undoweave@0.4.0
CAUTION· not startedPublisher claims: "Enables agents to record file edits and selectively reverse a chosen edit while preserving separate later work, requiring preview approval and refusing ambiguous overlaps." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- no vendor host named in the code
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it under the guard. Not started: dependency install failed; the server itself was not observed. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.
$vet-skills run --net declared -- <the server's command>
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathssrc/undoweave/engine.py:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…, "id_rsa", "id_ed25519", "id_ecdsa", "id_dsa", ".git-credentials", ".pgpass", ".netrc", ".npmrc", ".pypirc"} DEVICE = re.compile(r"^(CON|PRN|AUX|NUL|CONIN\$|CONOUT\$…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/undoweave/engine.py:423 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if (lowered in PROTECTED_DIRS or lowered in PROTECTED_NAMES or lowered == ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/undoweave/engine.py:424 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05or lowered.startswith(".env.") or lowered.endswith((".pem", ".key", ".p12", ".pfx", ".sqlite", ".sqlite3"))):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedbenchmarks/aider_runner.py:68 · Python subprocess execution detected
AST05result = subprocess.run(["git", *args], cwd=root, text=True, capture_output=True, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedbenchmarks/compare.py:101 · Python subprocess execution detected
AST05…json.loads((HERE / "fixtures.json").read_text(encoding="utf-8")) baseline = subprocess.run(["node", str(HERE / "pi_rewind_runner.mjs"), str(args.pi_rewind.resolve() / "src…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathssrc/undoweave/recorder.py:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05or part.casefold() == '.env' or part.casefold().startswith(('.env.', '.undoweave-write-'))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedbenchmarks/compare.py:21 · Python subprocess execution detected
AST05sha = subprocess.run(["git", "-C", str(checkout), "rev-parse", "HEAD"], text=True, capture_output=True, check=True).stdout.strip()Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathssrc/undoweave/engine.py:436 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05or lowered.startswith(".env.") or lowered.endswith((".pem", ".key", ".p12", ".pfx", ".sqlite", ".sqlite3"))):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/undoweave/engine.py:435 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if (lowered in PROTECTED_DIRS or lowered in PROTECTED_NAMES or lowered == ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedbenchmarks/compare.py:117 · Python subprocess execution detected
AST05…e__).read_bytes()).hexdigest(), } if args.aider_source: aider = subprocess.run([str(args.aider_python), str(HERE / "aider_runner.py"), str(args.aider_source), …Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedbenchmarks/compare.py:67 · Python subprocess execution detected
AST05subprocess.run(["git", *arguments], cwd=root, text=True, capture_output=True, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionbenchmarks/compare.py:101 · File type combined with upload action — agent may exfiltrate local data files
AST07…r.mjs"), str(args.pi_rewind.resolve() / "src" / "core.ts"), str(HERE / "fixtures.json")], text=True, encoding="utf-8", capture_output=True, check=True, timeout=180) data = { "schema_version": 1, …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionbenchmarks/compare.py:117 · File type combined with upload action — agent may exfiltrate local data files
AST07…on), str(HERE / "aider_runner.py"), str(args.aider_source), str(HERE / "fixtures.json")], text=True, encoding="utf-8", capture_output=True, check=True, timeout=180) data["aider"] = json.loads(aider.stdout)…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Python subprocess execution detectedbenchmarks/compare.py:24 · Python subprocess execution detected
AST05dirty = subprocess.run(["git", "-C", str(checkout), "status", "--porcelain", "--untracked-files=no"], text=True, capture_output=True, check=True).stdoutFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_onboarding.py:249 · Python subprocess execution detected
AST05result = subprocess.run([program, '-NoProfile', '-NonInteractive', '-Command',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/check_wheel.py:24 · Python subprocess execution detected
AST05subprocess.run([str(interpreter), str(repository / "scripts" / "smoke_install.py")], check=True, env=environment, cwd=base, timeout=120)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/check_wheel.py:23 · Python subprocess execution detected
AST05subprocess.run([str(interpreter), "-I", "-m", "undoweave", "demo", "--recording"], check=True, env=environment, cwd=base, stdout=subprocess.DEVNULL, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_onboarding.py:259 · Python subprocess execution detected
AST05result = subprocess.run([program, '-c', line + '\npwd -P'], cwd=self.base,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_presentation.py:51 · Python subprocess execution detected
AST05result = subprocess.run([sys.executable, "-I", "-m", "undoweave", "--root", str(root), "--state-dir", str(state), "history", "--format", "html"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedbenchmarks/efficiency.py:233 · Python subprocess execution detected
AST05actual = json.loads(subprocess.check_output([sys.executable, "-I", "-c", probe], cwd=temporary, text=True, timeout=30))Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_recorder.py:424 · Python subprocess execution detected
AST05init = subprocess.run(['git', '-C', str(self.root), 'init', '--quiet', '--template=' + str(empty)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/check_wheel.py:22 · Python subprocess execution detected
AST05subprocess.run([str(interpreter), "-I", "-m", "undoweave", "demo"], check=True, env=environment, cwd=base, stdout=subprocess.DEVNULL, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_onboarding.py:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05for name in ('.env', 'secret.py', 'local.py', 'main.py', 'notes.txt'):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_cli.py:33 · Python subprocess execution detected
