Skills/npm/bla-agents

bla-agents@3.3.2

CAUTION· startup only

Publisher claims: "BLA (Blind LLM Agents) — Adversarial defense shield that protects binaries, Electron apps, JS bundles, Python, WebAssembly, SQLite, AI Models, and Android DEX/IL2CPP against AI reverse-engineering agents like REA." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher qybaihe · publishing for 21 daysInstalls 22,255Last detonated 8 min ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
bla.tools (its own)Also local.fixture, schemastore.org, cursor.com, idx.dev, windsurf.com, visualstudio.com, opencode.ai — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it under the guard. Startup only; authenticated tool behavior not tested. The code names no credential variable and talks to bla.tools, its own; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- npx -y bla-agents

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-15 and scored it 66/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Collapsed <details> block carrying instructions; Access to sensitive file paths; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 28 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
8.0sprocessdependency install exit 0
28sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-NkIyqi/task/home/work/acme-api/.claude/skills/bla-agents/dist/engine/lane-independence-lint.js' } Node.js v22.23.5
28sprocessscript backend runs setup only
28sprocessno install scripts to re-run

Static findings

HIGH
Collapsed <details> block carrying instructionsREADME.md:175 · Collapsed <details> block carrying instructions<summary><strong>Designed-for paths not empirically run on this machine (click to expand)</strong></summary> <br /> These shields exist in-tree and are covered Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsdist/core/debug-posture.js:71 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files: "No package.json or .env.production found to verify Node launch flags.",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/core/sarif.js:64 · npx invocation of non-well-known package — may execute untrusted codetext: `${f.kind} (${f.representation}) in ${f.file} — Run "npx bla-agents defend" to replace with decoy source maps.`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/mcp/server.js:807 · File type combined with upload action — agent may exfiltrate local data files…scription: "Read-only correlation of a prior harden run: load bla-harden-summary.json by path or output directory, optionally asserting a run_id. Unsigned summaries only — never treat…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/engine/harden.js:234 · npx invocation of non-well-known package — may execute untrusted code* with the bankrupt profile. Modelled on REA's `npx rea-agents setup` simplicity.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:561 · npx invocation of non-well-known package — may execute untrusted code… CLI update: npm install --global bla-agents@latest\n • Agent MCP refresh: npx bla-agents@latest setup\n`); } return 0; } …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Unpinned dependencydist/cli.js:555 · Unpinned dependencyglobalUpdateCommand: "npm install --global bla-agents@latest",Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
HIGH
Destructive file system command detecteddist/ui/reporter.js:81 · Destructive file system command detected` ${ANSI.bold}Format / Preset:${ANSI.reset} ${res.detectedFormat} / ${ANSI.magenta}${res.intensity}${ANSI.reset} (seed: ${res.seed})`,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/engine/packaging-gates.js:111 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ude leaked environment artifact \`${rel}\` (SOLUTION/writeup notes, populated \`.env\`, SSH/PEM private keys, or \`.pdb\`/\`.dSYM\`/\`.dwp\` debug databases) from t…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/core/debug-posture.js:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessources.push(".env.production");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/mcp/server.js:402 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files… allow bankrupt/maximum harden despite leaked SOLUTION/writeup notes, populated .env secrets, SSH/PEM private keys, or unstripped .pdb/.dSYM/.dwp debug databases. D…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/mcp/server.js:656 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdescription: "Treat leaked SOLUTION/writeup notes, populated .env secrets, private keys, or .pdb/.dSYM/.dwp debug symbols as non-blocking (lab only)",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/cli.js:37 · npx invocation of non-well-known package — may execute untrusted codenpx bla-shield <command> [options]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandpackage.json:80 · File permission modification command — agent changes file ownership/permissions"build": "node scripts/sync-version.mjs && tsc -p tsconfig.build.json && chmod +x dist/cli.js",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:287 · Collapsed <details> block carrying instructions<summary><strong>Do I need Ghidra, Hopper, IDA, or Wabt installed to protect files?</strong></summary> No. All 19+ format shields are built into `bla-agents` inFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagedist/engine/defender.js:13 · npx invocation of non-well-known package — may execute untrusted code* Designed so that once an AI Coding Agent attaches BLA via `npx bla-agents@latest setup`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/core/debug-posture.js:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files: join(rootDir, ".env.production");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/engine/auditor.js:1456 · npx invocation of non-well-known package — may execute untrusted codeconst recommendedCommand = `npx bla-agents protect ${targetPath}`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:41 · npx invocation of non-well-known package — may execute untrusted codenpx bla-agents setup -y # register bla_harden with your agentFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Unpinned dependencydist/cli.js:561 · Unpinned dependency…r()}\n\nBLA v${BLA_IDENTITY.version} update workflow:\n • Global CLI update: npm install --global bla-agents@latest\n • Agent MCP refresh: npx bla-agents@latest setup\n`); } …Fix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
MEDIUM
File type combined with upload actiondist/cli.js:1090 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(JSON.stringify({ ...emitted, outputPath: outPath }, null, 2));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/cli.js:554 · npx invocation of non-well-known package — may execute untrusted coderefreshSetupCommand: "npx bla-agents@latest setup",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/mcp/server.js:461 · File type combined with upload action — agent may exfiltrate local data filesdescription: "Optional path to bla-harden-summary.json (or its output directory) to correlate this verify with a prior harden run (unsigned).",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/core/debug-posture.js:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesexposedFlags.push(`.env.production contains inspector/run-as-node directive`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/core/release-plan.js:48 · File type combined with upload action — agent may exfiltrate local data filesthrow new ReleaseConsistencyError("INVALID_PACKAGE_VERSION", `Invalid package.json version '${input.packageVersion}': expected strict semver (X.Y.Z)`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/cli.js:36 · npx invocation of non-well-known package — may execute untrusted codenpx bla-agents <command> [options]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/engine/harden.d.ts:220 · npx invocation of non-well-known package — may execute untrusted code* with the bankrupt profile. Modelled on REA's `npx rea-agents setup` simplicity.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/engine/defender.d.ts:99 · npx invocation of non-well-known package — may execute untrusted code* Designed so that once an AI Coding Agent attaches BLA via `npx bla-agents@latest setup`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/mcp/server.js:813 · File type combined with upload action — agent may exfiltrate local data filesdescription: "Path to bla-harden-summary.json, or the harden output directory that contains it",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈88 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

14 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim qybaihe: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Unpinned dependencies≈ +3 on the totalPin exact versions (and ideally hashes) in package.json, requirements or the install script so the bundle cannot change under you.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim qybaihePropose a patch to the maintainer