Is pitbox@0.1.6 safe to install?

pitbox@0.1.6

VERIFIED· install only

Publisher claims: "Enables coding agents to run, drive, and debug apps across Android emulators, Apple simulators, devices, and browsers from one tool, with token-lean UI snapshots, scripted flows, checks, and local service orchestration." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher veksa · publishing for 11 daysInstalls 0Last detonated 5d ago

$npx skills add pitbox

Watch Report an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.

Tested: every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: PITBOX_REMOTE_TOKENPITBOX_TOKENConfiguration, not credentials: ComSpec, GREETING, PATHEXT, PITBOX_BASH, PITBOX_E2E_EXAMPLES, PITBOX_E2E_KINDS
Where it talks to: no vendor host named in the codeAlso example.test, android.com — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: use of the skill by an agent

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names example.test, android.com as well as its own vendor. The guard injects PITBOX_REMOTE_TOKEN, PITBOX_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

0.0sprocessno install scripts to re-run

Static findings

HIGH

Access to sensitive file pathssrc/doctor/rules.ts:181 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst env = {...process.env, ...ctx.config.devserver?.env};Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

HTTP URL with a raw public IP addresssrc/jsdebug.test.ts:283 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name

const ok = new JsDebugger(proxy, strict.port, async () => undefined, ['http://192.0.2.1:8081', 'http://localhost:8081']);

Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

npx invocation of non-well-known packagesrc/init/project.ts:100 · npx invocation of non-well-known package — may execute untrusted codereturn framework === 'expo' ? 'npx expo start --port {port}' : 'npx react-native start --port {port}';Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagesrc/drivers/web/runner.ts:317 · npx invocation of non-well-known package — may execute untrusted code

…owser ?? 'chromium'}: ${msg}`, /Executable doesn't exist|install/i.test(msg) ? `npx playwright-core install ${this.cfg.browser ?? 'chromium'}, or set web.<app>.channel: 'chrome'` …

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

URL using a raw public IP addresssrc/jsdebug.test.ts:283 · URL using a raw public IP address — may bypass domain-based filtering

const ok = new JsDebugger(proxy, strict.port, async () => undefined, ['http://192.0.2.1:8081', 'http://localhost:8081']);

Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

HTTP URL with a raw public IP addresssrc/jsdebug.test.ts:287 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot nameconst refused = new JsDebugger(proxy, strict.port, async () => undefined, ['http://192.0.2.1:8081']);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Destructive file system command detectedsrc/unit.test.ts:470 · Destructive file system command detected

expect(instrumentCommand(26)).toMatch(/^rm -f \S+; nohup am instrument -w -r -e port \d+ dev\.pitbox\.runner\/\.RunnerInstrumentation > \S+ 2>&1 &$/);

Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

npx invocation of non-well-known packagesrc/drivers/web/runner.ts:57 · npx invocation of non-well-known package — may execute untrusted code

throw new WebError('Playwright is not installed', 'add playwright-core to the project (yarn add -D playwright-core) and `npx playwright-core install chromium`');

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

URL using a raw public IP addresssrc/jsdebug.test.ts:287 · URL using a raw public IP address — may bypass domain-based filteringconst refused = new JsDebugger(proxy, strict.port, async () => undefined, ['http://192.0.2.1:8081']);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

npx invocation of non-well-known packagesrc/drivers/web/runner.ts:7 · npx invocation of non-well-known package — may execute untrusted code// installs (`npx playwright-core install chromium`) or a channel the machine has (`chrome`, `msedge`).Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

LOW

URL to a private-network addresssrc/jsdebug.test.ts:115 · URL to a private-network address — a LAN or development target

expect(mapPathOf('http://10.0.2.2:8081/index.bundle//&platform=android&lazy=true')).toBe('/index.map?platform=android&lazy=true');

Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

File type combined with upload actionscripts/e2e.mjs:123 · File type combined with upload action — agent may exfiltrate local data files

for (const m of plan.apks ?? []) console.log(must(['install', path.join(nativeDir, m, 'build', 'outputs', 'apk', 'debug', `${m}-debug.apk`), '--device', avd, '--replace']));

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actionsrc/remote/appleRemote.ts:108 · File type combined with upload action — agent may exfiltrate local data filesconst body = (await res.json()) as {ok: boolean; result?: {upload: string}; error?: string};Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

Cost to the agent

Instructions loaded

≈30 tok

1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.