ghostbus@0.5.11
CAUTIONPublisher claims: "Enables MCP-capable agents to join a shared workspace where they can discover and message each other, hand off and approve tasks, and share files and context, with a provenance log for every action." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Server started and answered tools/list.- Tested
- MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
- Not tested
- what the tools do when called with real credentials
Before you give it your token
Code inventory arrives with this version's next honeypot run.- It will ask for
- unknown until the next run
- Where it talks to
- unknown until the next run
- What the honeypot saw
- no credential files read · no network
- What we could not test
- what the tools do when called with real credentials
The run was clean; the code inventory is pending. Server started and answered tools/list. What the code asks for and which hosts it names arrive with the next run; until then, connect it under the guard with the network pinned to what the honeypot saw.
$vet-skills run --net declared -- <the server's command>
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-06 and scored it 65/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Direct script execution from GitHub raw URL; Pipe-to-shell pattern. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.3sprocessexec /usr/bin/date
0.3sprocessexec /usr/bin/timeout
0.3sclaimed29 tools: bus_status, bus_register, bus_rotate_token, bus_heartbeat, bus_search, bus_channels, bus_agents, bus_send, bus_inbox, bus_thread, bus_create_task, bus_list_tasks, bus_approve_task, bus_claim_task, bus_complete_task, bus_cancel_task, workspace_put_file, workspace_get_file, workspace_list_files, workspace_put_context, workspace_get_context, workspace_board, bus_comment_task, workspace_delete_file, bus_sync
0.3sprocessscript backend runs setup only
0.3sprocessno install scripts to re-run
Static findings
HIGH
Privileged sudo commanddeploy/docker/vps-setup.sh:13 · Privileged sudo command — agent may execute with elevated privileges
AST05if [ "$(id -u)" != "0" ]; then echo "run as root (sudo bash)"; exit 1; fiFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Direct script execution from GitHub raw URLdeploy/docker/vps-setup.sh:6 · Direct script execution from GitHub raw URL — unverified code source
AST06# curl -fsSL https://raw.githubusercontent.com/littlestjames82-sys/ghostbus/main/deploy/docker/vps-setup.sh | sudo bashFix: Pin versions and sources; vendor anything fetched at install time.CRITICAL
Pipe-to-shell patterndeploy/docker/vps-setup.sh:17 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06curl -fsSL https://get.docker.com | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Remote installer piped to shelldeploy/docker/vps-setup.sh:17 · Remote installer piped to shell
AST07curl -fsSL https://get.docker.com | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandtest.mjs:1342 · Process kill command — agent can terminate processes
AST05// the state file itself must parse — the atomic rename means a kill canFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Remote installer piped to shelldeploy/docker/vps-setup.sh:6 · Remote installer piped to shell
AST07# curl -fsSL https://raw.githubusercontent.com/littlestjames82-sys/ghostbus/main/deploy/docker/vps-setup.sh | sudo bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandtest.mjs:1328 · Process kill command — agent can terminate processes
AST05} catch { break; } // socket died with the kill — expectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandsrc/mcp-server.mjs:61 · Process kill command — agent can terminate processes
AST05// bare `null` line used to throw in handle() and kill the server processFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.LOW
Unpinned dependency.github/workflows/publish-npm.yml:39 · Unpinned dependency
AST06- run: npm install -g npm@latestFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.MEDIUM
File permission modification commanddeploy/docker/vps-setup.sh:32 · File permission modification command — agent changes file ownership/permissions
AST05chmod 600 /root/ghostbus-admin-keyFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actiontest.mjs:781 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log('hostile input:');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Process kill commandtest.mjs:1353 · Process kill command — agent can terminate processes
AST05// everything the server ACKED (HTTP 200) before the kill is durableFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandsrc/core.mjs:94 · File permission modification command — agent changes file ownership/permissions
AST05// (v0.5.3). The mode rides through the atomic rename; the chmodFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Privileged sudo commanddeploy/docker/vps-setup.sh:6 · Privileged sudo command — agent may execute with elevated privileges
AST05# curl -fsSL https://raw.githubusercontent.com/littlestjames82-sys/ghostbus/main/deploy/docker/vps-setup.sh | sudo bashFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Instructions loaded
≈38 tok
1 file · 47 in bundle
Tool list per prompt
≈4,090 tok
29 tools · 141 per tool
Handshake
294 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 225
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
15 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Unclaimed publisher≈ +8 on the totalClaim littlestjames82-sys: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
- Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim littlestjames82-sysPropose a patch to the maintainer