Skills/Glama/pi-bay

pi-bay@0.9.34

CAUTION· startup only

Publisher claims: "Enables agents to discover and manage Raspberry Pis and other SSH devices on a LAN, including authentication, command execution, file and directory operations, reboots, and ctrlPi API installation." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher ctrlpi · publishing for 3 daysInstalls 0Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
PI_BAY_API_KEYSSH_AUTH_SOCKConfiguration, not credentials: PI_BAY_ALLOW_HOSTS, PI_BAY_API_PORT, PI_BAY_HOST, PI_BAY_MCP_HTTP, PI_BAY_MCP_STDIO, PI_BAY_NO_MCP, PI_BAY_NO_OPEN, PI_BAY_SSH_PORT
Where it talks to
no vendor host named in the codeAlso githubusercontent.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names githubusercontent.com as well as its own vendor. The guard injects PI_BAY_API_KEY, SSH_AUTH_SOCK only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; References a credential file in the home directory; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 21 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
1.4sprocessdependency install exit 0
21sprocessexec /app/apps/web/node_modules/.bin/xdg-open
21sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/xdg-open
21sprocessexec /app/node_modules/.bin/xdg-open
21sprocessexec /pnpm/xdg-open
21sprocessexec /usr/local/sbin/xdg-open
21sprocessexec /usr/local/bin/xdg-open
21sprocessexec /usr/sbin/xdg-open
21sprocessexec /usr/bin/xdg-open
21sprocessexec /sbin/xdg-open
21sprocessexec /bin/xdg-open
21sclaimedstartup only: exited (0) before answering · (node:3449) [UNDICI-EHPA] Warning: EnvHttpProxyAgent is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the warning was created) pi-bay: http://127.0.0.1:8383
21sprocessscript backend runs setup only
21sprocessno install scripts to re-run

Static findings

CRITICAL
Pipe-to-shell patternserver.js:476 · Pipe-to-shell pattern — downloads and immediately executes remote codeconst CTRLPI_INSTALL_CMD = pkg => 'cd ~ && curl -fsSL https://raw.githubusercontent.com/ctrlpi/pi-gpio-api/main/install.sh | bash -s -- --' + pkg;Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
References a credential file in the home directoryCLAUDE.md:52 · References a credential file in the home directory…ey authentication via `SSH_AUTH_SOCK` (SSH agent) and standard identity files (`~/.ssh/id_ed25519`, `~/.ssh/id_rsa`). 3. **Remote filesystem layer**: uses SFTP to browse,…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Privileged sudo commandCLAUDE.md:100 · Privileged sudo command — agent may execute with elevated privileges…LL_CMD`), then creates and starts, or restarts, the `pi-gpio-api` service when `sudo -n` works (`CTRLPI_SERVICE_CMD`, the installer's own unit). Needs `confirmed: tr…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsearch.py:201 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsearch.py:184 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandserver.js:484 · Privileged sudo command — agent may execute with elevated privileges…tall]\\nWantedBy=multi-user.target\\n' "$(whoami)" "$HOME/pi-gpio-api/run.sh" | sudo -n tee /etc/systemd/system/pi-gpio-api.service >/dev/null`, 'sudo -n systemctl…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Pipe-to-shell patternCLAUDE.md:75 · Pipe-to-shell pattern — downloads and immediately executes remote code…r SFTP when the Pi has none, so `install.sh` skips its own prompts, then types `curl ... install.sh | bash -s -- --lite|--full` into the Terminal tab through `sendToTerminal()`. The key …Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File type combined with upload actionserver.js:1349 · File type combined with upload action — agent may exfiltrate local data files…all.sh. On a first install, name and api_key are written to ~/pi-gpio-api/config.json (defaults: the device hostname and your-secret-key, the installer\'s own); an existing config.json is kept and they are ignored. A result with the defaul…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsserver.js:403 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// ~/.ssh/id_ed25519, id_rsa, then id_ecdsa. Host keys are accepted without verification.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsearch.py:169 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsearch.py:205 · Process kill command — agent can terminate processesout = e.stdout or "" # we kill dns-sd; partial output is what we wantFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellserver.js:476 · Remote installer piped to shellconst CTRLPI_INSTALL_CMD = pkg => 'cd ~ && curl -fsSL https://raw.githubusercontent.com/ctrlpi/pi-gpio-api/main/install.sh | bash -s -- --' + pkg;Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Privileged sudo commandserver.js:482 · Privileged sudo command — agent may execute with elevated privileges'sudo -n true 2>/dev/null || { echo needs_sudo; exit 0; }',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsCLAUDE.md:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ey authentication via `SSH_AUTH_SOCK` (SSH agent) and standard identity files (`~/.ssh/id_ed25519`, `~/.ssh/id_rsa`). 3. **Remote filesystem layer**: uses SFTP to bro…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
References a credential file in the home directoryserver.js:403 · References a credential file in the home directory// ~/.ssh/id_ed25519, id_rsa, then id_ecdsa. Host keys are accepted without verification.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
File type combined with upload actiontest/server.test.js:134 · File type combined with upload action — agent may exfiltrate local data filesconst upload = await request(baseUrl, '/api/file?path=a.txt', { method: 'PUT', body: 'hello' });Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandserver.js:483 · Privileged sudo command — agent may execute with elevated privileges'if [ -f /etc/systemd/system/pi-gpio-api.service ]; then sudo -n systemctl restart pi-gpio-api && echo restarted; exit; fi',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellCLAUDE.md:75 · Remote installer piped to shell…r SFTP when the Pi has none, so `install.sh` skips its own prompts, then types `curl ... install.sh | bash -s -- --lite|--full` into the Terminal tab through `sendToTerminal()`. The key …Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Direct script execution from GitHub raw URLserver.js:476 · Direct script execution from GitHub raw URL — unverified code sourceconst CTRLPI_INSTALL_CMD = pkg => 'cd ~ && curl -fsSL https://raw.githubusercontent.com/ctrlpi/pi-gpio-api/main/install.sh | bash -s -- --' + pkg;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandserver.js:485 · Privileged sudo command — agent may execute with elevated privileges'sudo -n systemctl daemon-reload && sudo -n systemctl enable --now pi-gpio-api && echo started'Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionCLAUDE.md:75 · File type combined with upload action — agent may exfiltrate local data files… opens a popup (agent name, API key, Lite/Full). It writes `~/pi-gpio-api/config.json` over SFTP when the Pi has none, so `install.sh` skips its own prompts, then types `curl ... install.sh | bash -s -- --lite|--full` into the Terminal tab…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈2,379 tok
3 files · 15 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim ctrlpi: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ctrlpiPropose a patch to the maintainer