Is aftermath@0.5.3 safe to install?

aftermath@0.5.3

BLOCKED· install only

Publisher claims: "Post-failure recovery skill for AI coding agents: stop, revert cheap damage, return to last-known-good. Project-aware destructive guards, forward-edit freeze, checkpoints, and host parity for OpenCode, Claude Code, and Codex." Observed in sandbox: sends data to fd12:ea5f:789c:1:5000:26:7c6e:98db, 10.238.152.219.

Registry npm (MCP server)Publisher after.math · publishing for 7 daysInstalls 256Last detonated 3 h ago

What would fix this Watch Dispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.

Tested: install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-14 and scored it 35/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Destructive file system command detected; Direct script execution from GitHub raw URL; Access to sensitive file paths. Summary: sends data to fd12:ea5f:789c:1:5000:26:7c6e:98db, 10.238.152.219.

Behavior trace

Honeypot run · 10 s · 2 scenarios

t+CategoryObserved action

0.0sprocessinstall script run in the sandbox

1.8snetworkdirect connection to fd12:ea5f:789c:1:5000:26:7c6e:98db:0, bypassing the egress proxy · undeclared

1.8snetworkdirect connection to 10.238.152.219:0, bypassing the egress proxy · undeclared

1.8sfilesystemread ~/.config/aftermath/repo/.git/config · ~/.config/aftermath/repo/.git/packed-refs · ~/.config/aftermath/repo/.git/HEAD · ~/.config/aftermath/repo/.git/refs/ · ~/.config/aftermath/repo/.git/info/grafts · ~/.config/aftermath/repo/.git/shallow outside project

1.8sfilesystemwrote ~/.config/aftermath/repo/.git/description · ~/.config/aftermath/repo/.git/info/exclude · ~/.config/aftermath/repo/.git/hooks/pre-rebase.sample · ~/.config/aftermath/repo/.git/hooks/push-to-checkout.sample · ~/.config/aftermath/repo/.git/hooks/pre-merge-commit.sample · ~/.config/aftermath/repo/.git/hooks/update.sample

1.8snetworkCONNECT tcp://github.com:443

1.8sprocessexec /app/apps/web/node_modules/.bin/git

1.8sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/git

1.8sprocessexec /app/node_modules/.bin/git

1.8sprocessexec /pnpm/git

1.8sprocessexec /usr/local/sbin/git

1.8sprocessexec /usr/local/bin/git

1.8sprocessexec /usr/sbin/git

1.8sprocessexec /usr/bin/git

1.8sprocessexec /usr/lib/git-core/git

1.8sprocessexec /usr/lib/git-core/git-remote-https

1.8sprocessexec /app/apps/web/node_modules/.bin/codex

1.8sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/codex

1.8sprocessexec /app/node_modules/.bin/codex

1.8sprocessexec /pnpm/codex

1.8sprocessexec /usr/local/sbin/codex

1.8sprocessexec /usr/local/bin/codex

1.8sprocessexec /usr/sbin/codex

1.8sprocessexec /usr/bin/codex

1.8sprocessexec /sbin/codex

1.8sprocessexec /bin/codex

1.8sprocessinstall script run in the sandbox

4.0snetworkdirect connection to fd12:ea5f:789c:1:5000:26:7c6e:98db:0 (×2), bypassing the egress proxy · undeclared

4.0snetworkdirect connection to 10.238.152.219:0 (×2), bypassing the egress proxy · undeclared

4.0sfilesystemread ~/.config/aftermath/repo/.git/HEAD · ~/.config/aftermath/repo/scripts/package.json · ~/.config/aftermath/repo/package.json · ~/.config/aftermath/repo/scripts/install.js · ~/.config/opencode/opencode.json · ~/.config/aftermath/repo/.opencode/commands outside project

4.0sfilesystemwrote ~/.config/aftermath/repo/.git/objects/maintenance.lock · ~/.config/aftermath/repo/.git/index.lock · ~/.config/aftermath/repo/.git/HEAD.lock · ~/.config/aftermath/repo/.git/ORIG_HEAD.lock

