vizier@r1
CAUTION· install onlyPublisher claims: "Exposes filesystem operations (read, write, list, move, delete, search), shell command execution, screenshots, mouse and keyboard control, and screen/window inspection as 15 tools plus configuration resources over stdio, SSE, or streamable HTTP. It lets MCP clients drive local computer-use and file management tasks with a fully local model stack." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Install scripts ran; no agent task scenario for this bundle.- Tested
- install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- no vendor host named in the codeAlso huggingface.co — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it under the guard. Install scripts ran; no agent task scenario for this bundle. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is vizier@r1 safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-13 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: README tells the reader to click past SmartScreen; README directs the reader to a committed installer; README tells the reader to click past SmartScreen. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationsStatic findings
directory. The executables are unsigned, so Windows SmartScreen may show “Windows protected your PC”;Fix: Pin versions and sources; vendor anything fetched at install time.get_mcp_server().run(transport="sse", host=host, port=port)Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.get_mcp_server().run(transport="streamable-http", host=host, port=port)Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.When launched with ``vizier mcp-server --stdio`` (or ``--sse`` /Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.1. Download `Vizier-Setup-1.0.0-x64.exe` from the release page (or build it locally withFix: Pin versions and sources; vendor anything fetched at install time.choose **More info → Run anyway** if you built or downloaded the release yourself.Fix: Pin versions and sources; vendor anything fetched at install time.proc = subprocess.run(command, **kwargs)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.args = parser.parse_args(["mcp-server", "--streamable-http", "--port", "9100"])Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.
What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- README tells the reader to click past SmartScreen≈ +9 on the totalPin versions and sources; vendor anything fetched at install time.
- README directs the reader to a committed installer≈ +9 on the totalPin versions and sources; vendor anything fetched at install time.
- Unclaimed publisher≈ +8 on the totalClaim sonamcgoo-dev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
- Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.