verbaly@r1
CAUTION· install onlyPublisher claims: "The i18n cycle of a JavaScript project as tools: extract the texts written in code, list missing translations and write machine translations as drafts that a person approves. Works with React, Vue, Svelte, Next.js, Nuxt, SvelteKit and Astro." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- no vendor host named in the code
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it under the guard. Nothing executable in the bundle ran; the trace covers the install step only. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is verbaly@r1 safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 69/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: document.cookie access; HTML comment carrying imperative instructions to the agent; HTML comment carrying imperative instructions to the agent. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
document.cookie = `${cookie}=${encodeURIComponent(locale)}; path=/; max-age=${maxAge}; samesite=lax`;Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.message: 'Read the <docs>guide</docs>' → a real <a>; hrefs from you, never from messagesFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.message: '[verbaly] no catalogs here, run npx verbaly init or check --root',Fix: Pin versions and sources; vendor anything fetched at install time.…put too; `failOnMissing: true` makes the build stop instead. 4. **Translate**: `npx verbaly translate` fills gaps with the configured provider (default Claude, needs `ANTH…Fix: Pin versions and sources; vendor anything fetched at install time.……`}``, Astro ``{t`…`}``. Display-only text is never extracted. 2. **Extract**: `npx verbaly extract` scans sources, fills `locales/<locale>.json` and refreshes the generat…Fix: Pin versions and sources; vendor anything fetched at install time.…or the framework integrations) dev-mode extraction is automatic. 3. **Check**: `npx verbaly check` exits 1 while a translation is missing or broken, a key written in the c…Fix: Pin versions and sources; vendor anything fetched at install time.prettier-ignoreFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.// it exited between the check and the killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.// The url is built inside the try: `GET //` throws, and out here that would kill the process.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
11 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Text that tells the agent to ignore its instructions≈ +9 on the totalDelete phrases like "ignore previous instructions", "override", "bypass" from SKILL.md and tool descriptions. Describe what the skill does; do not instruct the agent about other rules.
- Unclaimed publisher≈ +8 on the totalClaim aronsoto: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
- document.cookie access≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
- Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.