Skills/Glama/service-test-mcp

service-test-mcp@1.0.0

BLOCKED· not started

Publisher claims: "Enables AI agents to test WCF/SOAP and REST services directly, with WSDL discovery, authenticated calls, and deterministic assertions. Supports YAML multi-step scenarios with variable extraction, JSONPath/JSON Schema checks, and CI runs without spawning PowerShell or curl." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher ohankay · publishing for 1 daysInstalls 0Last detonated 19 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Blocked here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Revoked: guards refuse to launch this version

confirmed incident: README sends the reader to a committed installer (installer lure) Every machine running vet-skills guard stops starting it at the next launch; the state clears when the honeypot re-run or a reviewer clears it.

Before you give it your token

It will ask for
STM_HTTP_TOKENConfiguration, not credentials: STM_AGENT_AZURE_API_VERSION, STM_AGENT_BASE_URL, STM_AGENT_MCP_URL, STM_AGENT_MODEL, STM_AGENT_SYSTEM_PROMPT, STM_AGENT_VERIFY_TLS, STM_AUDIT, STM_AUDIT_DIR, STM_CONFIG, STM_ENV, STM_HOME, STM_HTTP_HOST, STM_HTTP_PORT, STM_MAX_RESPONSE_CHARS
Where it talks to
no vendor host named in the codeAlso sirket.local, tempuri.org, xmlsoap.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Do not connect it. The honeypot or a critical finding blocked this version; the evidence is below.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 10/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: README links to a committed installer. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

MEDIUM
Python subprocess execution detectedscripts/build_bundle.py:91 · Python subprocess execution detectedsubprocess.run([sys.executable, "-m", "pip", *args, "--disable-pip-version-check", "-q"], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionsrc/service_test_mcp/scenario/template.py:99 · File type combined with upload action — agent may exfiltrate local data files"the server's env in mcp.json with an ${input:...})")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedtests/test_e2e_stdio.py:98 · Python subprocess execution detectedproc = subprocess.Popen([sys.executable, "-m", "service_test_mcp", "--transport", "http", "--port", str(port)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Prompt injectionREADME.md:3 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…usu. VS Code'da GitHub Copilot (Agent modu, custom agent'lar) ile ya da VS Code'dan bağımsız herhangi bir MCP istemcisi / AI ajanıyla kullanılır. [sql-mcp-simple](…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
File type combined with upload actionsrc/service_test_mcp/config.py:73 · File type combined with upload action — agent may exfiltrate local data filesf"\"env\" in mcp.json, e.g. \"{env_name}\": \"${{input:{env_name.lower().replace('_', '-')}}}\", plus a "Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Prompt injectionbundle/KURULUM_REHBERI.md:29 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…san kullanıcıya hatayı olduğu gibi göster. > > **Kesin kurallar:** > - Kullanıcıdan şifre veya token İSTEME; bunları hiçbir dosyaya, komuta, ortam değişkenine veya…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
File type combined with upload actionbundle/templates/services.yaml:2 · File type combined with upload action — agent may exfiltrate local data files# Sifre / token bu dosyaya YAZILMAZ: *_env alanlari, mcp.json "env" icindeki ${input:...} degiskenlerini gosterir.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/service_test_mcp/engine.py:64 · File type combined with upload action — agent may exfiltrate local data files"STM_CONFIG to it in mcp.json, or put it at %USERPROFILE%\\.service-test-mcp\\services.yaml")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Prompt injectionREADME.md:159 · Prompt injection — known jailbreak technique reference · informational: not an instruction file## VS Code'dan bağımsız kullanımFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Python subprocess execution detectedscripts/build_bundle.py:59 · Python subprocess execution detectedsubprocess.run(cmd, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionsrc/service_test_mcp/agent/cli.py:5 · File type combined with upload action — agent may exfiltrate local data filesservice-test-agent --prompt-file gorev.txt --output rapor.mdFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Prompt injectionREADME.md:193 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…` ve SecureConversation'lı mesaj güvenliği (`wsHttpBinding` varsayılanı) Python'dan çağrılamaz. Test ortamında ek bir `basicHttpBinding` endpoint'i istemek en temi…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
README links to a committed installerREADME.md → https://github.com/ohankay/service-test-mcp-simple/raw/main/release/service-test-mcp-simple-windows-x64.ziphttps://github.com/ohankay/service-test-mcp-simple/raw/main/release/service-test-mcp-simple-windows-x64.zipFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈172 tok
2 files · 47 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

70 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

An override rule (installer_lure) caps this verdict regardless of the score. The first item below has to go before anything else counts.

  1. README links to a committed installer≈ +9 on the totalPin versions and sources; vendor anything fetched at install time.
  2. Unclaimed publisher≈ +8 on the totalClaim ohankay: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ohankayPropose a patch to the maintainer