mcp4acumatica@0.53.0
BLOCKED· install onlyPublisher claims: "Enables Claude to access Acumatica ERP 2025 R2 through per-user OAuth and role-governed tools for lookups, discovery, documentation, and optional customer updates. Includes consent, sensitive-field redaction, rate limiting, pagination safeguards, and audit logging." Observed in sandbox: reads credential files, sends data to fd12:ea5f:789c:1:d000:2b:95f6:3c3a, 10.246.60.58, sparrow.cloudflare.com.
Coverage
Install scripts ran; no agent task scenario for this bundle.- Tested
- install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Blocked here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Revoked: guards refuse to launch this version
confirmed incident: read ~/.npmrc; contacted fd12:ea5f:789c:1:d000:2b:95f6:3c3a, 10.246.60.58, sparrow.cloudflare.com (undeclared) Every machine running vet-skills guard stops starting it at the next launch; the state clears when the honeypot re-run or a reviewer clears it.
Before you give it your token
- It will ask for
ACUMATICA_CLIENT_SECRETADMIN_SECRETOAUTH_PROVIDERTOKEN_MANAGERTOKEN_STOREConfiguration, not credentials: ACUMATICA_CANARY_GI, ACUMATICA_CLIENT_ID, ACUMATICA_ENDPOINT_NAME, ACUMATICA_ENDPOINT_VERSION, ACUMATICA_MAX_CONCURRENT, ACUMATICA_MAX_PER_MINUTE, ACUMATICA_MAX_RECORDS, ACUMATICA_RATE_LIMIT_QUEUE_WAIT_MS, ACUMATICA_TENANT, ACUMATICA_URL, ACUMATICA_WRITES_ENABLED, COOKIE_ENCRYPTION_KEY, INDEX_STORE, REDACT_PATTERNS, REDACT_SKIP- Where it talks to
- no vendor host named in the codeAlso acumatica.com, hallboys.com, nodejs.org, git-scm.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- read ~/.npmrc · contacted fd12:ea5f:789c:1:d000:2b:95f6:3c3a, 10.246.60.58, sparrow.cloudflare.com (undeclared)
- What we could not test
- use of the skill by an agent
Do not connect it. The honeypot or a critical finding blocked this version; the evidence is below.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-12 and scored it 23/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: document.cookie access; Pipe-to-shell pattern; document.cookie access. Summary: reads credential files, sends data to fd12:ea5f:789c:1:d000:2b:95f6:3c3a, 10.246.60.58, sparrow.cloudflare.com.
Behavior trace
Honeypot run · 53 s · 2 scenariost+CategoryObserved action
18snetworkdirect connection to fd12:ea5f:789c:1:d000:2b:95f6:3c3a:0, bypassing the egress proxy · undeclared
18snetworkdirect connection to 10.246.60.58:0, bypassing the egress proxy · undeclared
18sfilesystemread ~/.npmrc
18sfilesystemread ~/.npm/_logs · ~/.npm/_cacache/index-v5/e1/c1/b652b100dbb3a5a73667352080ee1a3571f2367294dfaedabb31c272d1c0 · ~/.npm/_cacache/index-v5/85/77/38dee8c3856bf189b84c52b367afde4b81eafa67b4fb623545eb428e5ea7 · ~/.npm/_cacache/index-v5/f9/e1/6cb8a96ee8bd87645f76796edce77f6be8ab3923c3e2bae6f26f865bb5ca · ~/.npm/_cacache/index-v5/16/6f/8fd97cd88bbe3ca40475d59d71a79a99207af9dbf04e50dfb277734f4c2b · ~/.npm/_cacache/index-v5/35/db/0f10ba94df3de6c4f627181b30f528556a7bc72015de2b96c0fa5c9fdd53 outside project
18sfilesystemwrote ~/.npm/_cacache/tmp/19945268 · ~/.npm/_cacache/tmp/891526ea · ~/.npm/_cacache/tmp/b68b2b1a · ~/.npm/_cacache/tmp/5d113f9b · ~/.npm/_cacache/tmp/7f6b4156 · ~/.npm/_cacache/tmp/9b76f6c4
