Skills/Glama/knock

knock@r1

CAUTION· not started

Publisher claims: "A local-first MCP server that gives AI coding agents a persistent code map and memory, so they can retrieve relevant code with exact file:line pointers and rationale instead of re-reading files. It also lets agents save findings for future sessions and flags notes as stale when referenced files change." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher hasangilani · publishing for 12 daysInstalls 0Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
API_KEYConfiguration, not credentials: KNOCK_HOME, KNOCK_LOG_LEVEL, VITE_URL
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard. It asks for API_KEY and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is knock@r1 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 66/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathssrc/knock/security.py:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".netrc",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/knock/discovery.py:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".xml": "xml", ".gradle": "gradle", ".properties": "properties", ".conf": "conf", ".env.example": "dotenv"}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_discovery.py:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert ".env" not in found and ".env" in skippedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/knock/gitutil.py:39 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, timeout=timeout, env=_env(), stdin=subprocess.DEVNULL)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
AWS access key pattern detectedtests/conftest.py:14 · AWS access key pattern detected — possible hardcoded or harvested keyAWS_KEY = "AKIAIOSFODNN7EXAMPLE"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
HIGH
Access to sensitive file pathssrc/knock/discovery.py:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files""".git .hg .svn node_modules bower_components jspm_packages vendor third_party .venv venv env .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/knock/security.py:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/knock/security.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env.*",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/conftest.py:228 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env": f"STRIPE_SECRET_KEY={STRIPE_SECRET}\n",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_retrieval.py:93 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files@pytest.mark.parametrize("path", ["../../etc/passwd", "/etc/passwd", ".env", "build/bundle.js", "config/secrets.yaml", ".git/config", "missing.py"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedbenchmarks/retrieval_bench.py:63 · Python subprocess execution detectedsubprocess.run(["git", "-c", "core.hooksPath=/dev/null", "clone", "-q", "--depth", str(spec.get("history_depth", 200)),Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
HIGH
Access to sensitive file pathssrc/knock/discovery.py:86 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif name.startswith(".env.") and name.endswith((".example", ".sample", ".template")):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:242 · Collapsed <details> block carrying instructions<summary><b>Do I need an API key or a paid model?</b></summary> No. Indexing and search are fully deterministic and local. The only thing that uses an API is thFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedbenchmarks/agent_bench.py:87 · Python subprocess execution detectedout = subprocess.run(["git", "-C", str(root), "ls-files", "-z"], capture_output=True, check=True).stdout.decode()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_knowledge.py:77 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files({"category": "debugging", "content": "valid content here", "sources": [{"path": ".env"}]}, "not an indexed file"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Stripe-like API key pattern detectedtests/test_knowledge.py:90 · Stripe-like API key pattern detected — possible hardcoded or harvested keyrec = svc.record_knowledge("debugging", 'Local login works with api_key = "sk_live_abcdefghijklmnop1234"', repository=name)Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathstests/test_codemap.py:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessvc.open_code("../../etc/passwd:1-2", repository=name)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Stripe-like API key pattern detectedtests/conftest.py:15 · Stripe-like API key pattern detected — possible hardcoded or harvested keySTRIPE_SECRET = "sk_live_51HxYzAbCdEfGhIjKlMnOp"Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
HIGH
Access to sensitive file pathssrc/knock/security.py:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"*.env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:82 · Collapsed <details> block carrying instructions<summary><b>🖥️ Optional: use knock yourself from the terminal</b></summary> <br> You never *need* these, but they're handy. | Command | When you'd use it | |--Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Access to sensitive file pathstests/test_mcp.py:87 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesbad_path = await c.call_tool("get_source", {"path": "../../etc/passwd"})Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/conftest.py:21 · Python subprocess execution detectedreturn subprocess.run(["git", "-C", str(root), *args], check=True, capture_output=True, text=True, env=env).stdoutFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedbenchmarks/retrieval_bench.py:72 · Python subprocess execution detectedout = subprocess.run(["git", "-C", str(root), "ls-files", "-z"], capture_output=True, check=True).stdout.decode()Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
HIGH
Hidden zero-width characters detectedsrc/knock/extractors/js.py:25 · Hidden zero-width characters detected — may conceal content_SPACE = re.compile(r"[ \t\r\f\v 

]+")Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Python subprocess execution detectedbenchmarks/retrieval_bench.py:65 · Python subprocess execution detectedhead = subprocess.run(["git", "-C", str(dest), "rev-parse", "HEAD"], capture_output=True, text=True, check=True).stdout.strip()Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST05
MEDIUM
Access to sensitive file pathstests/test_indexer.py:132 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert ".env" not in paths and "certs/server.pem" not in paths and "config/secrets.yaml" not in pathsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_security.py:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files@pytest.mark.parametrize("path", [".env.example", "src/secret_manager.py", "README.md", "src/keys.py"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
AWS access key pattern detectedtests/test_security.py:11 · AWS access key pattern detected — possible hardcoded or harvested key"aws = 'AKIAIOSFODNN7EXAMPLE'",Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:64 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file> Add this line to your project's `CLAUDE.md` so the agent uses knock when it pays off:Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Access to sensitive file pathstests/test_security.py:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files@pytest.mark.parametrize("bad", ["../etc/passwd", "/etc/passwd", "a/../../b", "C:\\Windows", "", ".git/config", "a\x00b"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_security.py:38 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files@pytest.mark.parametrize("path", [".env", "config/.env.production", "id_rsa", "certs/server.pem", "secrets.yaml",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈1,658 tok
2 files · 61 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

14 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim hasangilani: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  5. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim hasangilaniPropose a patch to the maintainer