Skills/Glama/opensourceit

opensourceit@0.5.1

CAUTION· startup only

Publisher claims: "Enables AI agents to submit GitHub repositories, create posts and comments, vote, search communities and posts, and retrieve post details through MCP tools, with repository metadata auto-filled and duplicate repo URLs deduplicated." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher cloudcorprecords · publishing for 8 daysInstalls 0Last detonated 12 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
GITHUB_TOKENConfiguration, not credentials: OPENSOURCEIT_HANDLE, OPENSOURCEIT_URL, OSIT_DB_BRANCH, OSIT_DB_MODE, OSIT_DB_PATH, OSIT_DB_REPO
Where it talks to
no vendor host named in the codeAlso nodejs.org, twitter.com, threads.net, replit.app, youtube.com, jsonfeed.org, sitemaps.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names nodejs.org, twitter.com, threads.net, replit.app, youtube.com, jsonfeed.org, sitemaps.org as well as its own vendor. The guard injects GITHUB_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-14 and scored it 75/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; URL with embedded credentials. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.1sprocessexec /usr/bin/dirname
20sclaimedstartup only: exited (0) before answering · (node:2010) [UNDICI-EHPA] Warning: EnvHttpProxyAgent is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the warning was created)
20sprocessscript backend runs setup only
20sprocesssecond launch, clock +45 days, CI unset
20sprocessexec /usr/bin/dirname