18snetworkCONNECT tcp://github.com:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18snetworkCONNECT tcp://registry.npmjs.org:443
18sprocessexec /usr/bin/git
18sprocessexec /usr/lib/git-core/git
18sprocessexec /usr/lib/git-core/git-remote-https
18sprocessexec /usr/local/bin/npm
18sprocessexec /tmp/ks-detonate-7oSW7B/setup/home/work/acme-api/.claude/skills/mcp4acumaticaanil/MCP4Acumatica/node_modules/esbuild/bin/esbuild
18sprocessexec /tmp/ks-detonate-7oSW7B/setup/home/work/acme-api/.claude/skills/mcp4acumaticaanil/MCP4Acumatica/node_modules/wrangler/node_modules/esbuild/bin/esbuild
18sprocessexec /tmp/ks-detonate-7oSW7B/setup/home/work/acme-api/.claude/skills/mcp4acumaticaanil/MCP4Acumatica/node_modules/workerd/bin/workerd
18sprocessexited 1: ./install.sh: line 55: /dev/tty: No such device or address
31sfilesystemread ~/.npmrc
31sfilesystemread ~/.npm/_logs · ~/.npm/_cacache/index-v5/60/87/13cf84470afa8225bb765aee32de1c70abd5036c1255b2545b2e0844cf16 · ~/.npm/_cacache/content-v2/sha512/20/ec/429084fd59905d6320f322f6b9c661805be9e5ed46d4fa5a35ca200f72615eb629a0cb22ac39f707ec8c6e95e7e39bc4c0067d110ae55bf5019db5077991 · ~/.npm/_npx/32026684e21afda6/package.json · ~/.npm/_npx/32026684e21afda6/node_modules/.package-lock.json · ~/.npm/_npx/32026684e21afda6/yarn.lock outside project
31sfilesystemwrote ~/.npm/_cacache/tmp/c24a2d8c · ~/.npm/_cacache/index-v5/60/87/13cf84470afa8225bb765aee32de1c70abd5036c1255b2545b2e0844cf16 · ~/.npm/_cacache/tmp/cf277c7a · ~/.npm/_cacache/tmp/50ec0294 · ~/.npm/_cacache/tmp/fb751501 · ~/.npm/_cacache/tmp/8bc60f16
31snetworkCONNECT tcp://github.com:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://registry.npmjs.org:443
31snetworkCONNECT tcp://sparrow.cloudflare.com:443 · not in the allow-list, refused
31snetworkCONNECT tcp://sparrow.cloudflare.com:443 · not in the allow-list, refused
31snetworkCONNECT tcp://sparrow.cloudflare.com:443 · not in the allow-list, refused
31snetworkCONNECT tcp://sparrow.cloudflare.com:443 · not in the allow-list, refused
31sprocessexec /usr/local/bin/npx
31sprocessexec /usr/local/bin/npm
31sprocessexec /tmp/ks-detonate-7oSW7B/setup/home/work/acme-api/.claude/skills/mcp4acumaticaanil/node_modules/esbuild/bin/esbuild
31sprocessexec /tmp/ks-detonate-7oSW7B/setup/home/work/acme-api/.claude/skills/mcp4acumaticaanil/node_modules/workerd/bin/workerd
31sprocessexec /tmp/ks-detonate-7oSW7B/setup/home/work/acme-api/.claude/skills/mcp4acumaticaanil/node_modules/wrangler/node_modules/esbuild/bin/esbuild
31sprocessexec /usr/bin/grep
31sprocessexec /tmp/ks-detonate-7oSW7B/setup/home/work/acme-api/.claude/skills/mcp4acumaticaanil/node_modules/.bin/wrangler
31sprocessexec /tmp/ks-detonate-7oSW7B/setup/home/work/acme-api/.claude/skills/mcp4acumaticaanil/node_modules/wrangler/node_modules/@esbuild/linux-x64/bin/esbuild
31sprocessexec /usr/bin/dirname
31sprocessexited 1: (Use `node --trace-warnings ...` to show where the warning was created)
31sprocessscript backend runs setup only
31sprocessscript backend runs setup only
47sprocesssecond launch, clock +45 days, CI unset
47sprocessexited 1: Remove it, or set MCP4ACUMATICA_DIR to a different name, then re-run.
