Skills/npm/bambu-printer-mcp

bambu-printer-mcp@1.1.94

CAUTION· startup only

Publisher claims: "MCP server for Bambu Lab 3D printers with STL manipulation, slicing, and print management" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher dmontgomery40 · publishing for 709 daysInstalls 26,188Last detonated 38 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
BAMBU_PRINTER_ACCESS_TOKENBAMBU_TOKEN or --print-authorized / --command-authorizedConfiguration, not credentials: BAMBU_CLIENT_CERT, BAMBU_CLIENT_KEY, BAMBU_CONFIRMATION_TIMEOUT_MS, BAMBU_CONNECT_APP_PATH, BAMBU_CONTROL_REPLY_MS, BAMBU_DEFAULT_CONNECTION_MODE, BAMBU_DEFAULT_CONNECTION_TYPE, BAMBU_DEV_ID, BAMBU_DISPATCH_CHECK_MS, BAMBU_EMERGENCY_MQTT_TIMEOUT_MS, BAMBU_MODEL, BAMBU_NATIVE_ALLOW_UNPINNED_PLUGIN, BAMBU_NATIVE_CERT_DIR, BAMBU_NATIVE_CERT_FILE, BAMBU_NATIVE_COMMAND_JSON, BAMBU_NATIVE_CONFIG_DIR, BAMBU_NATIVE_HELPER, BAMBU_NATIVE_HOME, BAMBU_NATIVE_PLUGIN, BAMBU_NATIVE_SERIAL, BAMBU_NATIVE_TRY_EMMC_PRINT, BAMBU_NOZZLE_TYPE, BAMBU_NOZZLE_VOLUME_TYPE, BAMBU_PRINTER_HOST, BAMBU_PRINTER_MODEL, BAMBU_PRINTER_SERIAL, BAMBU_RESUME_STATE_DIR, BAMBU_SERIAL, BAMBU_SLICER_PROFILE, BAMBU_STOP_ACK_MS, BAMBU_STUDIO_PATH, BAMBU_TEMPLATE_3MF_PATH, BAMBU_TEMPLATE_DIR, BED_TYPE, BLENDER_HOST, BLENDER_MCP_ARGS, BLENDER_MCP_BRIDGE_COMMAND, BLENDER_MCP_COMMAND
Where it talks to
no vendor host named in the codeAlso bblcdn.com, apple.com, prusa3d.com, fabacademy.org, mit.edu, hubs.com, ufl.edu, orcaslicer.com, blogspot.com, hackaday.com, protolabs.com, sv-jme.eu, bambulab.com, microsoft.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names bblcdn.com, apple.com, prusa3d.com, fabacademy.org, mit.edu, hubs.com, ufl.edu, orcaslicer.com, blogspot.com, hackaday.com, protolabs.com, sv-jme.eu, bambulab.com, microsoft.com as well as its own vendor. The guard injects BAMBU_PRINTER_ACCESS_TOKEN, BAMBU_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y bambu-printer-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-12 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 34 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessexited 1: Node.js v22.23.5
13sprocessdependency install exit 0
33sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-BDGiDs/task/home/work/acme-api/.claude/skills/bambu-printer-mcp/dist/counterpart/visual-evidence.js' } Node.js v22.23.5
33sprocessscript backend runs setup only
33sprocesssecond launch, clock +45 days, CI unset
33sprocessexited 1: Node.js v22.23.5

