capgo@22.42.1
CAUTION· install onlyPublisher claims: "Capgo: push fixes to your Capacitor users in minutes, build signed iOS and Android apps without a Mac, and roll back in one click." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
CAPGO_CLI_POSTHOG_API_KEYCAPGO_TOKENPOSTHOG_API_KEYS3_ACCESS_KEY_IDor--s3-apikey/--s3-apisecret/--require-apikey-expiration/--max-apikey-expiration-days/--enforce-hashed-api-keys/--no-password-policy/--no-require-apikey-expiration/--no-enforce-hashed-api-keys/--p12-password/--apple-app-specific-passwordConfiguration, not credentials: BASE_URL, BRANCH, CAPGO_CLI_POSTHOG_API_HOST, CAPGO_DISABLE_POSTHOG, CAPGO_DISABLE_TELEMETRY, DELETE_FILES, DEV, DISPLAY, ENV, GITHUB_PATH, LIST_FILES, MAKE_COPY, ORG_EMAIL_PREFERENCE_KEYS, POSTHOG_API_HOST, SUPA_URL, SUPABASE_PROJECT_ID, SUPABASE_PROJECT_REF, SUPABASE_URL, USER_EMAIL_PREFERENCE_KEYS, VITE_APP_VERSION, VITE_SUPABASE_URL- Where it talks to
- no vendor host named in the codeAlso capgo.app, android.com, posthog.com, nextjs.org, svelte.dev — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names capgo.app, android.com, posthog.com, nextjs.org, svelte.dev as well as its own vendor. The guard injects CAPGO_CLI_POSTHOG_API_KEY, CAPGO_TOKEN, POSTHOG_API_KEY, S3_ACCESS_KEY_ID only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- <the server's command>
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 62/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Auto-update or dynamic fetch configuration; Access to sensitive file paths; Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
HIGH
Auto-update or dynamic fetch configurationcli/src/app/debug.ts:162 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06disableAutoUpdateUnderNative: { summary: () => 'Channel update version is lower than device native', level: 'error' },Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathspackage.json:73 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"plugin:dev": "bash scripts/wrangler-dev-compat.sh -c cloudflare_workers/plugin/wrangler.jsonc --env=dev --env-file=internal/cloudflare/.env.local",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationcli/src/utils.ts:932 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06const cachedRemoteConfig = new Map<string, CapgoConfig>()Fix: Pin versions and sources; vendor anything fetched at install time.CRITICAL
Prompting user to enter sensitive credentialscli/src/login.ts:57 · Prompting user to enter sensitive credentials — social engineering
AST03message: 'Enter your API key:',Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationcli/src/utils.ts:1959 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06const hostApi = apiHost ?? (await getRemoteConfig(true, signal)).hostApiFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationcli/src/app/debug.ts:161 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06disableAutoUpdateToPatch: { summary: () => 'Auto-update to patch versions disabled', level: 'error' },Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathspackage.json:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"api:dev": "bash scripts/wrangler-dev-compat.sh -c cloudflare_workers/api/wrangler.jsonc --env=dev --env-file=internal/cloudflare/.env.local",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationcli/src/app/todo.ts:389 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06printAgentText(formatAppTodoList(appId, progress, { list: selectedList, trial: getAgentTrial(progress, (await getRemoteConfig(true)).hostWeb) }))Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationcli/src/app/debug.ts:170 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06disableAutoUpdateMetadata: { summary: () => 'Auto-update on metadata disabled', level: 'error' },Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationcli/src/index.ts:735 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06.option('--disable-auto-update <disableAutoUpdate>', `Block updates by type: major, minor, metadata, patch, or none (allows all)`)Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationcli/skills/usage/SKILL.md:43 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06…ng-app path, the CLI keeps using the local Capacitor app ID. It writes the new `autoUpdate` policy modes into config: `"atBackground"` for the default flow and `"always"` for instant updates. It can also offer a final `npx skills add https…Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Image alt text carrying instructionsREADME.md:20 · Image alt text carrying instructions
AST01Build source code and send to CapgoFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Access to sensitive file pathspackage.json:76 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"plugin:preprod": "bash scripts/wrangler-dev-compat.sh -c cloudflare_workers/plugin/wrangler.jsonc --env=preprod --env-file=internal/cloudflare/.env.preprod",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagecli/skills/native-builds/SKILL.md:21 · npx invocation of non-well-known package — may execute untrusted code
AST06npx @capgo/cli@latest build request <appId> --platform ios --prescan-skip ios/capacitor-server-url-shippedFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Hidden zero-width characters detectedcli/src/docs.ts:66 · Hidden zero-width characters detected — may conceal content
