Skills/Glama/fish-story

fish-story@0.4.1

VERIFIED· not started

Publisher claims: "Enables AI agents to play and manage local interactive story sessions through MCP tools, including starting games, viewing scenes and choices, recording decisions, pausing/resuming, branching saves, and exporting play experiences." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher nefelibata5136-code · publishing for 3 daysInstalls 0Last detonated 2d ago
$npx skills add fish-story
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
LLM_API_KEYConfiguration, not credentials: FISH_PLAYER_ID, FISH_STORY_HOME, LLM_BASE_URL, LLM_MODEL, SystemRoot
Where it talks to
no vendor host named in the codeAlso creativecommons.org, python.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names creativecommons.org, python.org as well as its own vendor. The guard injects LLM_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-12 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsfish_story/import_pack.py:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'session.json', 'saves', 'sessions', '.env'))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedfish_story/vendor/native/api_client.py:555 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/release_check.py:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif any(p in BLOCKED for p in parts) or path.suffix.lower() in {'.sqlite', '.db', '.key', '.log'} or path.name.startswith('.env'):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedfish_story/vendor/native/api_client.py:430 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_windows_bundle.py:123 · Python subprocess execution detectedresult = subprocess.run([str(executable), '--home', str(home), *arguments],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/release_check.py:49 · Python subprocess execution detectedoutput = subprocess.run(['git', 'ls-files', '--cached'], cwd=ROOT, check=True, capture_output=True, text=True).stdoutFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/build_windows.py:122 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif path.suffix.lower() in {'.db', '.sqlite', '.sqlite3', '.key', '.log'} or path.name.startswith('.env'):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_cli_restart.py:10 · Python subprocess execution detectedresult = subprocess.run([sys.executable, '-m', 'fish_story.cli', '--home', str(tmp_path), *args],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_windows_startup.py:45 · Python subprocess execution detectedreturn subprocess.run([str(powershell), '-NoProfile', '-ExecutionPolicy', 'Bypass', '-File',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedfish_story/vendor/native/api_client.py:598 · Python subprocess execution detectedhelp_proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_import_pack.py:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files('project-main/.env', 'PRIVATE_FILE_NOT_COPIED'),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_windows_bundle.py:175 · Python subprocess execution detectedmemory = subprocess.run([str(executable), '--home', str(home), 'export', sid, '--format', 'memory'],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/build_windows.py:165 · Python subprocess execution detectedsubprocess.run([sys.executable, '-m', 'PyInstaller', '--noconfirm', *clean,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedfish_story/vendor/native/api_client.py:587 · Python subprocess execution detectedversion_proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_windows_bundle.py:185 · Python subprocess execution detectedprocess = subprocess.Popen([str(desktop), '--home', str(home), 'serve', '--port', '0'],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsfish_story/vendor/native/runner.py:520 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesload_dotenv(Path(__file__).resolve().parents[1] / ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
HTML that renders invisible but is read by the agentfish_story/web/index.html:28 · HTML that renders invisible but is read by the agent · informational: not an instruction file<label>读取 Markdown / 纯文本<input id="core-file" type="file" accept=".md,.txt,text/plain,text/markdown"></label><label>最终导入内容，可直接编辑<textarea id="core" rows="7" plaFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsAGENTS.md:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesPrivate state defaults outside this checkout. Do not stage `.env`, core files,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedfish_story/vendor/native/api_client.py:413 · Python subprocess execution detectedversion_proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈392 tok
2 files · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.