Is tongpin@0.2.2 safe to install?

tongpin@0.2.2

VERIFIED· install only

Publisher claims: "Enables multiple AI tools to observe the same local project, share file changes with per-client pagination and acknowledgement, coordinate turn-based collaboration, and exchange private, broadcast, and reply messages through a local mailbox." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher meowcoa · publishing for 2 daysInstalls 0Last detonated 2d ago

$npx skills add tongpin

Watch Report an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.

Tested: every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: no credential variables read in the code
Where it talks to: no vendor host named in the codeAlso agent-plugins.org — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: use of the skill by an agent

Connect it under the guard. Nothing executable in the bundle ran; the trace covers the install step only. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

0.0sprocessno install scripts to re-run

Static findings

HIGH

Access to sensitive file pathsscripts/check-source.mjs:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

…ta)(\/|$)|\.(exe|mcpb|zip|7z|sqlite(?:-.*)?|db(?:-.*)?|key|pem|p12|pfx)$|(^|\/)\.env(?:\.|$)/i.test(file)&&!file.endsWith('.env.example')){bad.push({file,reason:'ge…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsserver/monitor.ts:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

export function secretName(name: string) { return /^\.env(?:\.|$)|^id_(?:rsa|ed25519|ecdsa)(?:\.|$)|\.(?:pem|key|p12|pfx)$|^(?:credentials|secrets)(?:\.|$)/i.test(name); }

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actionserver/http.ts:61 · File type combined with upload action — agent may exfiltrate local data files

app.post('/api/workspace', async (req,res) => { const input = z.object({ path: z.string().min(1).max(4096) }).parse(req.body); res.json(await monitor.select(input.path)); });

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actionserver/http.ts:66 · File type combined with upload action — agent may exfiltrate local data files

…z.string().uuid(),credential_id:z.string().uuid()}).strict().parse(req.body);res.json(store.identity.registerFromUi(input.workspace_id,input.credential_id));}); const workspaceInput=z.object({workspace_id:z.string().uu…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actionscripts/build-mcp-exe.mjs:7 · File type combined with upload action — agent may exfiltrate local data files

…:'node',target:'node24',format:'cjs'}); await writeFile('desktop-dist/sea-config.json',JSON.stringify({main:'desktop-dist/mcp-helper.cjs',output:'desktop-dist/mcp-helper.blob',disableExperimentalSEAWarning:true,useSnapshot:f…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiontests/collaboration.test.ts:91 · File type combined with upload action — agent may exfiltrate local data files

… p of ['../escape','a/../escape','D:\\escape','/absolute','\\\\host\\share','app.txt:stream'])await assert.rejects(()=>call(b,'send_message',{workspace_id:id,...message,related_paths:[p]}),/相对路径/); await ass…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Access to sensitive file pathstests/preview.test.ts:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

…t.equal(response.status,200);assert.ok(!listing.entries.some((e:any)=>e.name==='.env'||e.name==='node_modules')); for(const file of ['../outside.txt','..\\outsi…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstests/integration.test.ts:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

await fs.writeFile(path.join(f.root,'.env'),'excluded test fixture');await fs.mkdir(path.join(f.root,'node_modules'));await fs.writeFile(path.join(f.root,'node_modules','cache.txt'),'excluded');

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actionserver/http.ts:68 · File type combined with upload action — agent may exfiltrate local data files

app.post('/api/turn/force-release',(req,res)=>{const input=workspaceInput.parse(req.body);res.json(store.collaboration.forceRelease(input.workspace_id));});

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actionserver/preview-routes.ts:11 · File type combined with upload action — agent may exfiltrate local data files

…'utf-8','gb18030','utf-16le','utf-16be']).default('auto')}).parse(req.query);res.json(await previewDocument(store,input.workspace_id,input.path,input.encoding));} catch(e){if(e instanceof PreviewError)res.status(e.status).jso…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actionserver/http.ts:71 · File type combined with upload action — agent may exfiltrate local data files

app.post('/api/messages/clear',(req,res)=>{const input=workspaceInput.extend({confirm:z.literal(true)}).strict().parse(req.body);res.json(store.collaboration.clearMessages(input.workspace_id));});

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Access to sensitive file pathstests/preview.test.ts:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

await fs.writeFile(path.join(root,'.env'),'excluded fixture');await fs.mkdir(path.join(root,'node_modules'));await fs.writeFile(path.join(root,'node_modules','hidden.txt'),'excluded');

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstests/integration.test.ts:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

assert.ok(!changes.some(e=>e.path.includes('.env')||e.path.includes('node_modules')||e.path.includes('replacement.tmp')||e.path.startsWith('.work/')||e.path.startsWith('release/')));

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Access to sensitive file pathstests/preview.test.ts:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

…file of ['../outside.txt','..\\outside.txt','C:\\Windows\\win.ini','/absolute','.env','node_modules/hidden.txt','hello.txt:private.txt'])assert.equal((await fetch(f…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actionserver/preview-routes.ts:9 · File type combined with upload action — agent may exfiltrate local data files

…et('/api/files',async(req,res,next)=>{try{const input=query.parse(req.query);res.json(await listWorkspaceFiles(store,input.workspace_id,input.path));}catch(e){if(e instanceof PreviewError)res.status(e.status).json({error:…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiontests/integration.test.ts:61 · File type combined with upload action — agent may exfiltrate local data files

…(path.join(f.root,folder));await fs.writeFile(path.join(f.root,folder,'generated.txt'),'excluded generated output');await assert.rejects(()=>s.monitor.validateRoot(path.join(f.root,folder)),/默认…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actionserver/http.ts:76 · File type combined with upload action — agent may exfiltrate local data files

…join(dir,created.credential_id+'.key'),created.token,{flag:'wx',mode:0o600});res.json({id:created.credential_id,name:input.name});} catch(e){store.identity.revoke(created.credential_id);throw e;} …

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiontests/collaboration.test.ts:93 · File type combined with upload action — agent may exfiltrate local data files

… changes VALUES(?,?,?,?,?,?,?,?,?,?,?,NULL)',other.id,1,alien,'created','foreign.txt',null,null,null,null,new Date().toISOString(),'watcher');await assert.rejects(()=>call(a,'send_message',{workspace_id:id,...message,related_change_ids:[al…

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

Cost to the agent

Instructions loaded

≈765 tok

2 files · 76 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.