51sfilesystemread ~/.npmrc
51sfilesystemread ~/.npm/_logs · ~/.config/.wrangler/logs · ~/.config/.wrangler/profiles/directory-bindings.json · ~/.config/npm/config · ~/.config/npm · ~/.config/.wrangler/metrics.json outside project
51sfilesystemwrote ~/.config/.wrangler/logs/wrangler-2026-12-27_02-56-39_606.log · ~/.config/.wrangler/logs/wrangler-2026-12-27_02-56-41_434.log
51snetworkCONNECT tcp://registry.npmjs.org:443
51snetworkCONNECT tcp://sparrow.cloudflare.com:443 · not in the allow-list, refused
51snetworkCONNECT tcp://sparrow.cloudflare.com:443 · not in the allow-list, refused
51snetworkCONNECT tcp://sparrow.cloudflare.com:443 · not in the allow-list, refused
51snetworkCONNECT tcp://sparrow.cloudflare.com:443 · not in the allow-list, refused
51sprocessexec /usr/local/bin/npx
51sprocessexec /tmp/ks-detonate-7oSW7B/later/home/work/acme-api/.claude/skills/mcp4acumaticaanil/node_modules/.bin/wrangler
51sprocessexec /tmp/ks-detonate-7oSW7B/later/home/work/acme-api/.claude/skills/mcp4acumaticaanil/node_modules/wrangler/node_modules/@esbuild/linux-x64/bin/esbuild
51sprocessexec /usr/bin/grep
51sprocessexec /usr/bin/dirname
51sprocessexited 1:
Static findings
HIGH
document.cookie accesssrc/admin/admin-handler.ts:611 · document.cookie access — can steal session cookies
AST07const m = document.cookie.match(/(?:^|; )mcp_admin_csrf=([^;]+)/);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File type combined with upload actionscripts/upload-indexes.mjs:24 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`Uploading ${file} → ${BUCKET}/${key} ...`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Remote installer piped to shellinstall.sh:52 · Remote installer piped to shell
AST07# When invoked via `curl | bash`, stdin is the pipe (the script), not theFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Pipe-to-shell patternCLAUDE.md:100 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06…ported as a text module via the `**/*.sh` rule in `wrangler.jsonc`). Users run `curl -fsSL https://<worker>/install.sh | bash`; it checks for `git`/`node`/`npm`, clones the repo, `npm install`s, and `exec`…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagesetup.sh:8 · npx invocation of non-well-known package — may execute untrusted code
AST06# 1. A Cloudflare account with `npx wrangler login` already authenticated.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageCLAUDE.md:338 · npx invocation of non-well-known package — may execute untrusted code
AST06npx wrangler dev # Local devFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageCLAUDE.md:246 · npx invocation of non-well-known package — may execute untrusted code
AST06…istry`, never on `GiRegistryEntry`, so nothing model-facing changed. Raw data: `npx wrangler kv key get "cache:gi_registry" --namespace-id <id> --remote`. - **Measured 2026…Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
document.cookie accesssrc/admin/admin-handler.ts:98 · document.cookie access — can steal session cookies
AST07// reads via document.cookie is the defense.Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.HIGH
document.cookie accesssrc/admin/admin-handler.ts:921 · document.cookie access — can steal session cookies
AST07const m = document.cookie.match(/(?:^|; )mcp_admin_csrf=([^;]+)/);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
npx invocation of non-well-known packagesetup.sh:86 · npx invocation of non-well-known package — may execute untrusted code
AST06if ! npx --no-install wrangler --version >/dev/null 2>&1; thenFix: Pin versions and sources; vendor anything fetched at install time.CRITICAL
Pipe-to-shell patternsrc/auth/acumatica-auth-handler.ts:469 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06// curl -fsSL https://<this-worker>/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Remote installer piped to shellCLAUDE.md:100 · Remote installer piped to shell
AST07…ported as a text module via the `**/*.sh` rule in `wrangler.jsonc`). Users run `curl -fsSL https://<worker>/install.sh | bash`; it checks for `git`/`node`/`npm`, clones the repo, `npm install`s, and `exec`…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patterninstall.sh:52 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06# When invoked via `curl | bash`, stdin is the pipe (the script), not theFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Remote installer piped to shellinstall.sh:8 · Remote installer piped to shell
AST07# curl -fsSL https://mcp4acumatica.hallboys.com/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/build-docs-index.mjs:284 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log("Upload with `npm run upload-index`.");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Instructs the agent to modify its persistent memory or instruction filesCLAUDE.md:384 · Instructs the agent to modify its persistent memory or instruction files
