Skills/Glama/offense

offense@0.1.0

CAUTION· startup only

Publisher claims: "Open-source security tools for coding agents. Provides dependency advisory audits and structured evidence for remediation through a local stdio MCP server, with optional hosted security tools." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher offense-research · publishing for 3 daysInstalls 0Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
OFFENSE_API_KEYOPENROUTER_API_KEYConfiguration, not credentials: OFFENSE_API_URL, OFFENSE_CONFIG_DIR, PURPLE_BROWSER, PURPLE_FIX_MODEL, PURPLE_SCAN_KEY
Where it talks to
no vendor host named in the codeAlso offense.sh, purpleteam.sh, osv.dev, openrouter.ai, twitter.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names offense.sh, purpleteam.sh, osv.dev, openrouter.ai, twitter.com as well as its own vendor. The guard injects OFFENSE_API_KEY, OPENROUTER_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: URL with embedded credentials; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 46 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessexited 1: Node.js v22.23.4
25sprocessdependency install exit 0
45sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-iyiddG/task/home/work/acme-api/.claude/skills/offense-app/sdk/node.mjs' } Node.js v22.23.4
45sprocessscript backend runs setup only
45sprocesssecond launch, clock +45 days, CI unset
45sprocessexited 1: Node.js v22.23.4

Static findings

MEDIUM
File type combined with upload actionpublic/skills/purple/SKILL.md:43 · File type combined with upload action — agent may exfiltrate local data files…nd must not be invoked when absent. Offense audit output is not the legacy `scan.json` input to those helpers; obtain a compatible Purple scan before running advanced triag…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionpublic/skills/offense/SKILL.md:79 · File type combined with upload action — agent may exfiltrate local data files…s://offense.sh/downloads/offense-sdk.tgz). The dashboard exports `offense.config.json`. An explicit enabled `pre_deploy`, `post_deploy` or `agent_run` event determines when the host should call it. Configure optional severity-based gates b…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
URL with embedded credentialssrc/style.css:1 · URL with embedded credentials — may be phishing or credential leaking@import url('https://fonts.googleapis.com/css2?family=DM+Sans:wght@400;500;600;700&family=Manrope:wght@400;500;600;700;800&display=swap');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathspackage.json:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"start": "node --env-file-if-exists=.env server/index.js",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionscripts/export-d1.mjs:89 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(JSON.stringify({ directory: outputDir, counts: result.counts }, null, 2));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionpublic/skills/purple/SKILL.md:89 · File type combined with upload action — agent may exfiltrate local data files…production remain explicit. ### Function-level reachability Read `reachability.json` and the call paths in `triage.md`/`handoff.md`. Prioritize `static_path_found` findings: they have a source entry → caller → affected API path, file/line …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/offense-cli.mjs:562 · File type combined with upload action — agent may exfiltrate local data files…y] [--output directory] [--plan-limit 0..10] [--max-pages 1..10] [--resume audit.json]', 'login [--no-browser]', 'logout', 'status', 'whoami', 'tools [list|show <tool>]', 'balance', 'topup', 'quote <tool> --input input.json', 'call <tool> …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionpublic/skills/purple/SKILL.md:19 · File type combined with upload action — agent may exfiltrate local data files…scripts/update.mjs` alongside the other helpers and read the package's `manifest.json`. Run `node /installed/purple/scripts/update.mjs --skill purple` after inspecting it to verify the files and record their hashes in `.skill-install.json`…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/offense-cli.mjs:582 · File type combined with upload action — agent may exfiltrate local data filesthrow new CliError('Use offense report --input audit.json|job.json --output report.pdf. This command is offline.');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionoffense/skills/offense/SKILL.md:22 · File type combined with upload action — agent may exfiltrate local data files…ent, run `offense rehearse /clean/project --scan /absolute/report-directory/scan.json --sandboxed --output /absolute/evidence`. The flag acknowledges isolation; it does not create a sand…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionpublic/skills/offense/SKILL.md:119 · File type combined with upload action — agent may exfiltrate local data files… upgrade is incompatible. The HTTPS audit helper also saves a separate **`trace.json`** locally. Its fixed allowlist records observed stages, outcomes, bounded durations and aggregate counts, fixed error categories and freshly generated ru…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandscripts/offense.mjs:80 · Process kill command — agent can terminate processesconst kill = () => { try { process.kill(-child.pid, 'SIGKILL'); } catch {} };Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionscripts/offense.mjs:15 · File type combined with upload action — agent may exfiltrate local data filesoffense dependencies verify --report fix.json [--output directory]Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionoffense/skills/purple/SKILL.md:22 · File type combined with upload action — agent may exfiltrate local data files…ent, run `offense rehearse /clean/project --scan /absolute/report-directory/scan.json --sandboxed --output /absolute/evidence`. The flag acknowledges isolation; it does not create a sand…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionplugins/offense/skills/offense/SKILL.md:128 · File type combined with upload action — agent may exfiltrate local data files…it result. Help and preview do not write traces. Share only the returned `trace.json` when `traceStatus` is `saved`. Disabled or failed exports leave any older trace file unchanged; it is not evidence for the new run. The adjacent `audit.j…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/offense.mjs:193 · File type combined with upload action — agent may exfiltrate local data filesif (options.action === 'scan') { console.log(JSON.stringify(await analyze(path.resolve(options.directory), { output: options.output }), null, 2)); return; }Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/offense-cli.mjs:569 · File type combined with upload action — agent may exfiltrate local data files'report --input audit.json|job.json --output report.pdf',Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionpublic/skills/purple/SKILL.md:93 · File type combined with upload action — agent may exfiltrate local data files… stay unknown until an affected API has been reviewed. Use `api-targets-template.json` to add mappings: inspect the advisory and the affected version's implementation using the agent's preferred connection; provide exported symbol paths, a…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionoffense/skills/purple/SKILL.md:20 · File type combined with upload action — agent may exfiltrate local data files…ts, missing importers and provider errors visible. 2. **Prioritize.** Read `scan.json` and `remediation.md`. Advisory matches are candidates, not confirmed exploitable vulnerabilities. For a complete executable checkout, run `offense triag…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionplugins/offense/skills/offense/SKILL.md:79 · File type combined with upload action — agent may exfiltrate local data files…s://offense.sh/downloads/offense-sdk.tgz). The dashboard exports `offense.config.json`. An explicit enabled `pre_deploy`, `post_deploy` or `agent_run` event determines when the host should call it. Configure optional severity-based gates b…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionoffense/skills/offense/SKILL.md:20 · File type combined with upload action — agent may exfiltrate local data files…ts, missing importers and provider errors visible. 2. **Prioritize.** Read `scan.json` and `remediation.md`. Advisory matches are candidates, not confirmed exploitable vulnerabilities. For a complete executable checkout, run `offense triag…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file paths.agents/skills/scanning-with-offense/SKILL.md:109 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesregistry credentials, `.env` files or unrelated source. Package names and exactFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload action.agents/skills/scanning-with-offense/SKILL.md:197 · File type combined with upload action — agent may exfiltrate local data filesnode "$OFFENSE_HELPERS/cli.mjs" report --input /private/reports/audit.json --output /private/reports/audit.pdfFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
URL with embedded credentialssrc/offense-theme.css:1 · URL with embedded credentials — may be phishing or credential leaking@import url('https://fonts.googleapis.com/css2?family=Archivo:wght@500;600;700;800&family=IBM+Plex+Mono:wght@400;500;600&display=swap');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathspackage.json:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"dev": "concurrently -k \"vite --host 127.0.0.1\" \"node --env-file-if-exists=.env --watch server/index.js\"",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionpublic/skills/offense/SKILL.md:121 · File type combined with upload action — agent may exfiltrate local data files…it result. Help and preview do not write traces. Share only the returned `trace.json` when `traceStatus` is `saved`. Disabled or failed exports leave any older trace file unchanged; it is not evidence for the new run. The adjacent `audit.j…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionpublic/skills/purple/SKILL.md:81 · File type combined with upload action — agent may exfiltrate local data files…each finding, read the advisory details, affected ranges and references in `scan.json`. Trace the affected API and configuration prerequisites through the actual callers to attacker-controlled input. If that cannot be established, keep `ne…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionplugins/offense/skills/offense/SKILL.md:126 · File type combined with upload action — agent may exfiltrate local data files… upgrade is incompatible. The HTTPS audit helper also saves a separate **`trace.json`** locally. Its fixed allowlist records observed stages, outcomes, bounded durations and aggregate counts, fixed error categories and freshly generated ru…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈26,300 tok
6 files · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim offense-research: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim offense-researchPropose a patch to the maintainer