reelapi@0.1.0
CAUTIONPublisher claims: "Lets coding agents create and edit video through cloud rendering: animated captions, photo slideshows with voiceover, AI-generated shorts, and arbitrary ffmpeg commands, with finished files saved into the project." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Server started and answered tools/list.- Tested
- MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
- Not tested
- what the tools do when called with real credentials
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- reelsdk.com (its own)Also githubusercontent.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- what the tools do when called with real credentials
Connect it under the guard; read the third-party hosts first. The code names githubusercontent.com as well as its own vendor. The guard pins the network to the hosts the honeypot saw.
$vet-skills run --net declared -- <the server's command>
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-14 and scored it 74/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Hex-encoded string detected; Hex-encoded string detected; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 20 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
20sclaimed6 tools: add_captions, make_slideshow, make_short, run_ffmpeg, get_job, upload_file
20stools07cf2a4418e65f4b
20stools66074af017c88ef4
20stoolsf22c930d9910ba13
20stools8c47985805fe3549
20stools04ae4f3e23994b69
20stools9d6dfe21103672d1
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run
Static findings
MEDIUM
Access to sensitive file pathstest/paths.test.ts:91 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05for (const name of ["../escape.mp4", "../created/escape.mp4", "/etc/passwd", path.join("captions", "..", "..", "escape.srt")]) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiondist/index.js:8 · File type combined with upload action — agent may exfiltrate local data files
AST07…:o}){let s=r.$comment;if(o.$comment===!0)t.code((0,C._)`${L.default.self}.logger.log(${s})`);else if(typeof o.$comment=="function"){let a=(0,C.str)`${n}/$comment`,c=t.scopeValue("root",{ref:e.root});t.code((0,C._)`${L.default.self}.opts.$c…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/index.js:75 · File type combined with upload action — agent may exfiltrate local data files
AST07…let o=await fetch(n,{method:e.method,headers:this.#s(e),body:e.file?DI(e.file):e.json===void 0?void 0:JSON.stringify(e.json),duplex:"half",redirect:"manual",signal:qI(e.signal,e.timeoutMs)}),s=ip(o.headers.get("request-id")),a=await LI(o,t…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.js:75 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…isValid}i(ep,"validateAndWarnToolName");var $a=class{static{i(this,"ExperimentalMcpServerTasks")}constructor(e){this._mcpServer=e}registerToolTask(e,r,n){let o={taskSupport:"required",...r.execution};if(o.taskSupport==="forbidden")throw ne…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.HIGH
Hex-encoded string detecteddist/index.js:78 · Hex-encoded string detected — may contain obfuscated payloads
AST07…F8[79]a/,/^RIFF[\s\S]{4}(?:AVI |WAVE|WEBP)/,/^(?:OggS|fLaC|ID3)/,/^BM[\s\S]{12}[\x0c\x28\x34\x38\x40\x6c\x7c]\x00\x00\x00/],g1=[/^WEBVTT(?:[ \t\r\n]|$)/,/^\[Script Info\]/i,/^\d+[ \t]*\r?\…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
Access to sensitive file pathstest/download.test.ts:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"file:///etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known package.github/workflows/ci.yml:27 · npx invocation of non-well-known package — may execute untrusted code
AST06npx -y ./reelsdk-mcp-*.tgz --versionFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageAGENTS.md:22 · npx invocation of non-well-known package — may execute untrusted code
AST06- No `build`, `prepare`, `prepack`, `install`, `preinstall` or `postinstall` scripts: npm would then run a full dev install whenever someone starts the server with `npx github:bitgate/reelsdk-mcp`.Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Hex-encoded string detectedsrc/sniff.ts:11 · Hex-encoded string detected — may contain obfuscated payloads
AST07/^BM[\s\S]{12}[\x0c\x28\x34\x38\x40\x6c\x7c]\x00\x00\x00/, // BMP, by its DIB header sizeFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.HIGH
Access to sensitive file pathssrc/paths.ts:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// Dot names (.ssh, .env, .aws) count below the project, and anywhere on a path outside itFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstest/tools.test.ts:399 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05await Promise.all([writeFile(path.join(dir, ".env"), MP4), writeFile(path.join(home, ".ssh", "key.mp4"), MP4), writeFile(path.join(home, "vault", "key.mp4"), MP4)]);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiontest/tools.test.ts:530 · File type combined with upload action — agent may exfiltrate local data files
AST07for (const names of [{ inputs: { "CON.mp4": "clip.mp4" } }, { outputs: ["nul"] }, { outputs: ["LPT1.txt"] }, { outputs: ["out."] }]) {Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
URL with embedded credentialstest/unit.test.ts:43 · URL with embedded credentials — may be phishing or credential leaking
AST07["https://user:[email protected]/v2/?debug=1#top", "https://api.example.com/v2"],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstest/tools.test.ts:483 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const outcome = await call(await connect(), "add_captions", { video: "https://media.example.com/v/.env%E2%80%AEgpj.mp4" });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstest/unit.test.ts:142 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05expect(hasHiddenSegment("/home/me/project/.env", "/home/me/project")).toBe(true);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstest/tools.test.ts:404 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05for (const input of [".env", path.join(home, ".ssh", "key.mp4"), "~/.ssh/id_rsa", "innocent.mp4", ".secrets/key.mp4"]) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
URL with embedded credentialstest/tools.test.ts:635 · URL with embedded credentials — may be phishing or credential leaking
AST07video: file("video.mp4").replace("http://", "http://user:hunter2@"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiontest/tools.test.ts:583 · File type combined with upload action — agent may exfiltrate local data files
AST07await symlink(path.join(victim, "precious.txt"), output("clip-captioned.mp4.part"));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Access to sensitive file pathstest/tools.test.ts:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const server = createServer({ REELSDK_KEY: GOOD_KEY, REELSDK_BASE_URL: api.baseUrl, CLAUDE_PROJECT_DIR: dir, REELSDK_WAIT_S: "30", ...env });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
References a credential file in the home directorytest/tools.test.ts:404 · References a credential file in the home directory
AST03for (const input of [".env", path.join(home, ".ssh", "key.mp4"), "~/.ssh/id_rsa", "innocent.mp4", ".secrets/key.mp4"]) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
URL to a private-network addresstest/unit.test.ts:36 · URL to a private-network address — a LAN or development target
AST07for (const url of ["http://api.reelsdk.com", "http://localhost.attacker.com", "http://127.0.0.1.nip.io", "http://10.0.0.5"]) {Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.Cost to the agent
Instructions loaded
≈638 tok
2 files · 32 in bundle
Tool list per prompt
≈2,639 tok
6 tools · 440 per tool
Handshake
542 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 450
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
6 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim bitgate: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Hex-encoded string detected≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
- New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
- Access to sensitive file paths≈ +2 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
- MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim bitgatePropose a patch to the maintainer