Static findings

HIGH
Access to sensitive file pathsdist/design-app-setup.js:358 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** A login agent that gives Fusion the add-in's port however Fusion is opened (a GUI app never reads this .env). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:464 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files: "This server has no .env file to add its Fusion settings to: add FUSION_MCP_COMMAND and FUSION_MCP_ARGS to its configuration."] : []),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:93 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfunction envFile(system) { return path.resolve(system.cwd, ".env"); }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:3108 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…: the change applies to the next print and control at once, and is saved to the .env file in this server's working directory when that file exists (savedTo; null ot…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:78 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// directory, as dotenv's own .env lookup is. Slicer CLIs receive paths underFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The server's own `.env`, when it has one: a client's env block has no file to update. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:97 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// counterpart_print_route changes these at run time (and in the .env file they came from).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/design-app-setup.js:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** One change at a time per server: overlapping updates would interleave backups, renames and .env writes. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:3080 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…part/1): the printers this server drives and the settings it reads for each, by .env variable name (first canonical, then aliases): label, hint, whether required, t…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/bambu-native.js:269 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, ...install.env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/cad/contracts.ts:395 · File type combined with upload action — agent may exfiltrate local data files…t selection and edits: set final: true only on the result you select. cad-result.json in each immediate run folder is protected from script writes and retains final, completed_at, lineage_id (source hash), full checks and artifact paths; c…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:100 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfunction envFile(system: SetupSystem): string { return path.resolve(system.cwd, ".env"); }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The working directory dotenv read `.env` from when the server started. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationpackage.json:8 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"autoUpdate": trueFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** The server's own `.env`, when it has one: a client's env block has no file to update. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** One change at a time per server: overlapping updates would interleave backups, renames and .env writes. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/cad/contracts.js:106 · File type combined with upload action — agent may exfiltrate local data files… output_dir, never overwriting previous artifacts. The saved .py and .parameters.json are the recovery checkpoint even after cancellation. Returns independently measured geometry, STL/STEP, six orthographic renders, a perspective view and …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/index.js:3234 · File type combined with upload action — agent may exfiltrate local data files…ame>.stl (export_stl of one body), <name>.f3d (export_f3d) and <name>.parameters.json (its user parameters), and return their absolute paths. The STL is checked as a finite triangle mesh; slice it like any other model. Fusion must run on t…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/index.ts:3617 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…: the change applies to the next print and control at once, and is saved to the .env file in this server's working directory when that file exists (savedTo; null ot…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:112 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// directory, as dotenv's own .env lookup is. Slicer CLIs receive paths underFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/counterpart/setup.ts:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* to this server's .env and never needs its own printer or model tables. Pure: no printer traffic, no secrets returned.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/cad/contracts.js:358 · File type combined with upload action — agent may exfiltrate local data files…t selection and edits: set final: true only on the result you select. cad-result.json in each immediate run folder is protected from script writes and retains final, completed_at, lineage_id (source hash), full checks and artifact paths; c…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/index.js:4532 · File type combined with upload action — agent may exfiltrate local data files// The report always says failed (a result.json that says success can still leave no output file).Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/bambu-native.js:95 · npx invocation of non-well-known package — may execute untrusted codereturn `npx -y -p bambu-printer-mcp${version ? `@${version}` : ""} bambu-printer-mcp-native-setup${homeOption}`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/cad/process.js:15 · Process kill command — agent can terminate processesconst kill = () => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:3589 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…part/1): the printers this server drives and the settings it reads for each, by .env variable name (first canonical, then aliases): label, hint, whether required, t…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/cad/process.js:4 · Process kill command — agent can terminate processes/** No shell, no inherited printer/provider environment, bounded output, and kill the entire dispatched group. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionsrc/cad/contracts.ts:392 · File type combined with upload action — agent may exfiltrate local data files…th script, output_dir and a plain name. It saves <name>.py and <name>.parameters.json before running, then exports <name>.stl and <name>.step in a fresh subfolder. For an edit, one cad_run with script_path pointing to the earlier .py, para…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/tool-annotations.js:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Replaces BAMBU_DEFAULT_CONNECTION_MODE/TYPE in .env and in this process.