4.0snetworkCONNECT tcp://github.com:443

4.0sprocessexec /usr/bin/git

4.0sprocessexec /usr/lib/git-core/git

4.0sprocessexec /usr/lib/git-core/git-remote-https

4.0sprocessexec /app/apps/web/node_modules/.bin/git

4.0sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/git

4.0sprocessexec /app/node_modules/.bin/git

4.0sprocessexec /pnpm/git

4.0sprocessexec /usr/local/sbin/git

4.0sprocessexec /usr/local/bin/git

4.0sprocessexec /usr/sbin/git

4.0sprocessexec /app/apps/web/node_modules/.bin/codex

4.0sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/codex

4.0sprocessexec /app/node_modules/.bin/codex

4.0sprocessexec /pnpm/codex

4.0sprocessexec /usr/local/sbin/codex

4.0sprocessexec /usr/local/bin/codex

4.0sprocessexec /usr/sbin/codex

4.0sprocessexec /usr/bin/codex

4.0sprocessexec /sbin/codex

4.0sprocessexec /bin/codex

4.0sprocessscript backend runs setup only

6.0sprocesssecond launch, clock +45 days, CI unset

7.3snetworkdirect connection to fd12:ea5f:789c:1:5000:26:7c6e:98db:0, bypassing the egress proxy · undeclared

7.3snetworkdirect connection to 10.238.152.219:0, bypassing the egress proxy · undeclared

7.3sfilesystemread ~/.config/aftermath/repo/.git/HEAD · ~/.config/opencode/opencode.json · ~/.config/aftermath/repo/.opencode/commands outside project

7.3sfilesystemwrote ~/.config/aftermath/repo/.git/objects/maintenance.lock · ~/.config/aftermath/repo/.git/index.lock · ~/.config/aftermath/repo/.git/HEAD.lock · ~/.config/aftermath/repo/.git/ORIG_HEAD.lock

7.3snetworkCONNECT tcp://github.com:443

7.3sprocessexec /app/apps/web/node_modules/.bin/git

7.3sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/git

7.3sprocessexec /app/node_modules/.bin/git

7.3sprocessexec /pnpm/git

7.3sprocessexec /usr/local/sbin/git

7.3sprocessexec /usr/local/bin/git

7.3sprocessexec /usr/sbin/git

7.3sprocessexec /usr/bin/git

7.3sprocessexec /usr/lib/git-core/git

7.3sprocessexec /usr/lib/git-core/git-remote-https

7.3sprocessexec /app/apps/web/node_modules/.bin/codex

7.3sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/codex

7.3sprocessexec /app/node_modules/.bin/codex

7.3sprocessexec /pnpm/codex

7.3sprocessexec /usr/local/sbin/codex

7.3sprocessexec /usr/local/bin/codex

7.3sprocessexec /usr/sbin/codex

7.3sprocessexec /usr/bin/codex

7.3sprocessexec /sbin/codex

7.3sprocessexec /bin/codex

9.5snetworkdirect connection to fd12:ea5f:789c:1:5000:26:7c6e:98db:0 (×2), bypassing the egress proxy · undeclared

9.5snetworkdirect connection to 10.238.152.219:0 (×2), bypassing the egress proxy · undeclared

9.5sfilesystemread ~/.config/aftermath/repo/.git/HEAD · ~/.config/aftermath/repo/scripts/package.json · ~/.config/aftermath/repo/package.json · ~/.config/aftermath/repo/scripts/install.js · ~/.config/opencode/opencode.json · ~/.config/aftermath/repo/.opencode/commands outside project

9.5sfilesystemwrote ~/.config/aftermath/repo/.git/objects/maintenance.lock · ~/.config/aftermath/repo/.git/index.lock · ~/.config/aftermath/repo/.git/HEAD.lock · ~/.config/aftermath/repo/.git/ORIG_HEAD.lock

