Skills/Glama/kintsugi

kintsugi@1.6.0

BLOCKED

Publisher claims: "Enables agents to pre-flight scan code or files, query paired anti-pattern and verified-fix examples, evolve and self-verify new guardrails from failure traces, and recompile portable skills and instructions for coding agents." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher tunguyen1993 · joined 0 days agoInstalls 0Last detonated 2 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-06 and scored it 48/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Pipe-to-shell pattern; Prompt injection attempt; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1
0.1sprocessexec /usr/bin/date
0.1sprocessexec /usr/bin/timeout
0.1sprocessexec .venv/bin/kintsugi
0.1sclaimedno tools/list reply (exit 0)
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

CRITICAL
Pipe-to-shell patternsrc/kintsugi/swarm.py:3024 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Prompt injection attempt.claude/skills/kintsugi-security/SKILL.md:64 · Prompt injection attempt — 'ignore previous instructions'Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/kintsugi/starter_pack.py:184 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detected.claude/skills/kintsugi-resource-lifecycle-logic/SKILL.md:36 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
Pipe-to-shell patternrust/src/lib.rs:1002 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification command.claude/skills/kintsugi-multi-model-council/SKILL.md:32 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
CRITICAL
OS command execution function call detectedrust/src/lib.rs:1002 · OS command execution function call detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or devicerust/src/lib.rs:413 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedrust/src/lib.rs:413 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Outbound HTTP to raw IP addresssrc/kintsugi/council.py:1174 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
References a credential file in the home directorysrc/kintsugi/starter_pack.py:181 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Python subprocess execution detected.claude/skills/kintsugi-resource-lifecycle-logic/SKILL.md:42 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/kintsugi/shield.py:78 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
HTML comment carrying imperative instructions to the agent.claude/skills/kintsugi-security/SKILL.md:64 · HTML comment carrying imperative instructions to the agentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/kintsugi/starter_pack.py:181 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Bidirectional text override characters detectedcollective-pool/ai-agents-mcp/deepseek-r1/KL-MCP-001.json:19 · Bidirectional text override characters detected — may hide content directionFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file paths.claude/skills/kintsugi-security/SKILL.md:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Prompt injection attempt.claude/skills/kintsugi-security/SKILL.md:70 · Prompt injection attempt — 'ignore previous instructions'Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
File permission modification command.claude/commands/kintsugi-multi-model-council.md:32 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
CRITICAL
OS command execution function call detectedrust/src/lib.rs:898 · OS command execution function call detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
References a credential file in the home directory.claude/skills/kintsugi-security/SKILL.md:64 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsrust/src/lib.rs:425 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
References a credential file in the home directory.claude/skills/kintsugi-security/SKILL.md:70 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Outbound HTTP to raw IP addresssrc/kintsugi/council.py:337 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file paths.claude/skills/kintsugi-security/SKILL.md:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
HTML comment carrying imperative instructions to the agent.claude/skills/kintsugi-security/SKILL.md:70 · HTML comment carrying imperative instructions to the agentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
File permission modification commandsrc/kintsugi/council.py:1044 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedsrc/kintsugi/swarm.py:3374 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detected.claude/skills/kintsugi-security/SKILL.md:94 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Bidirectional override character (text renders in a different order than it is read)collective-pool/ai-agents-mcp/deepseek-r1/KL-MCP-001.json:19 · Bidirectional override character (text renders in a different order than it is read) · informational: not an instruction fileFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detected.claude/skills/kintsugi-resource-lifecycle-logic/SKILL.md:48 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_kintsugi.py:1137 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedfree-skill-pack/scripts/verify_editions_and_benchmarks.py:190 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/kintsugi/foresight.py:232 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification command.github/instructions/kintsugi-guardrails.instructions.md:40 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandAGENTS.md:39 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedsrc/kintsugi/autofix.py:380 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using raw IP addresssrc/kintsugi/council.py:1174 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_kintsugi.py:1091 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedrust/src/lib.rs:972 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/kintsugi/cognition.py:984 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/kintsugi/autofix.py:438 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/kintsugi/compiler.py:119 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Access to sensitive file pathstests/test_kintsugi.py:1100 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/kintsugi/cognition.py:1007 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using raw IP addresssrc/kintsugi/council.py:337 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedfree-skill-pack/scripts/verify_editions_and_benchmarks.py:200 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/kintsugi/autofix.py:392 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/kintsugi/cognition.py:1002 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/kintsugi/council.py:998 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shelltests/test_kintsugi.py:1107 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandCLAUDE.md:39 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellsrc/kintsugi/swarm.py:3024 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Python subprocess execution detectedsrc/kintsugi/scanner.py:126 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/kintsugi/council.py:942 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandsrc/kintsugi/council.py:1090 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detected.claude/skills/kintsugi-security/SKILL.md:101 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/kintsugi/autofix.py:390 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedrust/src/lib.rs:108 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Pipe-to-shell patterntests/test_kintsugi.py:1107 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Remote installer piped to shellrust/src/lib.rs:1002 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Python subprocess execution detectedsrc/kintsugi/cognition.py:996 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
OS command execution function call detectedtests/test_kintsugi.py:1107 · OS command execution function call detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detected.claude/skills/kintsugi-security/SKILL.md:107 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/kintsugi/compiler.py:82 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedsrc/kintsugi/autofix.py:381 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/kintsugi/council.py:521 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedfree-skill-pack/scripts/verify_editions_and_benchmarks.py:230 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈21,242 tok
19 files · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

32 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Text that tells the agent to ignore its instructions≈ +9 on the totalDelete phrases like "ignore previous instructions", "override", "bypass" from SKILL.md and tool descriptions. Describe what the skill does; do not instruct the agent about other rules.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. OS command execution function call detected≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Unclaimed publisher≈ +8 on the totalClaim tunguyen1993: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  6. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim tunguyen1993Propose a patch to the maintainer