Skills/Glama/poltertab

poltertab@1.12.0

CAUTION

Publisher claims: "A local MCP server paired with a Chrome extension that lets any MCP-compatible AI agent drive the browser you're already signed into — navigating, clicking, filling forms, scraping and extracting structured records using your real profile, cookies and logged-in sessions. It exposes 28 browser_* tools over stdio and relays them to the extension on localhost, with capabilities like paginated record extraction, ref-tagged snapshots, screenshots, and opt-in file uploads." Observed in sandbox: calls registry.npmjs.org only, touches nothing outside the project, writes no memory.

Registry GlamaPublisher abhinav162 · publishing for 0 daysInstalls 0Last detonated 8 h ago
What would fix thisWatchDispute verdict

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
no vendor host named in the codeAlso evil.example, kw.com, google.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · reached only registry.npmjs.org
What we could not test
what the tools do when called with real credentials

Connect it under the guard; read the third-party hosts first. The code names evil.example, kw.com, google.com as well as its own vendor. The guard pins the network to the hosts the honeypot saw.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-14 and scored it 61/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; References a credential file in the home directory; Collapsed <details> block carrying instructions. Summary: calls registry.npmjs.org only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 25 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
4.7sprocessdependency install exit 0
25sfilesystemread ~/.poltertab/config.json · ~/.poltertab/update-check.json outside project
25sfilesystemwrote ~/.poltertab/update-check.json
25snetworkCONNECT tcp://registry.npmjs.org:443
25sclaimed28 tools: browser_navigate, browser_click, browser_fill, browser_scrape, browser_extract, browser_extract_all, browser_screenshot, browser_scroll, browser_hover, browser_get_text, browser_get_title, browser_get_url, browser_snapshot, browser_get_network_state, browser_set_intercept_patterns, browser_smart_scroll, browser_session_create, browser_session_switch, browser_session_list, browser_session_close, browser_session_context, browser_tab_new, browser_tab_list, browser_tab_switch, browser_tab_close
25stools74420f10a55e4ef6
25stoolsd87e4208246b5274
25stools62c24b6ff3a6549e
25stoolse36bdf3aa9c50199
25stools5b38fe4cc54c82ac
25stools392fbe0a392eb406
25stoolsd58b4722c65417e7
25stoolsb30a0673376ce146
25stools3d112ddcd8b743bc
25stoolsd80edc1254391401
25stoolscf1bd3b37dedb381
25stoolsa54fabe344e9a82e
25stools912ef7edbd1b6b43
25stoolsc8cf24d51995332f
25stoolscac5198b5e1700af
25stoolsf3052bdd0543b09b
25stools9cbeb351d68a956b
25stools9048e7b29d3da2e6
25stools9d401280c5d1b6d8
25stools677f2238dd6a51b9
25stools590340144991fabb
25stools7f6b4770f66708cc
25stools4230f8c5a49d5750
25stools722308fe77e5235a
25stoolsf6cfc36dbbe4b221
25stools0eb56a91ee68df7d
25stools0f59fad1e0bb2b3a
25stools820a546dffb56cd2
25sprocessscript backend runs setup only
25sprocessno install scripts to re-run

