Skills/npm/artifacts-skill

artifacts-skill@0.4.0

CAUTION· startup only

Publisher claims: "A local-first verification and evidence-generation engine for AI-generated documents: inspect, plan, execute, render, verify, and receipt PDF/PPTX/DOCX/XLSX/image/HTML/SVG artifacts, locally." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher kajisho5 · publishing for 72 daysInstalls 60Last detonated 42 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-12 and scored it 72/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Hidden zero-width characters detected; Hex-encoded string detected; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 21 s · 3 scenarios · 0 deviations
t+CategoryObserved action
20sprocessexec /app/apps/web/node_modules/.bin/artifacts-skill
20sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/artifacts-skill
20sprocessexec /app/node_modules/.bin/artifacts-skill
20sprocessexec /pnpm/artifacts-skill
20sprocessexec /usr/local/sbin/artifacts-skill
20sprocessexec /usr/local/bin/artifacts-skill
20sprocessexec /usr/sbin/artifacts-skill
20sprocessexec /usr/bin/artifacts-skill
20sprocessexec /sbin/artifacts-skill
20sprocessexec /bin/artifacts-skill
20sclaimedstartup only: exited (0) before answering · usage: artifacts-skill [-h] [--version] {doctor,contract,inspect,plan,execute,render,verify,look,receipt} ... artifacts-skill: error: the following arguments are required: command
20sprocessscript backend runs setup only
21sprocesssecond launch, clock +45 days, CI unset

Static findings

HIGH
Hidden zero-width characters detectedsrc/artifact_skill/adapters/csv/adapter.py:51 · Hidden zero-width characters detected — may conceal content# the header's first cell (e.g. "name" became "name"), silentlyFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Hex-encoded string detectedsrc/artifact_skill/core/artifact.py:35 · Hex-encoded string detected — may contain obfuscated payloads_CFB_MAGIC = b"\xd0\xcf\x11\xe0\xa1\xb1\x1a\xe1"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathssrc/artifact_skill/adapters/epub/adapter.py:402 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# "../../../../../../etc/passwd") makes resolve_href()Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/artifact_skill/doctor/detect.py:77 · Python subprocess execution detectedproc = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/artifact_skill/doctor/detect.py:91 · npx invocation of non-well-known package — may execute untrusted code`kajisho5/ffmpeg-skill`'s own installer uses (`npx ffmpeg-skill` copiesFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/artifact_skill/rendering/chromium_render.py:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files`<iframe src="file:///etc/passwd">`, and have its content end up inFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagebin/postinstall.js:30 · npx invocation of non-well-known package — may execute untrusted codeconsole.log("Then check status with: npx artifacts-skill doctor\n");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/artifact_skill/rendering/chromium_render.py:84 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesproblem: a hostile document referencing `file:///etc/passwd` (orFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/artifact_skill/security/subprocess_exec.py:143 · Python subprocess execution detectedproc = subprocess.run( # noqa: S603Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/artifact_skill/security/subprocess_exec.py:69 · Process kill command — agent can terminate processesprocess supervisor's graceful-stop signal, or plain `kill <pid>`) isFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagebin/artifacts-skill.js:4 · npx invocation of non-well-known package — may execute untrusted code* Thin npx wrapper. The real engine is Python (`src/artifact_skill`) —Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/artifact_skill/security/paths.py:68 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesactually exploit (a member name like `../../etc/passwd`). It is notFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/artifact_skill/security/subprocess_exec.py:59 · Python subprocess execution detected`subprocess.run()` already kills its child on any Python-levelFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagebin/artifacts-skill.js:28 · npx invocation of non-well-known package — may execute untrusted code// no pip install done yet (exactly the "try npx first" scenario this stepFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandsrc/artifact_skill/mcp/server.py:146 · Process kill command — agent can terminate processesexcept Exception as exc: # noqa: BLE001 - last-resort boundary: never let a tool call kill the stdio sessionFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈4,311 tok
1 file · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for artifacts-skill@0.4.0 as of 42 h ago. This is the package itself, not its dependencies.

What would make this Verified

8 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim kajisho5: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  3. Hex-encoded string detected≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim kajisho5Propose a patch to the maintainer