Is clipsdk-mcp@0.1.0 safe to install?

clipsdk-mcp@0.1.0

VERIFIED

Publisher claims: "Enables coding agents to turn long videos into captioned short clips, upload local or linked media, monitor jobs, and save finished MP4s with titles, scores, and ready-to-post captions to disk." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher bitgate · publishing for 6 daysInstalls 0Last detonated 6d ago

$npx skills add clipsdk-mcp

Watch Report an issue

Coverage

Server started and answered tools/list.

Tested: MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested: what the tools do when called with real credentials

Before you give it your token

It will ask for: no credential variables read in the code
Where it talks to: clipsdk.com (its own)Also githubusercontent.com — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: what the tools do when called with real credentials

Connect it under the guard; read the third-party hosts first. The code names githubusercontent.com as well as its own vendor. The guard pins the network to the hosts the honeypot saw.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-08 and scored it 81/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

20sclaimed3 tools: create_clips, get_job, upload_file

20sprocessscript backend runs setup only

20sprocessno install scripts to re-run

Static findings

MEDIUM

URL with embedded credentialstest/tools.test.ts:753 · URL with embedded credentials — may be phishing or credential leakingvideo: file("video.mp4").replace("http://", "http://user:hunter2@"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

File type combined with upload actiontest/tools.test.ts:234 · File type combined with upload action — agent may exfiltrate local data filesexpect(done.json.folder).toBe(output("podcast"));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiondist/index.js:75 · File type combined with upload action — agent may exfiltrate local data files

…yIf??Ra,async()=>{let o=await fetch(n,{method:e.method,headers:this.#i(e),body:e.json===void 0?void 0:JSON.stringify(e.json),redirect:"manual",signal:YI(e.signal,e.timeoutMs)}),s=fp(o.headers.get("request-id")),a=await pw(o,this.#e.answerB…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Access to sensitive file pathstest/unit.test.ts:80 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

const planned = plannedFiles([clip(1, "Why Pricing Pages Fail!"), clip(2, "", { poster: null, srt: null, vtt: null }), clip(3, "../../etc/passwd")]);

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actiontest/tools.test.ts:161 · File type combined with upload action — agent may exfiltrate local data filesexpect(outcome.json.folder).toBe(output("podcast"));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

LOW

URL to a private-network addresstest/unit.test.ts:37 · URL to a private-network address — a LAN or development target

for (const url of ["http://api.clipsdk.com", "http://localhost.attacker.com", "http://127.0.0.1.nip.io", "http://10.0.0.5"]) {

Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

File type combined with upload actiontest/tools.test.ts:235 · File type combined with upload action — agent may exfiltrate local data files

expect(done.json.clips?.map((clip) => clip.video)).toEqual([output("podcast", `${BEST}.mp4`), output("podcast", "02-moment-2.mp4")]);

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

npx invocation of non-well-known packageskills/clipsdk/SKILL.md:5 · npx invocation of non-well-known package — may execute untrusted code

… hosted (https://mcp.clipsdk.com/mcp with the key as a Bearer header) or local (npx -y github:bitgate/clipsdk-mcp, Node 20+, CLIPSDK_KEY set). Without it, falls back …

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Access to sensitive file pathstest/tools.test.ts:527 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

await Promise.all([writeFile(path.join(dir, ".env"), MP4), writeFile(path.join(home, ".ssh", "key.mp4"), MP4), writeFile(path.join(home, "vault", "key.mp4"), MP4)]);

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/unit.test.ts:170 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesexpect(hasHiddenSegment("/home/me/project/.env", "/home/me/project")).toBe(true);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known package.github/workflows/ci.yml:27 · npx invocation of non-well-known package — may execute untrusted codenpx -y ./clipsdk-mcp-*.tgz --versionFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

URL with embedded credentialstest/tools.test.ts:431 · URL with embedded credentials — may be phishing or credential leaking["https://user:[email protected]/talk.mp4", "user name or password"],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

