a2a-mailbox@r1

VERIFIED

Publisher claims: "Cross-CLI agent messaging: let Claude Code / Codex / Pi / ZCode terminal agents message each other like email. File-based mailboxes with a resident delivery hub that picks the channel per recipient (tmux injection / native queue / daemon queue / pull), federated across hosts over ssh." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher regretsss · joined 0 days agoInstalls 0Last detonated 2 h ago

$npx skills add a2a-mailbox

Watch Report an issue

Is a2a-mailbox@r1 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-06 and scored it 83/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.1sprocessexec /usr/bin/dirname

0.1sprocessexec /usr/bin/mkdir

0.1sprocessexec /usr/bin/cat

0.1sprocessexited 1: check 模式发现问题(见上), --apply 可自动修复 python 依赖

0.1sprocessscript backend runs setup only

0.2sprocesssecond launch, clock +45 days, CI unset

0.3sprocessexec /usr/bin/faketime

0.3sprocessexec /usr/bin/dirname

0.3sprocessexec /usr/bin/mkdir

0.3sprocessexec /usr/bin/cat

0.3sprocessexited 1: check 模式发现问题(见上), --apply 可自动修复 python 依赖

Static findings

HIGH

Access to sensitive file pathsscripts/add-peer.sh:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedcommon/detect.py:181 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedcommon/sshio.py:31 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedcommon/detect.py:154 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedcommon/tmuxio.py:53 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedcommon/codexq.py:83 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedcommon/tmuxio.py:40 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedcommon/codexq.py:211 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedcommon/sshio.py:128 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedcommon/sshio.py:68 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedcommon/sshio.py:20 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedcommon/detect.py:146 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedcommon/tmuxio.py:72 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedcommon/tmuxio.py:146 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/ssh-dryrun.py:30 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedmcp/mailbox_mcp.py:121 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/win-toast.py:42 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Destructive command against a filesystem root or devicetests/test_sshio.py:39 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Destructive file system command detectedtests/test_sshio.py:39 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedhub/hub.py:683 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedmcp/mailbox_mcp.py:167 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedhub/hub.py:152 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

Cost to the agent

Instructions loaded

≈553 tok

2 files · 80 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.