AST07emoji = '👨⚕️'Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.HIGH
Access to sensitive file pathscli/src/index.ts:1518 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05Browse stored credentials, view what's configured, export a CI/CD-ready .env file,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Hidden zero-width characters detectedcli/src/index.ts:216 · Hidden zero-width characters detected — may conceal content
AST07.description(`👨⚕️ Check if your Capgo app installation is up-to-date and gather information useful for bug reports.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.HIGH
Auto-update or dynamic fetch configurationcli/src/app/debug.ts:159 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06disableAutoUpdateToMajor: { summary: () => 'Auto-update to major versions disabled', level: 'error' },Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationcli/src/utils.ts:933 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06const remoteConfigInFlight = new Map<string, Promise<CapgoConfig>>()Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathspackage.json:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"files:dev": "bash scripts/wrangler-dev-compat.sh -c cloudflare_workers/files/wrangler.jsonc --env=dev --env-file=internal/cloudflare/.env.local",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathspackage.json:75 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"api:preprod": "bash scripts/wrangler-dev-compat.sh -c cloudflare_workers/api/wrangler.jsonc --env=preprod --env-file=internal/cloudflare/.env.preprod",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationsrc/main.ts:20 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06import { defaultApiHost, getRemoteConfig } from './services/console'Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Auto-update or dynamic fetch configurationcli/src/app/debug.ts:160 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06disableAutoUpdateToMinor: { summary: () => 'Auto-update to minor versions disabled', level: 'error' },Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/release-management/SKILL.md:12 · npx invocation of non-well-known package — may execute untrusted code
AST06- Prefer `npx @capgo/cli@latest ...` examples.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actioncli/src/sdk.ts:166 · File type combined with upload action — agent may exfiltrate local data files
AST07* console.log('Upload successful!')Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagecli/src/posthog.ts:323 · npx invocation of non-well-known package — may execute untrusted code
AST06// filename is the full install path — which differs per npx cache hash, bunx,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageplugin.json:20 · npx invocation of non-well-known package — may execute untrusted code
AST06…upload a new bundle build or start a native build. Use the Capgo CLI for those (npx @capgo/cli@latest bundle upload / build request), then manage the result here. Deleting data and …Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/src/utils.ts:115 · npx invocation of non-well-known package — may execute untrusted code
AST06`1. Retry with the resumable upload, which uploads in chunks and retries automatically: npx @capgo/cli@latest bundle upload --tus`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actioncli/skills/native-builds/SKILL.md:50 · File type combined with upload action — agent may exfiltrate local data files
AST07… "Email Capgo support" action: it writes a redacted diagnostics bundle as both `.log` and `.log.gz` under `~/.capgo-credentials/support/`, copies the `.log.gz` path to the clipboard, reveals it in Finder on macOS, and opens a pre-filled `m…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagecli/skills/native-builds/SKILL.md:33 · npx invocation of non-well-known package — may execute untrusted code
AST06- Backward compatibility: `npx @capgo/cli@latest build onboarding` still works.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/usage/SKILL.md:20 · npx invocation of non-well-known package — may execute untrusted code
AST06- Prefer `npx @capgo/cli@latest ...` in user-facing examples in this repo.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/src/app/add.ts:501 · npx invocation of non-well-known package — may execute untrusted code
AST06log.info(`Next step: upload a bundle with "npx @capgo/cli bundle upload ${appId}"`)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actioncli/src/index.ts:1214 · File type combined with upload action — agent may exfiltrate local data files
AST07…tion('--symbols-upload', 'Keep the debug symbols (iOS dSYMs zip, Android mapping.txt) in Capgo storage and print a time-limited download link for crash reporters (Crashlytics, Sentry). If output upload is enabled, also pass --no-output-upl…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagecli/skills/organization-management/SKILL.md:44 · npx invocation of non-well-known package — may execute untrusted code
AST06- Example: `npx @capgo/cli@latest organization list`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/organization-management/SKILL.md:50 · npx invocation of non-well-known package — may execute untrusted code
AST06- Example: `npx @capgo/cli@latest organization add --name "My Company" --email [email protected]`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/native-builds/SKILL.md:32 · npx invocation of non-well-known package — may execute untrusted code
