crossbar@0.1.0
CAUTION· startup onlyPublisher claims: "Turns a user's own X (Twitter) account into an MCP server and CLI so AI agents can read timelines, search, inspect threads, mentions, and DMs, and perform actions such as posting, replying, liking, reposting, bookmarking, following, muting, blocking, and messaging as the signed-in user without an API key or developer account." Observed in sandbox: reads credential files.
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- no vendor host named in the codeAlso x.com, nodejs.org — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- read ~/.npmrc · reached only registry.npmjs.org
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Connect it only under the guard, with no real credential files on the machine it runs on. It read ~/.npmrc, which is nothing an MCP server needs from a user. `--contain` makes those directories unreadable.
$vet-skills run --contain --net declared -- <the server's command>
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-10 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Collapsed <details> block carrying instructions; Privileged sudo command. Summary: reads credential files.
Behavior trace
Honeypot run · 31 s · 3 scenariost+CategoryObserved action
4.7sfilesystemread ~/.npmrc
4.7sfilesystemread ~/.npm/_logs · ~/.npm/_cacache/index-v5/e1/c1/b652b100dbb3a5a73667352080ee1a3571f2367294dfaedabb31c272d1c0 · ~/.npm/_cacache/index-v5/88/5d/25679281b30cf75a621bf8d7e1b724abec207e5af6227dfcf8f503319558 · ~/.npm/_cacache/index-v5/82/1f/bc6ddfe7826874158ab240154ebbd8569ff129493af149bcc64cca3537c1 · ~/.npm/_cacache/index-v5/1a/fd/532a4c7bf52c908d567ded2bb11b0f3282f0733d0d079a5291c2f72e0077 · ~/.npm/_cacache/index-v5/b4/9d/5a271b1898a503a6f8a6b2361235fd7539e9ae1aa5622d3e78124d1a0c34 outside project
4.7sfilesystemwrote ~/.npm/_cacache/tmp/7ad370da · ~/.npm/_cacache/tmp/27556715 · ~/.npm/_cacache/tmp/b48d11d2 · ~/.npm/_cacache/tmp/6b5f5bf1 · ~/.npm/_cacache/tmp/8318b6b9 · ~/.npm/_cacache/tmp/9b1f2ae6
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7snetworkCONNECT tcp://registry.npmjs.org:443
4.7sprocessexec /usr/bin/dirname
4.7sprocessexec /usr/local/bin/npm
4.7sprocessexited 127: ./install.sh: line 11: sudo: command not found
7.9sprocessdependency install exit 0
28sclaimedstartup only: exited (0) before answering · Other crossbar install [--force] (re)install Crossbar's X spec into ~/.api-anything crossbar status how each X operation has been doing (api-anything status) --json print the raw JSON answer
28sprocessscript backend runs setup only
29sprocesssecond launch, clock +45 days, CI unset
31sfilesystemread ~/.npmrc
31sfilesystemread ~/.npm/_logs outside project
31sprocessexec /usr/bin/dirname
31sprocessexec /usr/local/bin/npm
31sprocessexited 127: ./install.sh: line 11: sudo: command not found
Static findings
MEDIUM
File type combined with upload actionspec/x.json:2072 · File type combined with upload action — agent may exfiltrate local data files
AST07… "method": "GET", "url": "https://x.com/i/api/2/notifications/all.json?include_profile_interstitial_type=1&include_blocking=1&include_blocked_by=1&include_followed_by=1&include_want_retweets=1&include_mute_edge=1&include_can_dm=1&include_c…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionspec/x.json:2145 · File type combined with upload action — agent may exfiltrate local data files
AST07… "method": "GET", "url": "https://x.com/i/api/2/notifications/mentions.json?include_profile_interstitial_type=1&include_blocking=1&include_blocked_by=1&include_followed_by=1&include_can_dm=1&skip_status=1&cards_platform=Web-12&include_card…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionbin/crossbar.mjs:82 · File type combined with upload action — agent may exfiltrate local data files
AST07if (p.repost_of) console.log(`${indent} ${c.d(`reposted @${p.repost_of.author}:`)} ${p.repost_of.text ?? ""}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionbin/crossbar.mjs:118 · File type combined with upload action — agent may exfiltrate local data files
AST07for (const m of [...d.messages].reverse()) console.log(`${c.d(m.time ?? "")} ${c.b(m.sender_id)}: ${m.text ?? ""}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/build-spec.mjs:576 · File type combined with upload action — agent may exfiltrate local data files
AST07["mute", "/1.1/mutes/users/create.json", "Mute an account: its posts leave your timelines; it isn't told.", null],Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/build-spec.mjs:578 · File type combined with upload action — agent may exfiltrate local data files
AST07["block", "/1.1/blocks/create.json", "Block an account: it can't see your posts or contact you.", null],Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Collapsed <details> block carrying instructionsREADME.md:74 · Collapsed <details> block carrying instructions
AST01<summary><b>Other ways to install</b></summary> **From a clone, macOS / Linux** ```bash git clone https://github.com/prantikmedhi/crossbar && cd crossbar && ./iFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Privileged sudo commandinstall.sh:11 · Privileged sudo command — agent may execute with elevated privileges
AST05npm install -g . --no-audit --no-fund || { echo "Global install needs permission. Retrying with sudo..."; sudo npm install -g . --no-audit --no-fund; }Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Instructions loaded
≈1,377 tok
3 files · 23 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.npmrc.
- Unclaimed publisher≈ +8 on the totalClaim prantikmedhi: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
- Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim prantikmedhiPropose a patch to the maintainer