Skills/npm/agent-hooks

agent-hooks@1.9.141

CAUTION· not started

Publisher claims: "Human-in-the-loop (HITL) for AI agents: ask a person for approvals or answers by push notification. One command connects Claude Code, Codex, Cursor, Gemini CLI and more." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher pushary · publishing for 190 daysInstalls 18,092Last detonated 36 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
API_KEY_PREFIX_SHAPEPARTNER_API_KEYS_URLPUSHARY_API_KEYSHELL_INERT_URL_PASSWORD_UNIT or --no-ask-password / --with-tokenConfiguration, not credentials: CLAIM_PATH, CLAUDE_CONFIG_DIR, CLIENT_REPORT_PATH, CODEX_EVENT_KEY, CODEX_HOME, DEVICE_KEY_PATH, DISPLAY, EPISODE_PATH, GEMINI_CLI_HOME, GROK_SESSION_ID, IDENTITY_PATH, OPENCODE_CONFIG_DIR, PATHEXT, PLUGIN_LOCATIONS_KEY, ProgramFiles, ProgramW6432, PUSHARY_ADMISSION_FILE, PUSHARY_API_URL, PUSHARY_APP_REGISTER_TIMEOUT_MS, PUSHARY_AUTO_DECISION_BEACON, PUSHARY_BASE_URL, PUSHARY_BELL_QUIET, PUSHARY_BELL_UPGRADE_AT, PUSHARY_COMMAND_DIR, PUSHARY_CONFIG_FILE, PUSHARY_LEDGER_FILE, PUSHARY_MCP_PATH_PREFIX, PUSHARY_MODEL_PRICING, PUSHARY_NO_BROWSER, PUSHARY_PIN_GLOBAL_VERSION, PUSHARY_RECEIPTS, PUSHARY_RECIPIENT_PIN_FILE, PUSHARY_SESSION_KEY_DIR, PUSHARY_SPAWN_ID, PUSHARY_SUPPRESS_KEY_DRIFT_WARNING, PUSHARY_TASK_TITLES
Where it talks to
pushary.com (its own)Also nodejs.org, claude.ai, discord.gg, apple.com, microsoft.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names nodejs.org, claude.ai, discord.gg, apple.com, microsoft.com as well as its own vendor. The guard injects API_KEY_PREFIX_SHAPE, PARTNER_API_KEYS_URL, PUSHARY_API_KEY, SHELL_INERT_URL_PASSWORD_UNIT only into requests to pushary.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets API_KEY_PREFIX_SHAPE=pushary.com,PARTNER_API_KEYS_URL=pushary.com,PUSHARY_API_KEY=pushary.com,SHELL_INERT_URL_PASSWORD_UNIT=pushary.com -- npx -y @pushary/agent-hooks