AST06- Example: `npx @capgo/cli@latest build init`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actioncli/src/index.ts:1223 · File type combined with upload action — agent may exfiltrate local data files
AST07…id-version', 'Android: sync versionName in android/app/build.gradle from package.json before uploading the project. Fails unless versionName is a standalone quoted string literal.…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagecli/src/app/add.ts:129 · npx invocation of non-well-known package — may execute untrusted code
AST06`- Or register a different Capgo app ID, e.g. ${alternative}, and set plugins.CapacitorUpdater.appId to it in capacitor.config (your native bundle ID stays the same), then run npx cap sync.`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/observe/SKILL.md:18 · npx invocation of non-well-known package — may execute untrusted code
AST06npx @capgo/cli@latest observe metrics --action app_launch_ready --sort slowest --jsonFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/src/index.ts:167 · npx invocation of non-well-known package — may execute untrusted code
AST06Example: npx @capgo/cli@latest init YOUR_API_KEY com.example.app`)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/observe/SKILL.md:21 · npx invocation of non-well-known package — may execute untrusted code
AST06npx @capgo/cli@latest observe versionsFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/native-builds/SKILL.md:98 · npx invocation of non-well-known package — may execute untrusted code
AST06- Example: `npx @capgo/cli@latest build needed com.example.app --channel production --verbose`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actioncli/src/index.ts:1211 · File type combined with upload action — agent may exfiltrate local data files
AST07…load link (and QR), plus a link to the debug symbols (iOS dSYMs, Android mapping.txt) for crash reporters. Use with --no-playstore-upload (Android) or --ios-distribution ad_hoc (iOS) when you only need the artifact an…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actioncli/src/index.ts:1217 · File type combined with upload action — agent may exfiltrate local data files
AST07…gPath, finishedAt) to <path>. symbolsUrl is the iOS dSYMs zip or Android mapping.txt download link (with --output-upload or --symbols-upload) for crash reporters like Sentry. A PNG QR code is also written next to it as <path>.qr.png. Read …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagecli/src/utils.ts:95 · npx invocation of non-well-known package — may execute untrusted code
AST06`1. Upload a full zip instead: npx @capgo/cli@latest bundle upload --no-delta`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/release-management/SKILL.md:28 · npx invocation of non-well-known package — may execute untrusted code
AST06- Preview must already be enabled for the app; enable it with `npx @capgo/cli@latest app set com.example.app --preview`.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/observe/SKILL.md:17 · npx invocation of non-well-known package — may execute untrusted code
AST06npx @capgo/cli@latest observe summaryFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/usage/SKILL.md:49 · npx invocation of non-well-known package — may execute untrusted code
AST06… simulators, includes a reload option, and resolves the `cap run` command. Use `npx @capgo/cli@latest run device ios --no-launch` to exercise iOS physical/simulator target selection…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/native-builds/SKILL.md:37 · npx invocation of non-well-known package — may execute untrusted code
AST06- Example: `npx @capgo/cli@latest build init -a cap_xxx`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actioncli/skills/release-management/SKILL.md:153 · File type combined with upload action — agent may exfiltrate local data files
AST07…le>` (implies `--for-upload`) also writes a STORE zip with `capgo-delta-manifest.json` (`protocol_version`, `file_hash_format`, `delta_encryption`, `entries[]` with `file_name`, `file_hash`, `compression` = `none` or `brotli`, `uploaded_by…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagecli/skills/usage/SKILL.md:52 · npx invocation of non-well-known package — may execute untrusted code
AST06…run device`, and MCP live-update onboarding provide a manual Xcode launch. Run `npx cap open ios`, select the simulator, and choose Product > Run. Confirm the baseline…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actioncli/skills/native-builds/SKILL.md:155 · File type combined with upload action — agent may exfiltrate local data files
AST07…et - `--symbols-upload`: keep the debug symbols (iOS dSYMs zip, Android `mapping.txt`) and print a time-limited download link for crash reporters (Crashlytics, Sentry). If output upload is enabled by a flag, environment variable, or saved …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagecli/skills/release-management/SKILL.md:22 · npx invocation of non-well-known package — may execute untrusted code
AST06- Example: `npx @capgo/cli@latest get-qr com.example.app --bundle 1.2.3`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/organization-management/SKILL.md:29 · npx invocation of non-well-known package — may execute untrusted code
