Skills/Glama/termux-mcp

termux-mcp@1.0.0

CAUTION

Publisher claims: "Enables MCP clients running on the same Android device to drive Termux over localhost, covering command execution, persistent tmux interactive terminals, background tasks, file management, and Termux:API features like clipboard, notifications, and TTS." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher leemwood · publishing for 1 daysInstalls 0Last detonated 13 h ago
What would fix thisWatchDispute verdict

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
no vendor host named in the codeAlso termux.dev, f-droid.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with real credentials

Connect it under the guard; read the third-party hosts first. The code names termux.dev, f-droid.org as well as its own vendor. The guard pins the network to the hosts the honeypot saw.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-14 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 25 s · 2 scenarios
t+CategoryObserved action
0.0sprocessno install scripts in bundle
4.8sprocessdependency install exit 0
25sfilesystemwrote ~/.config/termux-mcp/config.json.tmp-2238-1794618269558
25sclaimed33 tools: run_command, read_file, write_file, edit_file, list_dir, stat_path, mkdir, copy_path, move_path, delete_path, search_files, system_info, clipboard_get, clipboard_set, notify, toast, vibrate, open, battery_status, tts_speak, termux_api, terminal_create, terminal_write, terminal_read, terminal_list
25stoolseb68fc2da2cf61bd
25stools26a0a20f54380d9c
25stools930b008e567fd0fa
25stools89975cbaba3e79c8
25stools6594238876372fd2
25stools330ca0fac876d2f2
25stoolsd1713af723523b5c
25stools48c78c2cbee1ffa0
25stools82f84df466726fd8
25stools9187b2956a1372bf
25stools3eb2504a6989d91d
25stools536713e7dff93383
25stools6df9a0dccbbbcfe1
25stools3aaf974acab48d8e
25stools57e40ace25984601
25stools3bb8b1c042021ee1
25stools5dd599c63cacbeb1
25stools2c8fdeecca9cde51
25stools38f15b94991d9fa4
25stools321dbc6eaab2a510
25stools0ee54b5b2bd0d0f8
25stoolsfc34905a74a9bd6a
25stools2e6a3fd2592cef35
25stools11f1afc2e2d850fd
25stoolsb156065bd16afd45
25stools1d3f224d494a695d
25stools1d2a8e1eff731f9e
25stools1a65d78320444fcf
25stoolsb756776233bb675d
25stools74a0bf3ec0b04e44
25stoolsbdde7d3744c246d8
25stoolse77f6b643dc64c7f
25stoolsb94264317394a2f0
25sprocessscript backend runs setup only
25sprocessno install scripts to re-run

Static findings

MEDIUM
Process kill commandscripts/stop.sh:26 · Process kill command — agent can terminate processesif kill -0 "$PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/start.sh:89 · Process kill command — agent can terminate processesif ! kill -0 "$PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/install-boot.sh:17 · File permission modification command — agent changes file ownership/permissionschmod +x "$BOOT_FILE"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/stop.sh:12 · Process kill command — agent can terminate processesif [ -z "${PID:-}" ] || ! kill -0 "$PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/start.sh:98 · Process kill command — agent can terminate processeskill "$PID" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/stop.sh:19 · Process kill command — agent can terminate processeskill "$PID" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/install-motd.sh:18 · Process kill command — agent can terminate processesif [ -n "${PID:-}" ] && kill -0 "$PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/ensure-running.sh:31 · File permission modification command — agent changes file ownership/permissionschmod 600 "$LOG_FILE" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/stop.sh:9 · File permission modification command — agent changes file ownership/permissionschmod 700 "$STATE_DIR" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/start.sh:17 · Process kill command — agent can terminate processesif [ -n "${OLD_LOCK_PID:-}" ] && kill -0 "$OLD_LOCK_PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/doctor.sh:98 · Process kill command — agent can terminate processesecho " - Disable Android battery optimization for Termux, otherwise Android may kill it."Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/doctor.sh:100 · Process kill command — agent can terminate processesecho " - Android 12+ may kill phantom processes; see the README troubleshooting section."Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/stop.sh:21 · Process kill command — agent can terminate processesif ! kill -0 "$PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/status.sh:15 · Process kill command — agent can terminate processesif [ -n "${PID:-}" ] && kill -0 "$PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/ensure-running.sh:26 · File permission modification command — agent changes file ownership/permissionschmod 700 "$STATE_DIR" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandscripts/start.sh:12 · File permission modification command — agent changes file ownership/permissionschmod 700 "$STATE_DIR" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/doctor.sh:63 · Process kill command — agent can terminate processesif [ -f "$STATE_DIR/server.pid" ] && kill -0 "$(cat "$STATE_DIR/server.pid" 2>/dev/null)" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/ensure-running.sh:16 · Process kill command — agent can terminate processesif [ -n "${PID:-}" ] && kill -0 "$PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/install-motd.sh:59 · File permission modification command — agent changes file ownership/permissionschmod 700 "$MOTD_FILE"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/start.sh:51 · Process kill command — agent can terminate processesif [ -n "${OLD_PID:-}" ] && kill -0 "$OLD_PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/http.js:223 · MCP server using network transport (SSE/HTTP) — data sent over networkconst mcp = createMcpServer({ config, logger, transport: 'http', audit });Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commandsrc/tasks.js:236 · File permission modification command — agent changes file ownership/permissions// Ignore filesystems without chmod support.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandsrc/terminal.js:558 · Process kill command — agent can terminate processesif (!result.ok) throw new PolicyError(`Failed to kill session: ${result.stderr.trim()}`);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)src/http.js:268 · MCP server using network transport (SSE/HTTP) — data sent over networkconst mcp = createMcpServer({ config, logger, transport: 'sse', audit });Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commandsrc/tasks.js:51 · File permission modification command — agent changes file ownership/permissions// Ignore filesystems without chmod support.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/stop.sh:28 · Process kill command — agent can terminate processeskill -9 "$PID" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandsrc/audit.js:55 · File permission modification command — agent changes file ownership/permissions// Ignore filesystems without chmod support.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈34 tok
1 file · 40 in bundle
Tool list per prompt
≈5,443 tok
33 tools · 165 per tool
Handshake
1335 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 181

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.config/termux-mcp/config.json.tmp-2238-1794618269558.
  2. Unclaimed publisher≈ +8 on the totalClaim leemwood: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  6. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim leemwoodPropose a patch to the maintainer