HIGH

Access to sensitive file pathssrc/paths.ts:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Dot names (.ssh, .env, .aws) count below the project, and anywhere on a path outside itFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/tools.test.ts:66 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

const server = createServer({ CLIPSDK_KEY: GOOD_KEY, CLIPSDK_BASE_URL: api.baseUrl, CLAUDE_PROJECT_DIR: dir, CLIPSDK_WAIT_S: "30", ...env });

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actiondist/index.js:8 · File type combined with upload action — agent may exfiltrate local data files

…:o}){let s=r.$comment;if(o.$comment===!0)t.code((0,A._)`${D.default.self}.logger.log(${s})`);else if(typeof o.$comment=="function"){let a=(0,A.str)`${n}/$comment`,c=t.scopeValue("root",{ref:e.root});t.code((0,A._)`${D.default.self}.opts.$c…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

References a credential file in the home directorytest/tools.test.ts:532 · References a credential file in the home directoryfor (const input of [".env", path.join(home, ".ssh", "key.mp4"), "~/.ssh/id_rsa", "innocent.mp4", ".secrets/key.mp4"]) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST03

MEDIUM

File type combined with upload actiontest/tools.test.ts:137 · File type combined with upload action — agent may exfiltrate local data filesexpect(outcome.json.folder).toBe(output("talk"));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Access to sensitive file pathstest/tools.test.ts:659 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files["https://media.example.com/v/.env%E2%80%AEgpj.mp4", "env_gpj"],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/paths.test.ts:91 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

for (const name of ["../escape.mp4", "../created/escape.mp4", "/etc/passwd", path.join("captions", "..", "..", "escape.srt")]) {

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)dist/index.js:75 · MCP server using network transport (SSE/HTTP) — data sent over network

…isValid}i(ip,"validateAndWarnToolName");var Sa=class{static{i(this,"ExperimentalMcpServerTasks")}constructor(e){this._mcpServer=e}registerToolTask(e,r,n){let o={taskSupport:"required",...r.execution};if(o.taskSupport==="forbidden")throw ne…

Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

Access to sensitive file pathstest/download.test.ts:80 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"file:///etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

URL with embedded credentialstest/unit.test.ts:44 · URL with embedded credentials — may be phishing or credential leaking["https://user:[email protected]/v2/?debug=1#top", "https://api.example.com/v2"],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

npx invocation of non-well-known packageAGENTS.md:22 · npx invocation of non-well-known package — may execute untrusted code

- No `build`, `prepare`, `prepack`, `install`, `preinstall` or `postinstall` scripts: npm would then run a full dev install whenever someone starts the server with `npx github:bitgate/clipsdk-mcp`.

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

LOW

URL to a private-network addresstest/tools.test.ts:426 · URL to a private-network address — a LAN or development target["https://192.168.1.20/talk.mp4", "can't reach 192.168.1.20"],Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL with embedded credentialstest/tools.test.ts:191 · URL with embedded credentials — may be phishing or credential leaking

for (const webhook_url of ["http://hooks.example.com/clips", "https://hooks.example.com:8443/clips", "https://user:[email protected]/clips", "hooks"]) {

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

MEDIUM

Access to sensitive file pathstest/tools.test.ts:532 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfor (const input of [".env", path.join(home, ".ssh", "key.mp4"), "~/.ssh/id_rsa", "innocent.mp4", ".secrets/key.mp4"]) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actiontest/tools.test.ts:169 · File type combined with upload action — agent may exfiltrate local data filesexpect(second.json.folder).toBe(output("talk-2"));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Dense URL-encoded contenttest/tools.test.ts:661 · Dense URL-encoded content — may be obfuscating payloads["https://media.example.com/%2e%2e%2f%2e%2e%2fescape.mp4", "escape"],Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.

AST07

MEDIUM

URL with embedded credentialstest/api.test.ts:218 · URL with embedded credentials — may be phishing or credential leakingfor (const url of ["http://example.com/in/a.mp4", "https://user:[email protected]/in/a.mp4", "not a url"]) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

Cost to the agent

Instructions loaded

≈1,581 tok

2 files · 32 in bundle

Tool list per prompt

≈1,127 tok

3 tools · 376 per tool

Handshake

391 ms

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 617

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.