AST06- Example: `npx @capgo/cli@latest account set --first-name Ada --no-newsletter --email-preference weekly_stats=false`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actioncli/skills/native-builds/SKILL.md:148 · File type combined with upload action — agent may exfiltrate local data files
AST07…one quoted `versionName` literal in `android/app/build.gradle` with the `package.json` version. The request fails before submission if the file is missing or `versionName` is computed, interpolated, concatenated, or otherwise not a standal…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagecli/skills/usage/SKILL.md:43 · npx invocation of non-well-known package — may execute untrusted code
AST06…the default flow and `"always"` for instant updates. It can also offer a final `npx skills add https://github.com/Cap-go/capgo-skills -g -y` install step before the GitHu…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/src/index.ts:191 · npx invocation of non-well-known package — may execute untrusted code
AST06…support, simulator selection prints instructions to run the app from Xcode with npx cap open ios and Product > Run. It does not attempt the incompatible simulator comm…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/release-management/SKILL.md:23 · npx invocation of non-well-known package — may execute untrusted code
AST06- Example: `npx @capgo/cli@latest get-qr com.example.app --channel production`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/src/utils.ts:116 · npx invocation of non-well-known package — may execute untrusted code
AST06`2. Or raise the limit for the standard upload: npx @capgo/cli@latest bundle upload --timeout <milliseconds>`,Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/organization-management/SKILL.md:14 · npx invocation of non-well-known package — may execute untrusted code
AST06- Example: `npx @capgo/cli@latest account whoami`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actioncli/src/sdk.ts:687 · File type combined with upload action — agent may exfiltrate local data files
AST07* console.log(`${bundle.version} - ${bundle.uploadedAt}`)Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actioncli/skills/usage/SKILL.md:43 · File type combined with upload action — agent may exfiltrate local data files
AST07… auto-detection fails on macOS, the flow opens a native file picker for `package.json` before falling back to manual path entry. If the onboarding bundle upload fails, recovery can retry immediately or ask for the app's `package.json` and …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actioncli/src/index.ts:1222 · File type combined with upload action — agent may exfiltrate local data files
AST07… only.') .option('--sync-ios-version', 'iOS: sync the app version from package.json before uploading the project. Updates MARKETING_VERSION or CFBundleShortVersionString based o…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagecli/skills/organization-management/SKILL.md:23 · npx invocation of non-well-known package — may execute untrusted code
AST06- Example: `npx @capgo/cli@latest account get`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/src/docs.ts:151 · npx invocation of non-well-known package — may execute untrusted code
AST06section += `npx @capgo/cli@latest ${fullPath.join(' ')}\n`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/src/index.ts:165 · npx invocation of non-well-known package — may execute untrusted code
AST06…tor's native-run cannot open it, onboarding gives you a manual launch path. Run npx cap open ios, select the simulator in Xcode, choose Product > Run, and confirm that…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/observe/SKILL.md:20 · npx invocation of non-well-known package — may execute untrusted code
AST06npx @capgo/cli@latest observe device DEVICE_ID --jsonFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/release-management/SKILL.md:24 · npx invocation of non-well-known package — may execute untrusted code
AST06- Example: `npx @capgo/cli@latest get-qr com.example.app production --type channel`Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli/skills/observe/SKILL.md:19 · npx invocation of non-well-known package — may execute untrusted code
AST06npx @capgo/cli@latest observe events --action app_crash_nativeFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actioncli/skills/usage/SKILL.md:70 · File type combined with upload action — agent may exfiltrate local data files
AST07…ce/config files, and dependency declarations use the selected app's own `package.json`, while installed dependencies can remain hoisted. Explicit package/dependency paths still override discovery. Hosted MCP tools cannot inspect local file…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packageskills/ship-live-update/SKILL.md:9 · npx invocation of non-well-known package — may execute untrusted code
AST06…en it is in no page, explain that new bundles are uploaded with the Capgo CLI (`npx @capgo/cli@latest bundle upload`) and stop. 3. Read the target channel with `capgo_get_channel` (…Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈18,195 tok
8 files · 80 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
18 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Unclaimed publisher≈ +8 on the totalClaim cap-go: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
- Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim cap-goPropose a patch to the maintainer