Is lean-context-mcp@0.1.1 safe to install?

Skills/Glama/lean-context-mcp

lean-context-mcp@0.1.1

VERIFIED· install only

Publisher claims: "Enables coding agents to reduce context tokens by requesting file outlines, individual symbols, compact searches, and condensed test, lint, and type-check failures instead of reading whole files or raw command output." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher fejinrp · publishing for 3 daysInstalls 0Last detonated 3d ago

$npx skills add lean-context-mcp

Watch Report an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.

Tested: every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: no credential variables read in the code
Where it talks to: no vendor host named in the code
What the honeypot saw: no credential files read · no network
What we could not test: use of the skill by an agent

Connect it under the guard. Nothing executable in the bundle ran; the trace covers the install step only. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

0.0sprocessno install scripts to re-run

Static findings

MEDIUM

npx invocation of non-well-known packagescripts/measure.ts:111 · npx invocation of non-well-known package — may execute untrusted codeawait runRow('unit tests, 1 injected failure', 'npx vitest run --project unit', 'nonzero');Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagescripts/measure.ts:122 · npx invocation of non-well-known package — may execute untrusted codeawait runRow('tsc, 2 injected type errors', 'npx tsc -p apps/worker/tsconfig.json --noEmit', 'nonzero');Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagesrc/config.ts:24 · npx invocation of non-well-known package — may execute untrusted code'npx tsc',Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagesrc/config.ts:22 · npx invocation of non-well-known package — may execute untrusted code'npx vitest',Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagesrc/config.ts:23 · npx invocation of non-well-known package — may execute untrusted code'npx jest',Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagescripts/measure.ts:102 · npx invocation of non-well-known package — may execute untrusted codeawait runRow('unit tests, all passing', 'npx vitest run --project unit', 'zero');Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Access to sensitive file pathstest/helpers.ts:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

return loadConfig({ LEAN_ROOTS: roots.join(path.delimiter), LEAN_CACHE_DIR: tmpDir('lc-cache-'), ...env } as NodeJS.ProcessEnv);

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Destructive command against a filesystem root or devicetest/allowlist.test.ts:24 · Destructive command against a filesystem root or device

for (const c of ['rm -rf /', 'curl http://x', 'node -e "1"', 'npm install evil', 'npm exec evil', 'npx evil', 'bash -c "npm test"', 'sh', 'php artisan migrate', 'go run .', 'npm', 'npm run']) {

Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

LOW

Instructs the agent to modify its persistent memory or instruction filesREADME.md:55 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileAgents prefer their built-in tools unless told otherwise. Add one line to `CLAUDE.md`, `AGENTS.md` or `.cursor/rules`:Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

MEDIUM

npx invocation of non-well-known packagetest/allowlist.test.ts:52 · npx invocation of non-well-known package — may execute untrusted codeexpect(checkAllowed('npx --package evil vitest', DEFAULT_ALLOW).ok).toBe(false);Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Destructive file system command detectedtest/allowlist.test.ts:35 · Destructive file system command detected

…there is no shell to interpret them)', () => { for (const c of ['npm test ; rm -rf /', 'npm test && curl x', 'npm test | tee x', 'npm test > /etc/x', 'npm test `who…

Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

npx invocation of non-well-known packagesrc/run/allowlist.ts:53 · npx invocation of non-well-known package — may execute untrusted code* token. Additional trailing args are allowed (e.g. "npx vitest" allows "npx vitest run src/a.test.ts").Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagetest/allowlist.test.ts:18 · npx invocation of non-well-known package — may execute untrusted code

…['npm test', 'npm test -- --run', 'npm run lint', 'npm run test:unit -- -t x', 'npx vitest run src/a.test.ts', 'npx tsc --noEmit', 'tsc -p .', 'eslint src', 'phpunit --fi…

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagesrc/server.ts:89 · npx invocation of non-well-known package — may execute untrusted codecommand: z.string().describe('e.g. "npx vitest run", "pytest -x"'),Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagesrc/run/allowlist.ts:72 · npx invocation of non-well-known package — may execute untrusted code// npx's own flags come before the package name; after it, args belong to the tool (e.g. `npx tsc -p x`).Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Destructive command against a filesystem root or devicetest/allowlist.test.ts:35 · Destructive command against a filesystem root or device

…there is no shell to interpret them)', () => { for (const c of ['npm test ; rm -rf /', 'npm test && curl x', 'npm test | tee x', 'npm test > /etc/x', 'npm test `whoa…

Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

npx invocation of non-well-known packagetest/allowlist.test.ts:7 · npx invocation of non-well-known package — may execute untrusted code

expect(tokenize(`npx vitest run -t "adds two (numbers)" 'a b'`)).toEqual(['npx', 'vitest', 'run', '-t', 'adds two (numbers)', 'a b']);

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Access to sensitive file pathstest/server.e2e.test.ts:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

await client.connect(new StdioClientTransport({ command: process.execPath, args: [DIST], env: { ...env, LEAN_ROOTS: root, LEAN_CACHE_DIR: tmpDir('lc-c-') }, stderr: 'ignore' }));

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstest/paths.test.ts:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesexpect(() => resolveSafe(cfg, '/etc/passwd')).toThrow(/outside allowed roots/);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packagetest/allowlist.test.ts:24 · npx invocation of non-well-known package — may execute untrusted code

for (const c of ['rm -rf /', 'curl http://x', 'node -e "1"', 'npm install evil', 'npm exec evil', 'npx evil', 'bash -c "npm test"', 'sh', 'php artisan migrate', 'go run .', 'npm', 'npm run']) {

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Destructive file system command detectedtest/allowlist.test.ts:24 · Destructive file system command detected

for (const c of ['rm -rf /', 'curl http://x', 'node -e "1"', 'npm install evil', 'npm exec evil', 'npx evil', 'bash -c "npm test"', 'sh', 'php artisan migrate', 'go run .', 'npm', 'npm run']) {

Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

Cost to the agent

Instructions loaded

≈38 tok

1 file · 56 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.