Is scamcheck@0.13.0 safe to install?

scamcheck@0.13.0

VERIFIED· not started

Publisher claims: "Enables Model Context Protocol agents to triage suspicious messages locally with explainable verdicts, signals, playbooks, and intelligence, while also supporting URL checks, entity extraction, and tamper-evident case creation." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher ctrlanmol · publishing for 3 daysInstalls 0Last detonated 3d ago

$npx skills add scamcheck

Watch Report an issue

Coverage

Not started: dependency install failed; the server itself was not observed.

Tested: install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested: server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: ANTHROPIC_API_KEYOPENAI_API_KEYSCAMCHECK_TELEGRAM_TOKENSCAMCHECK_WHATSAPP_TOKENTELEGRAM_BOT_TOKENWHATSAPP_APP_SECRETWHATSAPP_TOKENWHATSAPP_VERIFY_TOKEN or --bot-tokenConfiguration, not credentials: OPENAI_BASE_URL, PYTHONPATH, SCAMCHECK_AI_MODEL, SCAMCHECK_ANNOUNCE_ALL, SCAMCHECK_BOT_AI, SCAMCHECK_HOME, SCAMCHECK_JARVIS_AI, SCAMCHECK_PYTHON, SCAMCHECK_REGION, SCAMCHECK_ROOT, SCAMCHECK_SAY_CMD, SCAMCHECK_TELEGRAM_API, SCAMCHECK_VISION_MODEL, SCAMCHECK_VOICE_NAME, SCAMCHECK_VOICE_NAME_HI, SCAMCHECK_WATCH_AI, SCAMCHECK_WHATSAPP_API, WHATSAPP_PHONE_NUMBER_ID
Where it talks to: no vendor host named in the codeAlso telegram.org, facebook.com, rdap.org, cybercrime.gov.in, ic3.gov, ftc.gov, identitytheft.gov, police.uk, cyber.gov.au, scamwatch.gov.au, antifraudcentre-centreantifraude.ca, scamshield.gov.sg, police.gov.sg, dubaipolice.gov.ae, netsafe.org.nz, govt.nz, saps.gov.za — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names telegram.org, facebook.com, rdap.org, cybercrime.gov.in, ic3.gov, ftc.gov, identitytheft.gov, police.uk, cyber.gov.au, scamwatch.gov.au, antifraudcentre-centreantifraude.ca, scamshield.gov.sg, police.gov.sg, dubaipolice.gov.ae, netsafe.org.nz, govt.nz, saps.gov.za as well as its own vendor. The guard injects ANTHROPIC_API_KEY, OPENAI_API_KEY, SCAMCHECK_TELEGRAM_TOKEN, SCAMCHECK_WHATSAPP_TOKEN, TELEGRAM_BOT_TOKEN, WHATSAPP_APP_SECRET, WHATSAPP_TOKEN, WHATSAPP_VERIFY_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 3 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessexited 1: ModuleNotFoundError: No module named 'setuptools'

0.2sprocessdependency install exit 1 ·

0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed

0.2sprocessscript backend runs setup only

0.2sprocesssecond launch, clock +45 days, CI unset

0.2sprocessexited 1: ModuleNotFoundError: No module named 'setuptools'

Static findings

MEDIUM

URL using a raw public IP addresstests/samples.py:11 · URL using a raw public IP address — may bypass domain-based filtering"transaction. Verify your details immediately at http://202.51.10.7/secure-hdfc-verify", 2),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedscamcheck/deviceaudit.py:207 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscamcheck/ocr.py:181 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscamcheck/ocr.py:300 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscamcheck/ocr.py:152 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscamcheck/ocr.py:207 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, timeout=60)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscamcheck/cases.py:709 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, timeout=90)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

HTTP URL with a raw public IP addresstests/samples.py:11 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name"transaction. Verify your details immediately at http://202.51.10.7/secure-hdfc-verify", 2),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

HIGH

Access to sensitive file pathsscamcheck/deviceaudit.py:750 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesssh_dir = _expand("~/.ssh")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedtests/test_bot.py:357 · Python subprocess execution detectedproc = subprocess.run([sys.executable, "-m", "scamcheck", "--bot-status", "--json"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL with suspicious TLDtests/samples.py:41 · URL with suspicious TLD — commonly used for phishing/malware"to avoid a $50 late fee: http://dmv-toll-pay.top/eztag", 2),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedscamcheck/ocr.py:210 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscamcheck/jarvis.py:378 · Python subprocess execution detectedproc = subprocess.run(cmd + [text], capture_output=True, timeout=60)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscamcheck/jarvis.py:421 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL with suspicious TLDtests/run_samples.py:72 · URL with suspicious TLD — commonly used for phishing/malware"late fee applies: http://dmv-toll-pay.top/eztag",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Process kill commandscamcheck/recovery.py:62 · Process kill command — agent can terminate processes"bank": "Bank fraud line; activate the kill switch/freeze in your banking app",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Process kill commandscamcheck/conversation.py:154 · Process kill command — agent can terminate processes# --- scoring: shape of the kill chain matters, not the sum of words ---Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedtests/test_cases.py:279 · Python subprocess execution detectedreturn subprocess.run([sys.executable, "-m", "scamcheck"] + list(args),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Remote installer piped to shelltests/test_deviceaudit.py:77 · Remote installer piped to shell"curl -fsSL https://example.com/install.sh | sh")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST07

MEDIUM

Python subprocess execution detectedtests/test_intelligence.py:209 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_jarvis.py:338 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_jarvis.py:82 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_mcp.py:43 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_jarvis.py:354 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_mcp.py:273 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

HTTP URL with a raw public IP addresstests/test_bot.py:249 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name"URGENT: your bank account is suspended. Verify at http://202.51.10.7/hdfc"}},Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedtests/test_intelligence.py:194 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL shortener detectedtests/test_webcli.py:70 · URL shortener detected — destination cannot be verifiedtext="URGENT: your bank account is blocked. Verify KYC now: http://bit.ly/x1",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedtests/test_deviceaudit.py:202 · Python subprocess execution detectedproc = subprocess.run(cmd, cwd=ROOT, env=env, capture_output=True, text=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL shortener detectedtests/test_mcp.py:130 · URL shortener detected — destination cannot be verified"http://bit.ly/x1y2z or your account will be blocked within 24 hours."Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedtests/test_webcli.py:45 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedtests/test_phones.py:46 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Pipe-to-shell patterntests/test_deviceaudit.py:77 · Pipe-to-shell pattern — downloads and immediately executes remote code"curl -fsSL https://example.com/install.sh | sh")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST06

MEDIUM

Process kill commandtests/test_mcp.py:265 · Process kill command — agent can terminate processes# A malformed line must not kill the loop.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

LOW

Account verification phishing language detectedREADME.md:275 · Account verification phishing language detected · informational: not an instruction file- banking / OTP / KYC phishing scripts ("verify your account", "do not share this code")Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

MEDIUM

URL using a raw public IP addresstests/test_bot.py:249 · URL using a raw public IP address — may bypass domain-based filtering"URGENT: your bank account is suspended. Verify at http://202.51.10.7/hdfc"}},Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

Cost to the agent

Instructions loaded

≈203 tok

2 files · 81 in bundle

Tool list per prompt

≈0 tok

0 tools · 0 per tool

Handshake

no reply

launch to tools/list, stdio

Undocumented tools

description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.