lanhu-context-mcp@1.1.1
VERIFIEDPublisher claims: "Enables AI coding clients to turn Lanhu design drafts into implementation context, including HTML/CSS or Tailwind output, sliced asset mappings, design tokens, preview images, and downstream implementation guidance." Observed in sandbox: calls registry.npmjs.org only, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-06 and scored it 80/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: calls registry.npmjs.org only, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 2 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.8snetworkCONNECT https://registry.npmjs.org
0.8sprocessexec /usr/local/bin/npx
0.8sprocessexited 1: npm error A complete log of this run can be found in: /tmp/ks-detonate-mKQPO2/setup/home/.npm/_logs/2026-11-06T12_54_25_088Z-debug-0.log
0.8snetworkCONNECT https://registry.npmjs.org
0.8sprocessexited 127: bash: line 1: simple-git-hooks: command not found
0.8sprocessscript backend runs setup only
0.8sprocessscript backend runs setup only
1.1sprocesssecond launch, clock +45 days, CI unset
1.9snetworkCONNECT https://registry.npmjs.org
1.9snetworkCONNECT https://registry.npmjs.org
1.9sprocessexec /usr/bin/faketime
1.9sprocessexec /usr/local/bin/npx
1.9sprocessexited 1: npm error A complete log of this run can be found in: /tmp/ks-detonate-mKQPO2/later/home/.npm/_logs/2026-12-21T12_54_26_175Z-debug-0.log
1.9snetworkCONNECT https://registry.npmjs.org
1.9snetworkCONNECT https://registry.npmjs.org
1.9sprocessexec /usr/bin/faketime
1.9sprocessexited 127: bash: line 1: simple-git-hooks: command not found
Static findings
HIGH
Access to sensitive file pathssrc/config.ts:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
npx invocation of non-well-known packagepackage.json:117 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
MCP server using network transport (SSE/HTTP)src/tools/__tests__/get-design-context.http.integration.spec.ts:33 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04MEDIUM
File type combined with upload actionscripts/restore-install-hooks.ts:4 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
File type combined with upload actionscripts/strip-install-hooks.ts:23 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
npx invocation of non-well-known packagesrc/config.ts:162 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packagepackage.json:84 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packagesrc/config.ts:163 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
Access to sensitive file pathssrc/__tests__/config.spec.ts:150 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathssrc/utils/out-dir.ts:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
Access to sensitive file pathssrc/__tests__/config.spec.ts:140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
File type combined with upload actionscripts/strip-install-hooks.ts:16 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
npx invocation of non-well-known packagesrc/tools/__tests__/get-design-context.http.integration.spec.ts:3 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
File type combined with upload actionscripts/restore-install-hooks.ts:5 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
npx invocation of non-well-known packagesrc/tools/__tests__/get-design-context.stdio.integration.spec.ts:3 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06Cost to the agent
Instructions loaded
≈142 tok
3 files · 81 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.