AST05return subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/smoke_install.py:50 · Python subprocess execution detected
AST05setup = subprocess.run([sys.executable, '-I', '-m', 'undoweave', '--state-dir', str(selected_state),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Bidirectional text override characters detectedtests/test_recovery_display.py:331 · Bidirectional text override characters detected — may hide content direction
AST07preview = self.preview_of("b.txt", b"safe\n", "safe\n")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Python subprocess execution detectedtests/test_security.py:107 · Python subprocess execution detected
AST05made = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/smoke_install.py:38 · Python subprocess execution detected
AST05config = subprocess.run([sys.executable, "-I", "-m", "undoweave", "--root", str(project), "config"], check=True, capture_output=True, encoding="utf-8", timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_cli_encoding.py:51 · Python subprocess execution detected
AST05return subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedbenchmarks/efficiency.py:63 · Python subprocess execution detected
AST05actual = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_git_invariants.py:75 · Python subprocess execution detected
AST05return subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_recorder.py:116 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05(self.root / 'src' / '.env').write_bytes(b'private canary\n')Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_cli.py:302 · Python subprocess execution detected
AST05proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedbenchmarks/recording/run.py:168 · Python subprocess execution detected
AST05result = subprocess.run(child_command(request), cwd=output, capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_recorder.py:435 · Python subprocess execution detected
AST05oracle = subprocess.run(['git', '-C', str(self.root), '-c', 'core.ignorecase=true',Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_security.py:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05".env", ".env.local", "nested/.env.production", ".git/config",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Access to sensitive file pathstests/test_recorder.py:194 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05for value in ('.', '../x', '.env', 'node_modules', '.codex/config.toml', 'src/tokens.json'):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_exact_edits.py:71 · Python subprocess execution detected
AST05response = subprocess.run([sys.executable, "-I", "-m", "undoweave", "--root", str(self.root), "--state-dir", str(self.state), *arguments], capture_output=True, encoding="utf-8", timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedbenchmarks/efficiency.py:68 · Python subprocess execution detected
AST05baseline_source = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_recorder.py:277 · Python subprocess execution detected
AST05process = subprocess.run([sys.executable, '-I', '-c', script, str(self.root), str(self.base / 'state')],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_onboarding.py:268 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05('setup', '--watch', 'missing'), ('setup', '--watch', '.env'),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_security.py:608 · Python subprocess execution detected
AST05process_b = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandsrc/undoweave/engine.py:397 · File permission modification command — agent changes file ownership/permissions
AST05raise UndoWeaveError("unsafe_state", "Journal must have owner-only permissions (chmod 600).")Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedtests/test_cli.py:217 · Python subprocess execution detected
AST05proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_mcp.py:300 · Python subprocess execution detected
AST05proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_security.py:602 · Python subprocess execution detected
AST05process_a = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedscripts/check_wheel.py:21 · Python subprocess execution detected
AST05subprocess.run([str(interpreter), "-m", "pip", "install", "-c", str(repository / "constraints.txt"), str(wheels[0]) + "[mcp]"], check=True, env=environment, cwd=base, timeout=180)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Access to sensitive file pathstests/test_security.py:384 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05for name in ("credentials.json", ".env.production"):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedbenchmarks/recording/run.py:184 · Python subprocess execution detected
AST05self.process = subprocess.Popen(child_command({"mode": "record", "root": str(root), "state": str(state), "scopes": scopes}),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_isolated_startup.py:54 · Python subprocess execution detected
AST05generated = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Hidden zero-width characters detectedtests/test_recovery_display.py:331 · Hidden zero-width characters detected — may conceal content
AST07preview = self.preview_of("b.txt", b"safe\n", "safe\n")Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
File permission modification commandsrc/undoweave/engine.py:127 · File permission modification command — agent changes file ownership/permissions
AST05raise UndoWeaveError("unsafe_state", "State directory must have owner-only permissions (chmod 700).")Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedtests/test_exact_edits.py:90 · Python subprocess execution detected
AST05return subprocess.run([sys.executable, "-I", "-m", "undoweave", "--root", str(self.root), "--state-dir", str(self.state), *arguments], capture_output=True, encoding="utf-8", timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈1,891 tok
2 files · 70 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim jgolding1998: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
- Bidirectional text override characters detected≈ +2 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
- File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim jgolding1998Propose a patch to the maintainer