Skills/npm/blitzstrike

blitzstrike@2.4.191

CAUTION

Publisher claims: "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher shinthink · joined 8 days agoInstalls 10,000Last detonated 4 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-03 and scored it 56/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; References a credential file in the home directory; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
Access to sensitive file pathschains.json:149 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
References a credential file in the home directorychains.json:1807 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathschains.json:1120 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe-to-shell patterntools-catalog.json:2773 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patterntools-catalog.json:2551 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patterntools-catalog.json:3431 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathschains.json:1521 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Prompt injectionmanuals/web/sqlmap.md:139 · Prompt injection — explicit attempt to bypass safety measuresFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Reads credential paths from the home directorychains.json:1807 · Reads credential paths from the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
document.cookie accesschains.json:946 · document.cookie access — can steal session cookiesFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Coercive compliance languageCHANGELOG.md:2095 · Coercive compliance languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Pipe-to-shell patterntools-catalog.json:3149 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patterntools-catalog.json:873 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
References a credential file in the home directorychains.json:1529 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathschains.json:1118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathschains.json:1523 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Outbound HTTP to raw IP addresschains.json:1537 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsintelligence/patterns.json:983 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
document.cookie accessintelligence/patterns.json:912 · document.cookie access — can steal session cookiesFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Refusal suppressionskills/bs-scope-gate.md:11 · Refusal suppression — attempting to prevent safety responsesFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST01
HIGH
Direct script execution from GitHub raw URLtools-catalog.json:873 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
URL using raw IP addresschains.json:1545 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addresstools-catalog.json:5568 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addresstools-catalog.json:5544 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Leet speak prompt injectionintelligence/patterns.json:531 · Leet speak prompt injection — obfuscated 'override instructions'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST01
HIGH
Access to sensitive file pathsintelligence/patterns.json:133 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Outbound HTTP to raw IP addresstools-catalog.json:5556 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addresstools-catalog.json:5616 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addresschains.json:1537 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Refusal suppressionopencode-agents/Strike.md:31 · Refusal suppression — attempting to prevent safety responsesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsintelligence/patterns.json:324 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
URL with embedded credentialsskills/bs-web-hunting.md:61 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Outbound HTTP to raw IP addresschains.json:1545 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsintelligence/patterns.json:323 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Authorization escalation languagechains.json:1031 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Direct script execution from GitHub raw URLtools-catalog.json:3431 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsskills/hp-secrets-scan.md:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Authorization escalation languagechains.json:1203 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Authorization escalation languagechains.json:1909 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Outbound HTTP to raw IP addressskills/bs-web-hunting.md:61 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsskills/bs-web-hunting.md:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shelltools-catalog.json:2551 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
URL using raw IP addressskills/bs-web-hunting.md:61 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Remote installer piped to shelltools-catalog.json:873 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
MCP server using network transport (SSE/HTTP)tools-catalog.json:5616 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File permission modification commandtools-catalog.json:2851 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shelltools-catalog.json:2773 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Remote installer piped to shelltools-catalog.json:3431 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
URL using raw IP addresstools-catalog.json:5544 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addresstools-catalog.json:5568 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addresstools-catalog.json:5616 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File permission modification commandtools-catalog.json:5410 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shelltools-catalog.json:3149 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
URL using raw IP addresstools-catalog.json:5556 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

What would make this Verified

24 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Text that tells the agent to ignore its instructions≈ +9 on the totalDelete phrases like "ignore previous instructions", "override", "bypass" from SKILL.md and tool descriptions. Describe what the skill does; do not instruct the agent about other rules.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Reads credential paths from the home directory≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Unclaimed publisher≈ +8 on the totalClaim shinthink: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim shinthink