teamwork@r5
VERIFIED· install onlyPublisher claims: "Tools for Teamwork.com products." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry Docker MCP CatalogPublisher teamwork · publishing for 127 daysInstalls 12,653Last detonated 16 h ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
GH_TOKENGITHUB_TOKENTW_MCP_BEARER_TOKENTWAPI_AUTHTWAPI_TOKENConfiguration, not credentials: GITHUB_OUTPUT, GITHUB_REPOSITORY, GITHUB_STEP_SUMMARY, TEAMWORK_DEMO_CONFIRMED, TEAMWORK_REVIEW_MANIFEST, TWAPI_SERVER- Where it talks to
- no vendor host named in the codeAlso teamwork.com, datadoghq.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names teamwork.com, datadoghq.com as well as its own vendor. The guard injects GH_TOKEN, GITHUB_TOKEN, TW_MCP_BEARER_TOKEN, TWAPI_AUTH, TWAPI_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- docker run -i --rm mcp/teamwork
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is teamwork@r5 safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-13 and scored it 86/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
MEDIUM
File type combined with upload actionAGENTS.md:148 · File type combined with upload action — agent may exfiltrate local data files
AST07…l count and that shape. - `twprojects-set_timelogs_billable` (`PUT /time_entries.json`) selects timelogs by **filter**, not by ID, and the endpoint reads a missing or zero `projectId` as every project in the installation. So `project_id` i…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File permission modification commandDockerfile:44 · File permission modification command — agent changes file ownership/permissions
AST05RUN chown mcp:mcp /bin/tw-mcp-http /bin/tw-mcp-stdio && chmod 0755 /bin/tw-mcp-http /bin/tw-mcp-stdioFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actionAGENTS.md:159 · File type combined with upload action — agent may exfiltrate local data files
AST07…fy a help doc change against a real site before believing it. - `/search/tickets.json` reads neither `fields` nor a trustworthy total, and both cost the caller its context. It accepts the `fields` parameter and answers with the whole recor…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionAGENTS.md:155 · File type combined with upload action — agent may exfiltrate local data files
AST07…th a PUT. The routes are `GET|PATCH /helpdocssites/{siteId}/helpdocarticles/{id}.json` and `POST /helpdocssites/{siteId}/helpdocarticles.json`, so every one of those SDK calls …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionAGENTS.md:149 · File type combined with upload action — agent may exfiltrate local data files
AST07…ogs` picks the time report's dimension (`GET /projects/api/v3/time/report/{type}.json`), and a `task` row is not comparable to a `project` one: it carries no time logged directly on a project, and grouping is per task ID, so a parent exclu…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
MCP server using network transport (SSE/HTTP)AGENTS.md:144 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…filter or page argument looks identical to a working one. Use `testutil.ProjectsMCPServerMockWithRequestURL` / `testutil.DeskMCPServerMockWithRequestURL` (or the `...WithRequestBody` variants for writes) to assert the query string, and `te…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
File type combined with upload actionAGENTS.md:129 · File type combined with upload action — agent may exfiltrate local data files
AST07…_task_split` reads it (`GET|POST|PUT|DELETE /projects/api/v3/tasks/{id}/capacity.json`, list on `/tasks/capacity.json`). A day left out counts as zero and the rows need not add up to the estimate. The routes are not idempotent in the same …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
Authorization escalation languagedocs/usage/chat-gpt.md:10 · Authorization escalation language · informational: not an instruction file
AST01- Developer mode enabled in your workspace settingsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Authorization escalation languageusage.md:33 · Authorization escalation language · informational: not an instruction file
AST01- *(Optional)* Admin access to enable the AI / MCP feature on your siteFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Prompt injectiondocs/usage/chat-gpt.md:17 · Prompt injection — known jailbreak technique reference · informational: not an instruction file
AST012. Click **Create** and enable **developer mode** when prompted.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
Python subprocess execution detectedplugins/review/demo.py:104 · Python subprocess execution detected
AST05proc = subprocess.Popen(argv, stdin=subprocess.PIPE, stdout=subprocess.PIPE,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
Authorization escalation languagedocs/usage/README.md:33 · Authorization escalation language · informational: not an instruction file
AST01- *(Optional)* Admin access to enable the AI / MCP feature on your siteFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Authorization escalation languagedocs/usage/chat-gpt.md:17 · Authorization escalation language · informational: not an instruction file
AST012. Click **Create** and enable **developer mode** when prompted.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Prompt injectiondocs/usage/chat-gpt.md:10 · Prompt injection — known jailbreak technique reference · informational: not an instruction file
AST01- Developer mode enabled in your workspace settingsFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
MCP server using network transport (SSE/HTTP)internal/testutil/mcp.go:300 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04func deskMCPServer(t *testing.T, testServer *httptest.Server) (*mcp.Server, func()) {Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
MCP server using network transport (SSE/HTTP)internal/testutil/mcp.go:218 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04return deskMCPServer(t, pkgtestutil.HTTPServerMock(status, response))Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.Cost to the agent
Instructions loaded
≈29,569 tok
3 files · 80 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.