Skills/Glama/mcp-server-steam-backlog

mcp-server-steam-backlog@0.1.0

CAUTION· not started

Publisher claims: "Enables MCP clients such as Claude to search and filter a Steam library, get explained Deck-friendly picks, and triage games into lanes, edit notes, reorder Up next, and refresh the library through a self-hosted Steam Backlog Triage dashboard." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher sdnick484 · publishing for 28 daysInstalls 0Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
GH_TOKENGITHUB_TOKEN or --insecure-no-authConfiguration, not credentials: BACKLOG_DEBUG, BACKLOG_DRY_RUN, BACKLOG_LOG_UNREDACTED, GITHUB_ACTIONS
Where it talks to
no vendor host named in the codeAlso githubusercontent.com, steampowered.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names githubusercontent.com, steampowered.com as well as its own vendor. The guard injects GH_TOKEN, GITHUB_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-10 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedscripts/sync_shared.py:439 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
URL to a private-network addresstests/test_logsafe.py:119 · URL to a private-network address — a LAN or development target"GET http://10.0.0.5/api?volume=3&API_KEY=***&apikey=***#frag",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addresstests/test_logsafe.py:405 · URL using a raw public IP address — may bypass domain-based filteringassert mask_url("http://192.0.2.50:8480/") == "http://x.x.x.50:8480/"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)src/steam_backlog_mcp/remote.py:491 · MCP server using network transport (SSE/HTTP) — data sent over networkmcp: MCPServer, cfg: HttpConfig, *, health_check: HealthChecker | None = NoneFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedtests/conftest.py:108 · Python subprocess execution detectedsubprocess.run(["git", "-C", str(dest), "checkout", "-q", "FETCH_HEAD"], check=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL with embedded credentialstests/test_logsafe.py:129 · URL with embedded credentials — may be phishing or credential leaking("http://127.0.0.1:[email protected]", "http://127.0.0.1:[email protected]"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
File permission modification commanddeploy/alpine/smoke-test.sh:66 · File permission modification command — agent changes file ownership/permissionsmkdir -p /home/steam && chmod 700 /home/steamFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_logsafe.py:406 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameurl_with_query = "http://192.0.2.50:8480/api/v1?device=tv#section"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)SKILL.md:5 · MCP server using network transport (SSE/HTTP) — data sent over networkMCP server SDNick484/mcp-server-steam-backlog on Glama, built from https://github.com/SDNick484/mcp-server-steam-backlog.Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedtests/test_domain.py:263 · Python subprocess execution detectedout = subprocess.run([node, "-e", script, json.dumps(TAG_KEY_CASES)], capture_output=True, text=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/conftest.py:104 · Python subprocess execution detectedsubprocess.run(["git", "init", "-q", str(dest)], check=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Destructive file system command detecteddeploy/docker/Dockerfile:14 · Destructive file system command detectedRUN pip install --no-cache-dir /wheels/*.whl && rm -rf /wheelsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_http_tools.py:111 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_logsafe.py:417 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameassert mask_url("http://192.0.2.5:abc/") == "http://x.x.x.5:abc/"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using a raw public IP addresstests/test_logsafe.py:406 · URL using a raw public IP address — may bypass domain-based filteringurl_with_query = "http://192.0.2.50:8480/api/v1?device=tv#section"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
HTTP URL with a raw public IP addresstests/test_logsafe.py:405 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameassert mask_url("http://192.0.2.50:8480/") == "http://x.x.x.50:8480/"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/sync_shared.py:196 · Python subprocess execution detectedsubprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)deploy/docker/Dockerfile:19 · MCP server using network transport (SSE/HTTP) — data sent over networkENTRYPOINT ["mcp-server-steam-backlog", "serve", "--http"]Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
LOW
URL to a private-network addresstests/test_logsafe.py:118 · URL to a private-network address — a LAN or development target"GET http://10.0.0.5/api?volume=3&API_KEY=abc&apikey=def#frag",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Access to sensitive file pathstests/test_logsafe.py:178 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# .env / shell style; names that aren't secrets stayFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)CLAUDE.md:76 · MCP server using network transport (SSE/HTTP) — data sent over networkmcp-server-steam-backlog doctor [--json] | simulate [--api 1|2] | call <tool> k=v [--dry-run] | serve [--http]Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
URL using a raw public IP addresstests/test_logsafe.py:417 · URL using a raw public IP address — may bypass domain-based filteringassert mask_url("http://192.0.2.5:abc/") == "http://x.x.x.5:abc/"Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/conftest.py:131 · Python subprocess execution detectedhelp_text = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
HTTP URL with a raw public IP addresstests/test_remote.py:393 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameassert "192.0.2.10:*" in lan.allowed_hosts and "http://192.0.2.10:*" in lan.allowed_originsFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedtests/conftest.py:105 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detectedtests/test_domain.py:239 · Unicode escape sequence detected — may contain obfuscated payloads"\uff33\uff4f\uff55\uff4c\uff53\u2010\uff4c\uff49\uff4b\uff45", "Caf\u00e9", "", "+",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathssrc/steam_backlog_mcp/logsafe.py:84 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Shell/.env style, as a sibling might log its environment at debug: MQTT_PASSWORD=..., CF_ACCESS_AUD stays.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/steam_backlog_mcp/doctor.py:56 · MCP server using network transport (SSE/HTTP) — data sent over networkfor pkg in ("mcp-server-steam-backlog", "mcp", "httpx"):Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedtests/conftest.py:140 · Python subprocess execution detectedproc = subprocess.Popen(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/steam_backlog_mcp/logsafe.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesMQTT_PASSWORD=hunter2 -> MQTT_PASSWORD=*** (.env / shell style)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL with embedded credentialstests/test_logsafe.py:130 · URL with embedded credentials — may be phishing or credential leaking("http://127.0.0.1:8000#frag@section", "http://127.0.0.1:8000#frag@section"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
URL using a raw public IP addresstests/test_remote.py:393 · URL using a raw public IP address — may bypass domain-based filteringassert "192.0.2.10:*" in lan.allowed_hosts and "http://192.0.2.10:*" in lan.allowed_originsFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL with embedded credentialstests/test_logsafe.py:408 · URL with embedded credentials — may be phishing or credential leakingassert mask_url("http://user:[email protected]:8480/") == "http://user:[email protected]:8480/"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07

Cost to the agent

Instructions loaded
≈1,484 tok
2 files · 53 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim sdnick484: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  3. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  4. URL using a raw public IP address≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  5. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
  6. URL with embedded credentials≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim sdnick484Propose a patch to the maintainer