AST011. **Update CLAUDE.md** — ensure it reflects all changes made during the sessionFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packageCLAUDE.md:339 · npx invocation of non-well-known package — may execute untrusted code
AST06npx wrangler deploy # Deploy to CloudflareFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionCLAUDE.md:417 · File type combined with upload action — agent may exfiltrate local data files
AST07…n this occurs. - **Empty / non-JSON 2xx bodies (fixed 0.44.0):** `await response.json()` on an empty Acumatica body throws the raw V8 message `Unexpected end of JSON input`, which reached the model verbatim as the entire explanation. Produ…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packageCLAUDE.md:342 · npx invocation of non-well-known package — may execute untrusted code
AST06npx wrangler tail # Live logsFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageCLAUDE.md:340 · npx invocation of non-well-known package — may execute untrusted code
AST06npx tsc --noEmit # Type checkFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandCLAUDE.md:118 · Process kill command — agent can terminate processes
AST05…user write gate can `enable()` per session), and `runWriter` still enforces the kill switch per call. **A tool registered via `this.server.tool(...)` directly bypass…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagesetup.sh:93 · npx invocation of non-well-known package — may execute untrusted code
AST06warn "You may not be logged in to wrangler. Run: npx wrangler login"Fix: Pin versions and sources; vendor anything fetched at install time.CRITICAL
Pipe-to-shell patterninstall.sh:8 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06# curl -fsSL https://mcp4acumatica.hallboys.com/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionCLAUDE.md:300 · File type combined with upload action — agent may exfiltrate local data files
AST07…binding `INDEX_STORE`) — schema-knowledge + documentation indexes (`schema-index.json`, `docs-index.json` + `docs-chunks/*` parts, future `dac-index.json`/`gi-examples-index.json`). Built offline by `scripts/` and uploaded with `npm run up…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagesetup.sh:92 · npx invocation of non-well-known package — may execute untrusted code
AST06if ! npx wrangler whoami 2>&1 | grep -qi 'logged in\|email\|account'; thenFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionCLAUDE.md:321 · File type combined with upload action — agent may exfiltrate local data files
AST07…han hand-building. See "GI Tool Gating & Registry". - **Re-import `MCPGIFields.xml` if the instance predates 0.48.0** — it gained the `SortOrder` and `IsActive` output columns (positional alignment can't attach column descriptions without …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/upload-indexes.mjs:61 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`Done — uploaded ${uploaded} index file(s).`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Process kill commandsrc/tools/tool-annotations.ts:66 · Process kill command — agent can terminate processes
AST05/** Same truthiness rule runWriter() uses for the kill switch. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Remote installer piped to shellsrc/auth/acumatica-auth-handler.ts:469 · Remote installer piped to shell
AST07// curl -fsSL https://<this-worker>/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packagesetup.sh:194 · npx invocation of non-well-known package — may execute untrusted code
AST06CREATE_OUT="$(npx wrangler kv namespace create TOKEN_STORE 2>&1 || true)"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandsrc/index.ts:515 · Process kill command — agent can terminate processes
AST05* still enforces the kill switch on every call regardless.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actionsetup.sh:302 · File type combined with upload action — agent may exfiltrate local data files
AST07# If swagger.json is present, build the schema index and upload it so theFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Process kill commandsrc/index.ts:509 · Process kill command — agent can terminate processes
AST05* kill switch is off.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Instructions loaded
≈28,539 tok
2 files · 80 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
57 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%An override rule (credential_read_plus_egress) caps this verdict regardless of the score. The first item below has to go before anything else counts.
- Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs.
- Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
- Unclaimed publisher≈ +8 on the totalClaim anilcopilot: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
- document.cookie access≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
- Pipe-to-shell pattern≈ +4 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim anilcopilotPropose a patch to the maintainer