tones@r1

VERIFIED· install only

Publisher claims: "Enables Claude to learn a user's writing style from personal samples and retrieve style context, exemplars, and profiles for rewriting and code-comment guidance through MCP." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher back2base · publishing for 1 daysInstalls 0Last detonated 12 h ago

$npx skills add tones

Watch Report an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.

Tested: every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: AUTHAUTH0_CLIAUTH0_CLIENT_IDAUTH0_CLIENT_SECRETAUTH0_DOMAINCLOUDFLARE_API_TOKENUPLOAD_TOKEN or --reveal-secretsConfiguration, not credentials: AI_GATEWAY_ID, ALLOWED_SUBS, CLOUDFLARE_ACCOUNT_ID, COOKIE_ENCRYPTION_KEY, INGEST, INGEST_URL, INGEST_WORKFLOW, LIVE_FILES, MCP_ORIGIN, MODEL_CLASSIFY, MODEL_EMBED, MODEL_GUIDE, PROFILE_WORKFLOW, PUBLIC_ORIGIN, SAMPLES, UPLOAD_USER_ID, VECTORIZE
Where it talks to: no vendor host named in the codeAlso cloudflare.com, openxmlformats.org — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: use of the skill by an agent

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names cloudflare.com, openxmlformats.org as well as its own vendor. The guard injects AUTH, AUTH0_CLI, AUTH0_CLIENT_ID, AUTH0_CLIENT_SECRET, AUTH0_DOMAIN, CLOUDFLARE_API_TOKEN, UPLOAD_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is tones@r1 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

0.0sprocessno install scripts to re-run

Static findings

HIGH

Access to sensitive file pathspackage.json:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"test:live:phase1": "node --env-file-if-exists=.env --experimental-strip-types scripts/acceptance.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathspackage.json:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"test:live": "node --env-file-if-exists=.env --experimental-strip-types scripts/test-mcp-live.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/config.ts:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (!value) throw new Error(`Set ${name} in .env (see .env.example)`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathspackage.json:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"provision": "node --env-file-if-exists=.env --experimental-strip-types scripts/provision.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actionscripts/acceptance.ts:83 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Uploaded ${file}: ${result.sampleId}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

HIGH

Access to sensitive file pathspackage.json:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"gateway:configure": "node --env-file-if-exists=.env --experimental-strip-types scripts/gateway.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathspackage.json:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"test:unit": "node --env-file-if-exists=.env --experimental-strip-types --test tests/*.test.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

Cost to the agent

Instructions loaded

≈33 tok

1 file · 67 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.