9.5snetworkCONNECT tcp://github.com:443

9.5sprocessexec /usr/bin/git

9.5sprocessexec /usr/lib/git-core/git

9.5sprocessexec /usr/lib/git-core/git-remote-https

9.5sprocessexec /app/apps/web/node_modules/.bin/git

9.5sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/git

9.5sprocessexec /app/node_modules/.bin/git

9.5sprocessexec /pnpm/git

9.5sprocessexec /usr/local/sbin/git

9.5sprocessexec /usr/local/bin/git

9.5sprocessexec /usr/sbin/git

9.5sprocessexec /app/apps/web/node_modules/.bin/codex

9.5sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/codex

9.5sprocessexec /app/node_modules/.bin/codex

9.5sprocessexec /pnpm/codex

9.5sprocessexec /usr/local/sbin/codex

9.5sprocessexec /usr/local/bin/codex

9.5sprocessexec /usr/sbin/codex

9.5sprocessexec /usr/bin/codex

9.5sprocessexec /sbin/codex

9.5sprocessexec /bin/codex

Static findings

HIGH

Destructive file system command detectedhooks/aftermath-signals.cjs:21 · Destructive file system command detected/\brm\s+-[a-zA-Z]*r\b/i, // rm -rFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Direct script execution from GitHub raw URLscripts/install.sh:41 · Direct script execution from GitHub raw URL — unverified code sourcecurl -fsSL https://raw.githubusercontent.com/moah0911/aftermath/main/scripts/install.sh \Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File permission modification commandskills/destructive-action/SKILL.md:33 · File permission modification command — agent changes file ownership/permissions| Permissions | `chmod -R 777` | Narrow the mode and the path |Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

HIGH

Access to sensitive file pathsscripts/init.js:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst ALWAYS_PROTECTED = ['.git', '.env*', 'secrets*', '*.pem', '*.key'];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Destructive file system command detectedhooks/aftermath-signals.cjs:20 · Destructive file system command detected/\brm\s+[^|&;]*-[a-zA-Z]*f[a-zA-Z]*r/i, // rm -frFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

npx invocation of non-well-known package.opencode/commands/aftermath-init.md:9 · npx invocation of non-well-known package — may execute untrusted code

1. Run `npx @after.math/aftermath init $ARGUMENTS` (or `node <aftermath-root>/scripts/init.js $ARGUMENTS` from a checkout).

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packageskills/test-regression/SKILL.md:29 · npx invocation of non-well-known package — may execute untrusted code| Jest / Vitest | `✕`, `1 failed`, `FAIL` | `npx jest auth.spec -t "login"` |Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

CRITICAL

Destructive command against a filesystem root or devicehooks/aftermath-signals.cjs:19 · Destructive command against a filesystem root or device/\brm\s+[^|&;]*-[a-zA-Z]*r[a-zA-Z]*f/i, // rm -rf / rm -RfFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedscripts/make-logo.py:61 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

Destructive file system command detectedhooks/aftermath-signals.cjs:19 · Destructive file system command detected/\brm\s+[^|&;]*-[a-zA-Z]*r[a-zA-Z]*f/i, // rm -rf / rm -RfFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Direct script execution from GitHub raw URLscripts/install.sh:4 · Direct script execution from GitHub raw URL — unverified code source# curl -fsSL https://raw.githubusercontent.com/moah0911/aftermath/main/scripts/install.sh \Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packageskills/test-regression/SKILL.md:33 · npx invocation of non-well-known package — may execute untrusted code| Mocha | `1 failing` | `npx mocha tests/auth.spec.js --grep login` |Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagecommands/aftermath-init.md:9 · npx invocation of non-well-known package — may execute untrusted code

1. Run `npx @after.math/aftermath init $ARGUMENTS` (or `node <aftermath-root>/scripts/init.js $ARGUMENTS` from a checkout).

Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

Cost to the agent

Instructions loaded

≈6,613 tok

10 files · 53 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for @after.math/aftermath@0.5.3 as of 2 h ago. This is the package itself, not its dependencies.

What would make this Verified

45 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.config/aftermath/repo/.git/config, ~/.config/aftermath/repo/.git/packed-refs, ~/.config/aftermath/repo/.git/HEAD.
Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Unclaimed publisher≈ +8 on the totalClaim after.math: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.

Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim after.math Propose a patch to the maintainer

Watch this skill

One email when aftermath gets a new release, its verdict moves, or the maintainer changes. Free, no account needed.

Safer alternatives

Verified skills that do a similar job.

google-agents-cli-eval88 · Verified
google · skills.sh · 571,253 installs · failure, agents, project
code-review95 · Verified
mattpocock · skills.sh · 893,100 installs · coding, agents, code
microsoft-foundry92 · Verified
microsoft · skills.sh · 713,900 installs · failure, agents, project

README badge

Shows the live score and label; updates itself as new versions are detonated. Paste into your README or registry listing:

[![KillerSkills verdict for aftermath](https://killerskills.ai/badge/npm/aftermath.svg)](https://killerskills.ai/skills/npm/aftermath?ref=badge)

Version history

0.5.335 · Blocked

Stable for 0 days. Same maintainers since first release.

Declared permissions

networknone

filesystem./ (project)

memorynone

2 of 3 declarations violated in sandbox.

Block it everywhere

vet-skills block aftermath
--org acme --reason "v_4c06"