Skills/npm/actors-mcp-server

actors-mcp-server@0.19.3

CAUTION

Publisher claims: "Apify MCP Server" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher apify · joined 0 days agoInstalls 102KLast detonated 2 h ago
Dispute verdict

Behavior trace

Honeypot run · 2 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
1.6sprocessdependency install exit 1
1.9sprocessexec /usr/bin/timeout
1.9sprocessexited 1: Node.js v22.23.4
1.9sclaimedno tools/list reply (exit 1)
1.9sprocessscript backend runs setup only

Static findings

CRITICAL
Access to sensitive file pathsREADME.md:512 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/apify_client.js:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/apify_client.js:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/dev_server.js:319 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/payments/const.js:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/dev_server.js:320 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/apify_client.js:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/apify_client.js:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/apify_client.js:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/dev_server.js:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/instrument.js:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/mcp/server.js:265 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/dev_server.js:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/mcp/server.js:271 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/dev_server.js:98 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/mcp/actors.js:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/stdio.js:97 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/telemetry.js:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageREADME.md:78 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageREADME.md:374 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageREADME.md:77 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)README.md:13 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
HIGH
npx invocation of non-well-known packageREADME.md:368 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.d.ts:3 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)dist/dev_server.js:120 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
HIGH
npx invocation of non-well-known packagedist/stdio.js:107 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)README.md:14 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
CRITICAL
Credential pass-through configurationdist/utils/auth.js:27 · Credential pass-through configuration — agent relays sensitive credentials
AST02
HIGH
npx invocation of non-well-known packageREADME.md:408 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)README.md:15 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
CRITICAL
Access to sensitive file pathsdist/stdio.js:62 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)README.md:562 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
CRITICAL
Access to sensitive file pathsdist/stdio.js:121 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)README.md:33 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.js:10 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.js:3 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04
actors-mcp-server@0.19.3 safety verdict: Caution 63/100 — KillerSkills