Skills/Glama/iam-tap

iam-tap@0.1.1

VERIFIED· startup only

Publisher claims: "Enables capturing real AWS SDK calls through Client-Side Monitoring (CSM UDP) and turning them into least-privilege IAM policies, emitted as JSON, Terraform, or AWS CDK over a JSON-RPC stdio interface. Policy writes are path-contained and dry-run by default, requiring an explicit opt-in flag." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher kanchingyg · publishing for 0 daysInstalls 0Last detonated 5 h ago
$npx skills add iam-tap
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
CSM_TOKEN_ENVDASHSCOPE_API_KEYConfiguration, not credentials: IAM_TAP_BIN, REPOMCP_PATH_WSL
Where it talks to
no vendor host named in the codeAlso aliyuncs.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names aliyuncs.com as well as its own vendor. The guard injects CSM_TOKEN_ENV, DASHSCOPE_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-14 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
20sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-5pDB0i/task/home/work/acme-api/.claude/skills/iam-tap/dist/cli.js' } Node.js v22.23.5
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagesrc/cli.ts:258 · npx invocation of non-well-known package — may execute untrusted code`iam-tap ${VERSION}\n npx iam-tap -- <cmd>\n npx iam-tap --format terraform -- <cmd>\n npx iam-tap --mcp\n`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:10 · npx invocation of non-well-known package — may execute untrusted codenpx iam-tap --mcpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
AWS access key pattern detectedinternal/action/mapper_test.go:30 · AWS access key pattern detected — possible hardcoded or harvested keyout := RedactSecrets("key=AKIAIOSFODNN7EXAMPLE")Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
npx invocation of non-well-known packagemain.go:23 · npx invocation of non-well-known package — may execute untrusted code_, _ = fmt.Fprintf(os.Stderr, "iam-tap %s\n npx iam-tap -- <cmd>\n npx iam-tap --format terraform -- <cmd>\n npx iam-tap --mcp\n go install github.com/kanchingyg/iam-tap@latest\n", version)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known package.github/workflows/release.yml:55 · npx invocation of non-well-known package — may execute untrusted codenpx -y jsr publish --allow-dirtyFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:9 · npx invocation of non-well-known package — may execute untrusted codenpx iam-tap -- npm testFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
AWS access key pattern detectedinternal/action/mapper_test.go:31 · AWS access key pattern detected — possible hardcoded or harvested keyif !strings.Contains(out, "[REDACTED]") || strings.Contains(out, "AKIAIOSFODNN7EXAMPLE") {Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
AWS access key pattern detectedtest/iam-tap.test.ts:255 · AWS access key pattern detected — possible hardcoded or harvested keyexpect(out).not.toContain("AKIAIOSFODNN7EXAMPLE");Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
AWS access key pattern detectedtest/iam-tap.test.ts:257 · AWS access key pattern detected — possible hardcoded or harvested keyexpect(asia).not.toContain("ASIAIOSFODNN7EXAMPLE");Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
LOW
Unpinned dependency.github/workflows/release.yml:29 · Unpinned dependencynpm install -g npm@latestFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
AWS access key pattern detectedtest/iam-tap.test.ts:253 · AWS access key pattern detected — possible hardcoded or harvested keyconst out = redactSecrets("key=AKIAIOSFODNN7EXAMPLE");Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
AWS access key pattern detectedtest/iam-tap.test.ts:256 · AWS access key pattern detected — possible hardcoded or harvested keyconst asia = redactSecrets("ASIAIOSFODNN7EXAMPLE");Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03

Cost to the agent

Instructions loaded
≈75 tok
1 file · 42 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.