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Auto-update or dynamic fetch configuration; Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 2 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
1.9sprocessdependency install exit 1 · npm error code EUNSUPPORTEDPROTOCOL npm error Unsupported URL Type "workspace:": workspace:* npm error A complete log of this run can be found in: /tmp/ks-detonate-jxdk7L/task/home/.npm/_logs/2026-11-13T00_38_56_024Z-debug-0.log
1.9sclaimednot started: dependency install failed (exit 1); the server itself was not observed
1.9sprocessscript backend runs setup only
1.9sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsdist/chunk-A6KNDKO5.js:8549 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/(^|[\\/])\.env(\.|$|[\\/])/i,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/chunk-A6KNDKO5.js:9715 · Process kill command — agent can terminate processesvar isProvenModeResponse = (value) => isRecord(value) && typeof value.kill === "boolean";Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/chunk-4ZTPPMLM.js:289 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` ${dim("A browser on this computer is subscribed, but no phone is connected yet.")}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commanddist/chunk-A6KNDKO5.js:5421 · File permission modification command — agent changes file ownership/permissions"Bash(chown -R:*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-CUJ2MGG5.js:96 · Auto-update or dynamic fetch configuration — agent may load new code at runtimevar autoUpdateDecision = (input) => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/chunk-CUJ2MGG5.js:102 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeif (checkedWithinInterval(input.state.lastCheckAt, input.now, autoUpdateCheckInterval(input.state))) return { kind: "skip", reason: "checked_recently" };Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/chunk-A6KNDKO5.js:6821 · File permission modification command — agent changes file ownership/permissions"Bash(chmod -R:*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-GGXAZTSW.js:1249 · Auto-update or dynamic fetch configuration — agent may load new code at runtimevar autoUpdateState = () => join6(pusharyDir(), "auto-update.json");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/chunk-A6KNDKO5.js:8820 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/(^|[\\/])\.env(\.|$|[\\/])/i,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commanddist/chunk-AIZYJJGD.js:76 · Privileged sudo command — agent may execute with elevated privilegestext: `Phone-start ${STOPS_AT_LOGOUT}. To keep it running: \`sudo loginctl enable-linger ${outcome.user}\``Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/chunk-7EYUDJQ6.js:1031 · Process kill command — agent can terminate processesif (mode?.kill || mode?.mode === "terminal_only") return;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commanddist/chunk-A6KNDKO5.js:5420 · File permission modification command — agent changes file ownership/permissions"Bash(chmod -R:*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-CUJ2MGG5.js:105 · Auto-update or dynamic fetch configuration — agent may load new code at runtimevar autoUpdateReportState = (decision) => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/chunk-A6KNDKO5.js:5786 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesvar SECRET_FILE_NAME = /^(?:\.env(?:\.(?!example$|sample$|template$)[\w.-]+)?|(?:secrets?|credentials)\.(?:json|ya?ml|env|toml|ini)|credentials)$/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-CUJ2MGG5.js:98 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeconst offReason = autoUpdateOffReason(input);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/chunk-A6KNDKO5.js:6822 · File permission modification command — agent changes file ownership/permissions"Bash(chown -R:*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commanddist/chunk-AIZYJJGD.js:83 · Privileged sudo command — agent may execute with elevated privilegesreturn `no: it ${STOPS_AT_LOGOUT}; run \`pushary daemon install\`, or \`sudo loginctl enable-linger $USER\``;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-CUJ2MGG5.js:60 · Auto-update or dynamic fetch configuration — agent may load new code at runtimevar autoUpdateOffReason = (input) => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/chunk-A6KNDKO5.js:5836 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesvar REDIRECTS_INTO_A_SECRET_FILE = />>?\s*(?:[^\s;|&<>]*\/)?\.env(?:\.[\w-]+)?(?=$|[\s;|&)])/;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/chunk-ME2ZKG6Y.js:1748 · Process kill command — agent can terminate processesif (mode?.kill || mode?.mode === "terminal_only") return;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/chunk-ME2ZKG6Y.js:1392 · npx invocation of non-well-known package — may execute untrusted code// `npx ... doctor` reports npx for that invocation and claude_plugin asFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/chunk-ME2ZKG6Y.js:551 · Process kill command — agent can terminate processesreturn { ...unknownMode(), kill: last.state.kill === true };Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/chunk-A6KNDKO5.js:268 · npx invocation of non-well-known package — may execute untrusted codevar PUSHARY_SETUP_COMMAND = "npx pushary@latest setup";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/chunk-A6KNDKO5.js:4563 · npx invocation of non-well-known package — may execute untrusted code/** `npx pushary@latest ...`, the documented one-liner. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/chunk-ME2ZKG6Y.js:1788 · Process kill command — agent can terminate processesif (mode?.kill || mode?.mode === "terminal_only") return;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/chunk-GGXAZTSW.js:806 · MCP server using network transport (SSE/HTTP) — data sent over network…ray(value)) return false; const snapshot = value; return typeof snapshot.hadMcpServers === "boolean" && typeof snapshot.mcpServersWasRecord === "boolean" && (!snapshot.hadMcpServers || snapshot.mcpServersWasRecord || Object.hasOwn(snapshot…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Process kill commanddist/chunk-A6KNDKO5.js:9721 · Process kill command — agent can terminate processeskill: data.kill === true,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈81 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @pushary/agent-hooks@1.9.141 as of 36 h ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim pushary: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim pusharyPropose a patch to the maintainer