olcli@0.16.2
VERIFIED· install onlyPublisher claims: "Works with Overleaf projects from an MCP client: list projects, read and edit files, compile and download the PDF, diff, comments and tracked changes. Supports overleaf.com and self-hosted Overleaf; authenticates with an Overleaf session cookie." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
OVERLEAF_PASSWORDor--save-password/--no-save-passwordConfiguration, not credentials: GIT_DIR, GIT_REMOTE_OVERLEAF_DEBUG, OLCLI_BROWSER, OLCLI_CONCURRENCY, OVERLEAF_BASE_URL, OVERLEAF_COOKIE_NAME, OVERLEAF_EMAIL, OVERLEAF_SESSION, OVERLEAF_TIMEOUT- Where it talks to
- no vendor host named in the codeAlso overleaf.com, no-color.org — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names overleaf.com, no-color.org as well as its own vendor. The guard injects OVERLEAF_PASSWORD only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- <the server's command>
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-13 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
MEDIUM
File type combined with upload actionsrc/cli.ts:1202 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(chalk.bold('Available output files:'));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packageSKILL.md:119 · npx invocation of non-well-known package — may execute untrusted code
AST06npx -y --package @aloth/olcli olcli-mcpFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionsrc/cli.ts:1207 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(chalk.dim('Usage: olcli output <type>'));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packageSKILL.md:118 · npx invocation of non-well-known package — may execute untrusted code
AST06# Or via npx (the server is the olcli-mcp command of the @aloth/olcli package)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionsrc/cli.ts:314 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log('4. Run this and paste it when asked (input stays hidden):');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Process kill commandsrc/browser-auth.ts:353 · Process kill command — agent can terminate processes
AST05const kill = async (): Promise<void> => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Access to sensitive file pathstest/paths.test.ts:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05assert.equal(resolveWithin(base, '../../etc/passwd'), null);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL using a raw public IP addresstest/proxy.test.ts:138 · URL using a raw public IP address — may bypass domain-based filtering
AST07assert.equal(proxyForUrl(new URL('http://128.0.0.1/'), env)?.host, 'proxy.example:3128');Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File type combined with upload actiontest/mcp.test.ts:428 · File type combined with upload action — agent may exfiltrate local data files
AST07assert.equal(result.json.cli_command, `olcli upload --to sec/new.tex ${local} ${PROJECT}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagetest/package-metadata.test.ts:25 · npx invocation of non-well-known package — may execute untrusted code
AST06// The server is not the package's default bin, so npx has to be told which binFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Access to sensitive file pathstest/help.test.ts:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env: { ...base, HOME: home, XDG_CONFIG_HOME: join(home, '.config'), NODE_NO_WARNINGS: '1', COLUMNS: '200', ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagetest/package-metadata.test.ts:26 · npx invocation of non-well-known package — may execute untrusted code
AST06// to run: npx -y --package @aloth/olcli@<version> olcli-mcpFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiontest/e2e-ignore.sh:123 · File type combined with upload action — agent may exfiltrate local data files
AST07echo "$UPL_BLOCK" | grep -qF "${TEST_ID}_doc.log" && fail ".log leaked into upload" || ok ".log filtered"Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionsrc/cli.ts:1828 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(chalk.bold(`Would upload ${filesToUpload.length} file(s) to "${projectName}":`));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Access to sensitive file pathstest/browser-auth.test.ts:294 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env: { ...clean, HOME: home, XDG_CONFIG_HOME: join(home, '.config'), APPDATA: join(home, 'AppData'), NODE_NO_WARNINGS: '1', NO_COLOR: '1', ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstest/paths.test.ts:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05assert.equal(resolveWithin(base, '/etc/passwd'), null);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstest/proxy.test.ts:59 · URL with embedded credentials — may be phishing or credential leaking
AST07await withEnv({ HTTP_PROXY: `http://user:pa%[email protected]:${proxy.port}` }, async () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagesrc/mcp.ts:16 · npx invocation of non-well-known package — may execute untrusted code
AST06* npx @aloth/olcli-mcpFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionsrc/cli.ts:1208 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(chalk.dim('Example: olcli output bbl'));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiontest/scan.test.ts:39 · File type combined with upload action — agent may exfiltrate local data files
AST07assert.ok(!found.includes('.olcli.json'), '.olcli.json must never be uploaded');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
HTTP URL with a raw public IP addresstest/proxy.test.ts:138 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name
AST07assert.equal(proxyForUrl(new URL('http://128.0.0.1/'), env)?.host, 'proxy.example:3128');Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Access to sensitive file pathstest/cli-offline.test.ts:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05...env,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiontest/e2e-ignore.sh:116 · File type combined with upload action — agent may exfiltrate local data files
AST07echo "$UPL_BLOCK" | grep -qF "$MARKER" && ok "marker .txt queued for upload" || fail "marker missing from upload"Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
URL to a private-network addresstest/proxy.test.ts:44 · URL to a private-network address — a LAN or development target
AST07assert.equal(bypassesProxy(new URL('http://10.0.0.5/'), env), true);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.LOW
Unpinned dependency.github/workflows/publish.yml:18 · Unpinned dependency
AST06- run: npm install -g npm@latestFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.Cost to the agent
Instructions loaded
≈3,492 tok
1 file · 73 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.