicious.json:274 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Outbound HTTP to raw IP addresstests/deployed_entrypoint.rs:163 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/corpus/malicious.json:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/skills.rs:1231 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/corpus/malicious.json:192 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Authorization escalation languagetests/corpus/malicious.json:25 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Discord webhook URLtests/corpus/malicious.json:274 · Discord webhook URL — data will be sent to DiscordFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Outbound HTTP to raw IP addresssrc/server.rs:903 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/fixtures/agentskills/my-skill/references/api.md:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL using raw IP addresssrc/config.rs:2661 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
References a credential file in the home directorytests/fixtures/agentskills/my-skill/scripts/exfil.py:20 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Remote installer piped to shell.cursor/rules/mcp.json:6 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
AWS access key pattern detectedtests/fixtures/agentskills/my-skill/scripts/exfil.py:14 · AWS access key pattern detected — possible hardcoded or harvested keyFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST03
MEDIUM
Access to sensitive file pathstests/fixtures/agentskills/my-skill/scripts/exfil.py:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/fixtures/agentskills/my-skill/scripts/exfil.py:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL using raw IP addresstests/deployed_entrypoint.rs:45 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Remote installer piped to shellsrc/normalize.rs:236 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
URL using raw IP addresssrc/server.rs:907 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Remote installer piped to shellsrc/normalize.rs:232 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
URL using raw IP addresssrc/server.rs:900 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addresssrc/server.rs:349 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addresssrc/server.rs:903 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addresssrc/config.rs:2665 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)src/main.rs:1225 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Remote installer piped to shelltests/corpus/malicious.json:137 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
URL using raw IP addresstests/deployed_entrypoint.rs:163 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionsrc/mcp_client.rs:785 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)src/main.rs:1218 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actionsrc/mcp_client.rs:1124 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
URL using raw IP addresssrc/server.rs:906 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File type combined with upload actionsrc/mcp_client.rs:834 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

What would make this Verified

21 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Text that tells the agent to ignore its instructions≈ +9 on the totalDelete phrases like "ignore previous instructions", "override", "bypass" from SKILL.md and tool descriptions. Describe what the skill does; do not instruct the agent about other rules.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim getjavelin: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Privileged sudo command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to Docker MCP Catalog, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim getjavelin