Is zeqqat@0.3.2 safe to install?

zeqqat@0.3.2

VERIFIED· install only

Publisher claims: "Open source MCP gateway. Your agent connects to one Zeqqat URL instead of holding your API keys; Zeqqat enforces per-connection permissions, keeps secrets out of the model (handles, not values) and logs every call. Works with Dokploy today and any API from its OpenAPI spec." Observed in sandbox: calls registry.npmjs.org only, touches nothing outside the project, writes no memory.

Registry GlamaPublisher zeqqat · publishing for 7 daysInstalls 0Last detonated 7d ago

$npx skills add zeqqat

Watch Report an issue

Coverage

Install scripts ran; no agent task scenario for this bundle.

Tested: install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: BETTER_AUTH_SECRETDATABASE_URLENABLED_AUTH_PROVIDERSGITHUB_CLIENT_SECRETGOOGLE_CLIENT_SECRETPOSTGRES_PASSWORDRESEND_API_KEYConfiguration, not credentials: DO_NOT_TRACK, GITHUB_CLIENT_ID, GOOGLE_CLIENT_ID, MAIL_FROM, NEXT_RUNTIME, SEGMENT_PATTERN, SMTP_URL, UMAMI_SCRIPT_URL, ZEQQAT_EDITION, ZEQQAT_ENCRYPTION_KEY, ZEQQAT_OPERATOR_KEY, ZEQQAT_PUBLIC_URL, ZEQQAT_TELEMETRY, ZEQQAT_TELEMETRY_URL
Where it talks to: zeqqat.com (its own)Also claude.ai, resend.com — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · reached only registry.npmjs.org
What we could not test: use of the skill by an agent

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names claude.ai, resend.com as well as its own vendor. The guard injects BETTER_AUTH_SECRET, DATABASE_URL, ENABLED_AUTH_PROVIDERS, GITHUB_CLIENT_SECRET, GOOGLE_CLIENT_SECRET, POSTGRES_PASSWORD, RESEND_API_KEY only into requests to zeqqat.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets BETTER_AUTH_SECRET=zeqqat.com,DATABASE_URL=zeqqat.com,ENABLED_AUTH_PROVIDERS=zeqqat.com,GITHUB_CLIENT_SECRET=zeqqat.com,GOOGLE_CLIENT_SECRET=zeqqat.com,POSTGRES_PASSWORD=zeqqat.com,RESEND_API_KEY=zeqqat.com -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-08 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: calls registry.npmjs.org only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 3 s · 2 scenarios · 0 deviations

t+CategoryObserved action

1.1snetworkCONNECT tcp://registry.npmjs.org:443

1.1sprocessexec /usr/local/bin/npx

1.1sprocessexec /tmp/ks-detonate-aefN3M/setup/home/.npm/_npx/0b83cd9ca5e1325c/node_modules/.bin/only-allow

1.1sprocessexited 1: npm warn exec The following package was not found and will be installed: [email protected]

1.2sprocessscript backend runs setup only

2.0sprocesssecond launch, clock +45 days, CI unset

3.2snetworkCONNECT tcp://registry.npmjs.org:443

3.2sprocessexec /usr/local/bin/npx

3.2sprocessexec /tmp/ks-detonate-aefN3M/later/home/.npm/_npx/0b83cd9ca5e1325c/node_modules/.bin/only-allow

3.2sprocessexited 1: (Use `node --trace-warnings ...` to show where the warning was created)

Static findings

MEDIUM

npx invocation of non-well-known packageAGENTS.md:18 · npx invocation of non-well-known package — may execute untrusted code- pnpm — this repo enforces it (`preinstall: npx only-allow pnpm`)Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File type combined with upload actionlib/telemetry.ts:87 · File type combined with upload action — agent may exfiltrate local data files

console.log("[zeqqat] sending an anonymous daily install ping (id and version only). Set ZEQQAT_TELEMETRY=0 to turn it off.");

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Access to sensitive file pathsdocker-compose.yml:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# cp .env.example .env # fill in the valuesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathslib/scrub.ts:145 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// KEY=VALUE, as it appears in an env block or a .env file dump.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packagepackage.json:7 · npx invocation of non-well-known package — may execute untrusted code"preinstall": "npx only-allow pnpm",Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

Cost to the agent

Instructions loaded

≈6,840 tok

3 files · 80 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.