Skills/Glama/collie

collie@0.6.0

CAUTION

Publisher claims: "Connects your own AI agent to a systematic review and meta-analysis workbench, exposing tools for protocol, search, deduplication, screening, full-text handling, data extraction, risk of bias, meta-analysis, GRADE and PRISMA. The agent drafts suggestions that you review and accept or dismiss in the app, keeping a human in the loop." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher leandromedeirosfelix · publishing for 0 daysInstalls 0Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
COLLIE_TOKEN_FILEMSR_TOKENConfiguration, not credentials: COLLIE_FEEDBACK, COLLIE_FEEDBACK_FILE, COLLIE_NO_BROWSER, MA_RSCRIPT, MSR_AGENT_DECISIONS, MSR_RSCRIPT, MSR_URL, RSCRIPT_PATH, XDG_STATE_HOME
Where it talks to
colliesr.com (its own)Also githubusercontent.com, auth.gr, york.ac.uk — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names githubusercontent.com, auth.gr, york.ac.uk as well as its own vendor. The guard injects COLLIE_TOKEN_FILE, MSR_TOKEN only into requests to colliesr.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets COLLIE_TOKEN_FILE=colliesr.com,MSR_TOKEN=colliesr.com -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-14 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
20sfilesystemread ~/.config/collie/token.json outside project
20sclaimed61 tools: collie_connection_status, collie_connect, collie_disconnect, collie_setup, review_list, review_get, criteria_get, criteria_set, records_search, record_get, screening_queue, screening_decide, exclusion_reasons, search_build, search_count, search_import, mesh_suggest, duplicates_list, duplicates_suggest, pdf_text, analysis_run, studies_list, table1_get, outcomes_list, rob_tools
20stools7ef33b4b2a807e17
20stools52f84fdcd0507043
20stoolscd3e37021418c7fe
20stools6cac95afdf519a63
20stoolsbdc30f91daf8eb88
20stools1012fbb75551e4c3
20stoolse278063afd1f9b63
20stools4cbe619ecd1dd8dd
20stoolse52b7d8cceefc1f1
20stools3d3c3f1b43db79f7
20stoolsc9aea4017bffeeed
20stoolsbfcc4266d76261a1
20stools10ef79118e9739df
20stools73291fd9d74e058b
20stoolse61a8efd673366b4
20stools17a12d4375dd65fe
20stoolsfc5a0b6b95cf2bd9
20stools64e5366ae55a2cfc
20stoolsa8b5d0fe25fc93fd
20stoolsed27d0e023749616
20stools5d6df6d1e9295f85
20stoolsc151fbfa8d52b170
20stoolsb9fddfc7995cda1e
20stools8732b389ff3dcc03
20stools000d5938954964ae
20stoolscae8e220ccfd441b
20stools0caa1e152a286678
20stools07e772f191f46fdf
20stools8de59dc570b4ba9c
20stoolsa23f21c1f794f2f5
20stoolsc6d95380e79725fd
20stools91b76ebc9b379653
20stools76541fa75c9ccf13
20stools2e930c48838bb077
20stools3e97b707924173e8
20stools83204d85a628fce1
20stoolsd1476eff58754e6c
20stoolsa48f65577c53f7c1
20stools2ba719480f7ff0fc
20stools8e17636713cb2c5d
20stoolsc3ce126d395b3201
20stools2d0749f6d67f36ef
20stoolsbc7bc8ab898adcdd
20stoolsdb7d7e4ac05580e6
20stools3bf054d630ab152e
20stools38756a6e256df0c1
20stoolse0f5df3ee4006009
20stools5e5c1b759c74d25c
20stools868fa2cbd1296020
20stools09ea5a8947c8ba42
20stools606129b21bb151cc
20stoolsa38087251c0e8a08
20stoolsa827328720d698dd
20stools8399741cddff1b92
20stools81c09e9d48cebc6f
20stools5b54350b7843ba5d
20stoolsa8becac232f25efb
20stools005a07061683b6f6
20stools8a5ef24a118f13c6
20stools8781d38b9e43bcfa
20stoolse539790ab84e7849
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actionserver/collie-mcp.mjs:65 · File type combined with upload action — agent may exfiltrate local data files…nternet connection (or MSR_URL), then call collie_connect again.`);let n=await r.json();if(r.status===429)throw new Error(`${Ti(r,n)}${n.error_description?` (${n.error_description})`:""}`);if(!r.ok)throw new Error(`Collie refused to start …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)server/collie-mcp.mjs:42 · MCP server using network transport (SSE/HTTP) — data sent over network…let e=xP(t);return wP(t,e.warnings),e.isValid}var bi=class{constructor(e){this._mcpServer=e}registerToolTask(e,r,n){let o={taskSupport:"required",...r.execution};if(o.taskSupport==="forbidden")throw new Error(`Cannot register task-based to…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Access to sensitive file pathstests/node/zotero.test.mjs:167 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.ok(!/process\.env|fetch\(/.test(src), "no environment override and no fetch");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/node/feedback.test.mjs:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert.equal(record({ type: "tool_call", source: "collie-mcp", ref: "x" }, { env: { ...env, COLLIE_FEEDBACK: "off" } }), false);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdocs/install-manual.md:134 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file…re review work, as the server's instructions tell it to. To make that explicit, add one line to your client's project rules (`AGENTS.md` for Codex, `GEMINI.md` for Gemini CLI, `.cursor/rules` for Cursor): ```text F…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionserver/collie-mcp.mjs:44 · File type combined with upload action — agent may exfiltrate local data files…m==="win32"?ki(process.env.APPDATA??ki(j_(),"AppData","Roaming"),"collie","token.json"):ki(process.env.XDG_CONFIG_HOME??ki(j_(),".config"),"collie","token.json"));function Fr(t){try{let e=JSON.parse(OP(Lr,"utf8"));return e.url===t&&typeof …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)server/collie-mcp.mjs:44 · MCP server using network transport (SSE/HTTP) — data sent over network…thub.com/${vd}`,yd=["-y",`github:${vd}`];function L_(t,e){let r=JSON.stringify({mcpServers:{collie:{command:"npx",args:yd,env:{MSR_URL:e}}}}),n=`Skills: ${ZP}/tree/main/skills (start with collie-workflow/SKILL.md).`,o={"claude-code":["## C…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actionserver/collie-mcp.mjs:7 · File type combined with upload action — agent may exfiltrate local data files…:o}){let s=r.$comment;if(o.$comment===!0)t.code((0,Z._)`${F.default.self}.logger.log(${s})`);else if(typeof o.$comment=="function"){let i=(0,Z.str)`${n}/$comment`,a=t.scopeValue("root",{ref:e.root});t.code((0,Z._)`${F.default.self}.opts.$c…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageserver/collie-mcp.mjs:52 · npx invocation of non-well-known package — may execute untrusted code…stom \u203A "Simple" tab:',` Server Name: collie Command: env MSR_URL=${e} npx ${yd.join(" ")}`,'3. Save, open the connector under Plugins \u203A Installed (or Customize …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈5,715 tok
17 files · 73 in bundle
Tool list per prompt
≈13,442 tok
61 tools · 220 per tool
Handshake
2364 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 301

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.config/collie/token.json.
  2. Unclaimed publisher≈ +8 on the totalClaim leandromedeirosfelix: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
  6. Access to sensitive file paths≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim leandromedeirosfelixPropose a patch to the maintainer