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/cad/contracts.ts:116 · File type combined with upload action — agent may exfiltrate local data files… output_dir, never overwriting previous artifacts. The saved .py and .parameters.json are the recovery checkpoint even after cancellation. Returns independently measured geometry, STL/STEP, six orthographic renders, a perspective view and …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/design-app-setup.ts:362 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** A login agent that gives Fusion the add-in's port however Fusion is opened (a GUI app never reads this .env). */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/cad/contracts.js:355 · File type combined with upload action — agent may exfiltrate local data files…th script, output_dir and a plain name. It saves <name>.py and <name>.parameters.json before running, then exports <name>.stl and <name>.step in a fresh subfolder. For an edit, one cad_run with script_path pointing to the earlier .py, para…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagesrc/bambu-native.ts:179 · npx invocation of non-well-known package — may execute untrusted codereturn `npx -y -p bambu-printer-mcp${version ? `@${version}` : ""} bambu-printer-mcp-native-setup${homeOption}`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/printers/bambu.js:2127 · Process kill command — agent can terminate processes// 5.x/6.x line; we rely on the outer kill timer instead so we don'tFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:3691 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ue, installs what is missing and adds the missing settings to this server's own .env (after a copy of it), keeping a configured FUSION_MCP_COMMAND and its arguments…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/bambu-native.ts:371 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, ...install.env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/index.js:3182 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ue, installs what is missing and adds the missing settings to this server's own .env (after a copy of it), keeping a configured FUSION_MCP_COMMAND and its arguments…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/index.js:75 · Process kill command — agent can terminate processes// below and kill the server before it ever opens the stdio transport.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/tool-annotations.js:101 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// the Fusion add-in folder, a login item and this server's .env are written. Repeating finds them current.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/tool-annotations.ts:87 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Replaces BAMBU_DEFAULT_CONNECTION_MODE/TYPE in .env and in this process.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/cad/process.d.ts:14 · Process kill command — agent can terminate processes/** No shell, no inherited printer/provider environment, bounded output, and kill the entire dispatched group. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/cad/process.ts:20 · Process kill command — agent can terminate processes/** No shell, no inherited printer/provider environment, bounded output, and kill the entire dispatched group. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/index.ts:132 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// counterpart_print_route changes these at run time (and in the .env file they came from).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/tool-annotations.ts:129 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// the Fusion add-in folder, a login item and this server's .env are written. Repeating finds them current.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectionREADME.md:48 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileUse direct LAN printing by default. Explain any LAN/Developer Mode settingFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Authorization escalation languageREADME.md:1006 · Authorization escalation language · informational: not an instruction file…01.08.05+ refuses the command (HMS 0500-0500-0001-0007, needs LAN Only Mode and Developer Mode), the call fails and says so; clear that fatal HMS entry with `clear_hms_errors…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Prompt injectionREADME.md:1030 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…inter refuses direct FTPS uploads: an X1C on firmware 01.12.00.00 (LAN Only and Developer Mode on, a ready writable SD card) answered every FTPS `STOR` with `553 Could not cr…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Prompt injectionREADME.md:1595 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…he path.** Direct MQTT/FTPS tools require local reachability and compatible LAN/Developer Mode settings. FULU bridge cloud jobs use BambuNetwork and require its runtime, inte…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
File type combined with upload actionsrc/index.ts:5264 · File type combined with upload action — agent may exfiltrate local data files// The report always says failed (a result.json that says success can still leave no output file).Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Authorization escalation languageREADME.md:1030 · Authorization escalation language · informational: not an instruction file…inter refuses direct FTPS uploads: an X1C on firmware 01.12.00.00 (LAN Only and Developer Mode on, a ready writable SD card) answered every FTPS `STOR` with `553 Could not cr…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commandsrc/index.ts:109 · Process kill command — agent can terminate processes// below and kill the server before it ever opens the stdio transport.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/printers/bambu.ts:2359 · Process kill command — agent can terminate processes// 5.x/6.x line; we rely on the outer kill timer instead so we don'tFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Authorization escalation languageREADME.md:1595 · Authorization escalation language · informational: not an instruction file…he path.** Direct MQTT/FTPS tools require local reachability and compatible LAN/Developer Mode settings. FULU bridge cloud jobs use BambuNetwork and require its runtime, inte…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Prompt injectionREADME.md:1006 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…01.08.05+ refuses the command (HMS 0500-0500-0001-0007, needs LAN Only Mode and Developer Mode), the call fails and says so; clear that fatal HMS entry with `clear_hms_errors…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Authorization escalation languageREADME.md:48 · Authorization escalation language · informational: not an instruction fileUse direct LAN printing by default. Explain any LAN/Developer Mode settingFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionsrc/index.ts:3743 · File type combined with upload action — agent may exfiltrate local data files…ame>.stl (export_stl of one body), <name>.f3d (export_f3d) and <name>.parameters.json (its user parameters), and return their absolute paths. The STL is checked as a finite triangle mesh; slice it like any other model. Fusion must run on t…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandsrc/cad/process.ts:37 · Process kill command — agent can terminate processesconst kill = () => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈61 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for bambu-printer-mcp@1.1.94 as of 38 h ago. This is the package itself, not its dependencies.

What would make this Verified

3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim dmontgomery40: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim dmontgomery40Propose a patch to the maintainer