Skills/Glama/family-tree-mcp

family-tree-mcp@0.1.0

CAUTION· not started

Publisher claims: "Enables agents to build and manage family trees, derive how people are related, and export diagrams or GEDCOM/HTML files through structured tools." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher jaiamin · publishing for 0 daysInstalls 0Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
CLOUDFLARE_API_TOKENFAMILY_PASSWORDFAMILY_TREE_TOKENConfiguration, not credentials: BACKUP, BACKUP_DIR, BASE_PATH, CLIENT_IP, DATA_DIR, DEPLOYMENT, DEV_DATA_DIR, DEVELOPMENT, EXPORT_FILE, FAMILY_INSTALLATION_CONFIG, FAMILY_INSTALLATION_CONFIG_JSON, FAMILY_TREE_URL, GOOGLE_CLIENT_ID, LEGACY_BACKUP_DIR, OWNER_EMAIL, PHOTOS, PUBLIC_ORIGIN, RECOVERY_KEY_FILE, SITE_NAME, TRUST_PROXY_HOPS
Where it talks to
no vendor host named in the codeAlso google.com, cloudflare.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names google.com, cloudflare.com as well as its own vendor. The guard injects CLOUDFLARE_API_TOKEN, FAMILY_PASSWORD, FAMILY_TREE_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-14 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsweb/src/admin.js:139 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslist.replaceChildren(...credentials.map(credential => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsweb/src/index.ts:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn app.fetch(request, { ...env, CLIENT_IP: request.headers.get("cf-connecting-ip") || "unknown" }, ctx);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionweb/tests/api.test.mjs:136 · File type combined with upload action — agent may exfiltrate local data files…t object; for (let n = 0; n < 20; n++) { object = await bucket.get("collection.json"); if (object) { const value = JSON.parse(await object.text()); if (value.uploads.length === 2) { assert.ok(value.collection.people[parentId]); assert.equa…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commandweb/Dockerfile:16 · File permission modification command — agent changes file ownership/permissionsRUN mkdir /data /backup && chown node:node /data /backupFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
URL with embedded credentialsweb/tests/smoke.test.mjs:47 · URL with embedded credentials — may be phishing or credential leakingfor (const url of ["https://user:[email protected]", "https://example.com?token=x", "https://example.com#x", "http://example.com"]) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
File type combined with upload actionweb/src/app.ts:58 · File type combined with upload action — agent may exfiltrate local data filesenv.DB.prepare("INSERT INTO photo_uploads(id, person_id, object_key, content_type, content_hash) VALUES (?, ?, ?, ?, ?)").bind(version, id, key, type, await digest(bytes)),Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsweb/scripts/server.mjs:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn { env, fetch: (request, address = "local") => app.fetch(request, { ...env, CLIENT_IP: address }, ctx),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Host or code assembled from base64 fragmentsweb/src/gedcom-decoding.ts:71 · Host or code assembled from base64 fragmentstry { binary = atob(encoded); } catch { throw new HttpError(400, "Invalid GEDCOM file encoding. Choose the file again."); }Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Python subprocess execution detectedmcp/tests/test_share.py:185 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionweb/src/app.ts:124 · File type combined with upload action — agent may exfiltrate local data filesawait audited(env,user,"suggestion.created",[env.DB.prepare("INSERT INTO suggestions(id, person_id, person_name, sender_name, contact, message) VALUES (?, ?, ?, ?, ?, ?)")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedweb/src/gedcom-ansel.ts:9 · Unicode escape sequence detected — may contain obfuscated payloads…ed96fd970d971d972d973d974d975d976d977d979d97ad97bd97c'; const ANSEL_VALUES_2 = '\u02c0\u1ea2\u1eba\u1ec8\u1ece\u1ee6\u1ef6\u1ea3\u1ebb\u1ec9\u1ecf\u1ee7\u1ef7\u02cb\xc0\xc8\xcc\xd2\xd9\u1e80\u1ef2\xe0\xe8\xec\xf2\xf9\u1e81\u1ef3\u02ca\xc1\…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedweb/src/gedcom-ansel.ts:7 · Unicode escape sequence detected — may contain obfuscated payloads…\xe6\u0153\u02ba\u0131\xa3\xf0\u01a1\u01b0\xb0\u2113\u2117\xa9\u266f\xbf\xa1\xdf\u0309\u0300\u0301\u0302\u0303\u0304\u0306\u0307\u030c\u030a\ufe20\ufe21\u0315\u030b\u0310\u0327\u0328\u0323\u0324\u0325\u0333\u0332\u0326\u031c\u032e\ufe22\uf…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hex-encoded string detectedweb/src/gedcom-ansel.ts:9 · Hex-encoded string detected — may contain obfuscated payloads…20a7\u0192\xa4\u20a4\u20a0\u20a1\u20a2\u20a3\u20a5\u20a6\u20a8\u20a9\u20aa\u20ac\xb9\xb2\xb3\xaa\xba\xab\xbb\xa6\xb6\xa7\u2310\u2020\u2021\u2122\ufb01\ufb02\u2039\u203a\u2030\u2026\u201c\u201d\u201a\u…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

Cost to the agent

Instructions loaded
≈725 tok
2 files · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim jaiamin: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Obfuscated code≈ +5 on the totalRemove base64-assembled strings, eval of decoded text and minified blobs. Reviewers and scanners both treat unreadable code as hostile.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Host or code assembled from base64 fragments≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  5. Hex-encoded string detected≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim jaiaminPropose a patch to the maintainer