Static findings

MEDIUM
Access to sensitive file pathsmcp-server/test/group-u.js:126 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ env: { PATH: process.env.PATH, ...env }, encoding: "utf8" },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionbin/uploads.js:33 · File type combined with upload action — agent may exfiltrate local data filesconsole.log("\nUpload configuration (~/.poltertab/config.json)");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/setup.js:249 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(" – uploads skipped enable later: poltertab uploads allow <dir>");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/setup.js:271 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` ${c.green("✓")} uploads folder ${c.dim(folderPath)} (already set)`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/setup.js:260 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(" – uploads skipped (poltertab uploads allow <dir> any time)");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/uploads.js:97 · File type combined with upload action — agent may exfiltrate local data filesconsole.log("\n No upload activity recorded.\n");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/uploads.js:37 · File type combined with upload action — agent may exfiltrate local data filesconsole.log("\n Allowed folders: (none — uploads disabled)");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/setup.js:269 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` ${c.green("✓")} uploads folder ${c.dim(folderPath)}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionbin/uploads.js:143 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(" Upload config access is now enabled for this extension.");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsmcp-server/upload-paths.js:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// bypass the check (e.g. ~/Downloads/key.pem -> ~/.ssh/id_ed25519).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionchrome-extension/options.js:24 · File type combined with upload action — agent may exfiltrate local data files// All data is the server's ~/.poltertab/config.json and uploads.log.jsonl,Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)mcp-server/test/group-d.js:20 · MCP server using network transport (SSE/HTTP) — data sent over networkconsole.log("\nD. mcp-server end-to-end (real processes, fake extension)");Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Access to sensitive file pathsmcp-server/test/group-x.js:108 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Attacker tries to allow ~/.ssh — still blockedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
References a credential file in the home directorymcp-server/upload-paths.js:85 · References a credential file in the home directory// bypass the check (e.g. ~/Downloads/key.pem -> ~/.ssh/id_ed25519).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Process kill commandbin/pair-flow.js:45 · Process kill command — agent can terminate processes// `kill -INT` or a non-raw terminal), as a cancel; the returned functionFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:83 · Collapsed <details> block carrying instructions<summary>Or load it unpacked (developer / offline path)</summary> Use this when you are changing the extension or cannot reach the Web Store. An unpacked extensFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionbin/setup.js:239 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n Let agents upload files from a folder? [${DEFAULT_UPLOAD_FOLDER}]`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Auto-update or dynamic fetch configurationchrome-extension/popup.js:95 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// Version line. An unpacked extension never auto-updates, so a stale oneFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionbin/uploads.js:100 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\nUpload activity log (last ${entries.length} entries)`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionmcp-server/test/group-y.js:49 · File type combined with upload action — agent may exfiltrate local data filesconsole.log("\nY. upload permissions");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Collapsed <details> block carrying instructionssite/index.html:544 · Collapsed <details> block carrying instructions · informational: not an instruction file<summary>Developer or offline? Load the unpacked zip instead.</summary> <ol class="step-list"> <li>Download the latest <a href="https://github.com/abhinav162/poFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languageREADME.md:92 · Authorization escalation language · informational: not an instruction file3. Enable **Developer mode** (top right toggle)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionmcp-server/test/group-x.js:22 · File type combined with upload action — agent may exfiltrate local data filesconsole.log("\nX. file upload feature");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Access to sensitive file pathsmcp-server/test/group-y.js:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Y1 validateAllowlistEntry rejects ~/.ssh, /etc/foo, relative pathsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionmcp-server/tools.js:29 · File type combined with upload action — agent may exfiltrate local data files… a summary (row count, field names, fill rates, two sample records). .jsonl and .csv are written in those formats when the payload carries records, anything else as JSON. A path is reduced to its basename — output cannot be written elsewhe…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filestest/setup.test.js:178 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction filegroup("C CLAUDE.md update");Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filestest/setup.test.js:8 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file// C CLAUDE.md update appends once, never twiceFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Collapsed <details> block carrying instructionssite/index.html:569 · Collapsed <details> block carrying instructions · informational: not an instruction file<summary>Can the agent read my passwords or cookies?</summary> <div class="answer"><p>It can’t open your password manager or Chrome’s cookie store. It sees whatFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
MCP server using network transport (SSE/HTTP)test/setup.test.js:12 · MCP server using network transport (SSE/HTTP) — data sent over network// Same shape as mcp-server/test/run.js — plain asserts, one file, real fs.Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
LOW
Prompt injectionREADME.md:92 · Prompt injection — known jailbreak technique reference · informational: not an instruction file3. Enable **Developer mode** (top right toggle)Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
MCP server using network transport (SSE/HTTP)test/setup.test.js:254 · MCP server using network transport (SSE/HTTP) — data sent over networkfor (const need of ["bin/", "mcp-server/", "skills/", "assets/"]) {Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Access to sensitive file pathsmcp-server/test/group-y.js:52 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesawait test("Y1 validateAllowlistEntry rejects ~/.ssh, /etc/foo, relative paths", () => {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈3,863 tok
2 files · 80 in bundle
Tool list per prompt
≈6,821 tok
28 tools · 244 per tool
Handshake
1272 ms
launch to tools/list, stdio
Undocumented tools
2
description under 20 chars · avg 176

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

19 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim abhinav162: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  3. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  4. References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Access to sensitive file paths≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim abhinav162Propose a patch to the maintainer