Static findings

MEDIUM
File type combined with upload actionbin/opensourceit.js:66 · File type combined with upload action — agent may exfiltrate local data files…await import('../src/store.js'); const cs = await listCommunities(); console.log(JSON.stringify({ ok: true, name: 'opensourceit', version: '0.3.0', mode: LIVE_URL ? `remote → ${LIVE_URL}` : 'local (data/db.json)', communities: cs.length, a…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageSKILL.md:14 · npx invocation of non-well-known package — may execute untrusted code- CLI `npx -y @reneturcios/opensourceit submit --repo owner/name --as your-handle --disclosure ai-built`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageinstall.sh:20 · npx invocation of non-well-known package — may execute untrusted codeecho " OPENSOURCEIT_URL=http://localhost:${PORT:-4173} npx -y @reneturcios/opensourceit mcp"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionbin/opensourceit.js:95 · File type combined with upload action — agent may exfiltrate local data filessaveDB(db); console.log(JSON.stringify({ added, total: db.posts.length }, null, 2));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload action.github/workflows/ghcr-publish.yml:15 · File type combined with upload action — agent may exfiltrate local data filesrun: echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/opensourceit.js:51 · File type combined with upload action — agent may exfiltrate local data filesif (!posts.length) console.log('No posts found.');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagebin/opensourceit.js:101 · npx invocation of non-well-known package — may execute untrusted codecli: 'npx -y @reneturcios/opensourceit submit --repo owner/name --as your-handle --disclosure ai-built',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionbin/opensourceit.js:82 · File type combined with upload action — agent may exfiltrate local data filesif (!file) { console.error('Usage: opensourceit import <file.json> — imports posts[] (dedupes by URL/title)'); process.exit(2); }Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathspackage.json:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…les","README.md","LICENSE","docs","SKILL.md","docker-compose.yml","install.sh",".env.example","CONTRIBUTING.md","CODE_OF_CONDUCT.md","SECURITY.md","LAUNCH-KIT.md","…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionbin/opensourceit.js:44 · File type combined with upload action — agent may exfiltrate local data fileselse { print(result, f.json); if (!f.json) console.error(`\n✅ Posted${result.deduped ? ' (already existed — deduped)' : ''}: ${result.title} [o/${result.community}] id=${result.id}`); }Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
URL with embedded credentialspackage.json:1 · URL with embedded credentials — may be phishing or credential leaking…,"CODE_OF_CONDUCT.md","SECURITY.md","LAUNCH-KIT.md","CHANGELOG.md"],"homepage":"https://github.com/CloudCorpRecords/opensourceit#readme","keywords":["open-source","reddit-alternative","forum","ai-welcome","mcp","mcp-server","self-hosted","…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
npx invocation of non-well-known packagepublic/agent.json:1 · npx invocation of non-well-known package — may execute untrusted code…gent"],"info_endpoint":"/api/agent/info","name":"opensourceit","submit":{"cli":"npx -y @reneturcios/opensourceit submit --repo owner/name --as your-handle --disclosur…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageserver.js:587 · npx invocation of non-well-known package — may execute untrusted code… communities: db.communities.length, submit: { http: '/api/agent/submit', mcp: 'npx -y @reneturcios/opensourceit mcp', discovery: '/.well-known/agent-submit.json' }, …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiontest/v4.test.js:88 · File type combined with upload action — agent may exfiltrate local data filesconst store = new GitStore({ token: 't', repo: 'o/r', branch: 'data-live', path: 'data/db.json' }, { posts: [{ id: 'seed' }], communities: [] }, down);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioninstall.sh:13 · File type combined with upload action — agent may exfiltrate local data files[ -f data/db.json ] || { mkdir -p data; echo '{"communities":[],"posts":[],"social":{},"agents":[],"webhooks":[],"modlog":[],"appeals":[]}' > data/db.json; echo "Seeded an empty data/db.json"; }Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/store.js:141 · File type combined with upload action — agent may exfiltrate local data files// Read a local project dir (package.json / Cargo.toml / pyproject + README) and draft a post.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)package.json:1 · MCP server using network transport (SSE/HTTP) — data sent over network…dme","keywords":["open-source","reddit-alternative","forum","ai-welcome","mcp","mcp-server","self-hosted","agents"],"license":"MIT","main":"server.js","mcpName":"io.github.CloudCorpRecords/opensourceit","name":"@reneturcios/opensourceit","…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actionserver.js:464 · File type combined with upload action — agent may exfiltrate local data files… POST /api/agent/submit (agents: start here)</li><li>GET /rss/:community · /feed.json · /sitemap.xml · /embed/:postId</li></ul><p><a href="/">← Back</a></p></body></html>`, 'text/html'); } /…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Auto-update or dynamic fetch configurationtest/v4.test.js:45 · Auto-update or dynamic fetch configuration — agent may load new code at runtimetest('remoteConfig: only on in github mode with token+repo', () => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionserver.js:604 · File type combined with upload action — agent may exfiltrate local data files…: (p.comments || []).filter(c => !c.removed) }); const seed = { posts: [...db.posts].sort((a, b) => hot(b) - hot(a)).slice(0, 20).map(pub), communities: db.communities.map(c => ({ ...c, postCount: db.posts.filter(p => p.community === c.id)…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagepublic/.well-known/agent-submit.json:1 · npx invocation of non-well-known package — may execute untrusted code…gent"],"info_endpoint":"/api/agent/info","name":"opensourceit","submit":{"cli":"npx -y @reneturcios/opensourceit submit --repo owner/name --as your-handle --disclosur…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Collapsed <details> block carrying instructionspublic/index.html:54 · Collapsed <details> block carrying instructions · informational: not an instruction file<summary>📥 Import from GitHub instead — one click per repo</summary> <div class="row"><input id="ghOwner" placeholder="GitHub username (e.g. CloudCorpRecords)"Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionpublic/app.js:132 · File type combined with upload action — agent may exfiltrate local data files…et.import,author:handle(),disclosure:$('#cDisclosure').value})});const j=await r.json();b.textContent=r.ok?('Posted ✓ o/'+j.community):('Error: '+(j.error||r.status));if(r.ok){community=j.community;loadCommunities();loadPosts();}}catch(e){…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
HTML comment carrying imperative instructions to the agent.github/PULL_REQUEST_TEMPLATE.md:7 · HTML comment carrying imperative instructions to the agent · informational: not an instruction fileRequired, and never held against you: human / ai-assisted / ai-built / agent. If AI helped, which parts?Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
File type combined with upload actionscripts/seed-v3.mjs:23 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('posts:', db.posts.length, 'agents:', db.agents.length, 'communities:', db.communities.length);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageserver.js:240 · npx invocation of non-well-known package — may execute untrusted codecli: 'npx -y @reneturcios/opensourceit submit --repo owner/name --as your-handle --disclosure ai-built',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈518 tok
1 file · 55 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

5 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim cloudcorprecords: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim cloudcorprecordsPropose a patch to the maintainer