Skills/npm/cli

cli@0.3.73

CAUTION· not started

Publisher claims: "Knowledge layer for AI agents - CLI, MCP server, and data layer" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher phren · publishing for 245 daysInstalls 12,455Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ANTHROPIC_API_KEYOPENAI_API_KEYPHREN_CONTEXT_TOKEN_BUDGETPHREN_MAX_INJECT_TOKENSConfiguration, not credentials: _PHREN_WALKTHROUGH_OLLAMA_SKIP, CLAUDE_CONFIG_DIR, CODEX_HOME, ComSpec, COPILOT_HOME, DEFAULT_PHREN_PATH, GIT_CONFIG_GLOBAL, PHREN_APNS_CONFIG, PHREN_CLANKER, PHREN_CONTEXT_SNIPPET_CHARS, PHREN_CONTEXT_SNIPPET_LINES, PHREN_DEBUG, PHREN_DISPATCH_ID, PHREN_EMBEDDING_API_URL, PHREN_FEATURE_PROGRESSIVE_DISCLOSURE, PHREN_GH_ISSUE_LIMIT, PHREN_GH_PR_LIMIT, PHREN_GH_RETRIES, PHREN_GH_RUN_LIMIT, PHREN_GH_TIMEOUT_MS, PHREN_HOOK_TIMEOUT_MS, PHREN_HOOK_TOOL, PHREN_LLM_ENDPOINT, PHREN_MCP_PROFILE, PHREN_MEMORY_AUTO_ACCEPT, PHREN_MEMORY_EXTRACT_WINDOW_DAYS, PHREN_MEMORY_TTL_DAYS, PHREN_MIN_QUERY_RELEVANCE, PHREN_PATH, PHREN_PROFILE, PHREN_PULL_INTERVAL_SECONDS, PHREN_SLOW_FS_WARN_MS, PHREN_SUDO_TEST_PARENT, REMOTE_PATH, SCOPE_KEY_COMMENT, WSL_DISTRO_NAME
Where it talks to
no vendor host named in the codeAlso bunny.net, apple.com, ollama.com, jsdelivr.net — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names bunny.net, apple.com, ollama.com, jsdelivr.net as well as its own vendor. The guard injects ANTHROPIC_API_KEY, OPENAI_API_KEY, PHREN_CONTEXT_TOKEN_BUDGET, PHREN_MAX_INJECT_TOKENS only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y @phren/cli

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-09 and scored it 75/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 2 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
2.0sprocessdependency install exit 1 · npm error code EUNSUPPORTEDPROTOCOL npm error Unsupported URL Type "workspace:": workspace:* npm error A complete log of this run can be found in: /tmp/ks-detonate-vT2RN6/task/home/.npm/_logs/2026-11-09T06_44_01_044Z-debug-0.log
2.0sclaimednot started: dependency install failed (exit 1); the server itself was not observed
2.0sprocessscript backend runs setup only
2.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsdist/bridge/link.js:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** Hosts from ~/.ssh/config and the store's machines.yaml that answer over ssh,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/hooks.d.ts:73 · npx invocation of non-well-known package — may execute untrusted code* an ephemeral npx copy and the wrapper already runs a lasting entry that exists. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/init/setup.js:247 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescreated.push(`.env:PHREN_FEATURE_AUTO_CAPTURE=${autoCaptureDefault}`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/init/setup.js:1017 · npx invocation of non-well-known package — may execute untrusted codeok: true, // always pass — wrapper is optional (global install or npx work too)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/hooks.d.ts:14 · npx invocation of non-well-known package — may execute untrusted code* self-healing fallback is fragile: npx prunes that cache and the `<hash>`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/init/setup.js:475 · npx invocation of non-well-known package — may execute untrusted code? "Hook entrypoint available via npx fallback"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/init/init.js:234 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Persist the walkthrough choice so init writes an explicit .env default.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commanddist/bridge/push.js:55 · Privileged sudo command — agent may execute with elevated privilegesalert: { title: `sudo on ${value.computer}`, body: command },Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/shell/view.js:76 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileProjects: [`${k("↑↓")} ${d("move")}`, `${k("↵")} ${d("open")}`, `${k("e")} ${d("edit AGENTS.md")}`],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST01
MEDIUM
npx invocation of non-well-known packagedist/init/setup.js:1020 · npx invocation of non-well-known package — may execute untrusted code: `CLI wrapper not found (optional — use 'npx @phren/cli' instead)`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/init/setup.js:234 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst envPath = path.join(phrenPath, ".env");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/hooks.js:112 · npx invocation of non-well-known package — may execute untrusted code* commands that resolve here must fall back to `npx -y <spec>` (whichFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/init/init.js:443 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction filelog(` Run \`phren init --apply-starter-update\` to refresh global/AGENTS.md and global skills.`);Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsdist/hooks.js:914 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst mergedEnv = { ...process.env, PHREN_PATH: phrenPath, PHREN_HOOK_EVENT: event, ...env };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commanddist/bridge/sudo.js:17 · Privileged sudo command — agent may execute with elevated privileges* sudo with no terminal, answered from the phone.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/status.js:425 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n ${BOLD}Health${RESET} ${DIM}(${health.computer.name})${RESET}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commanddist/bridge/sudo.js:19 · Privileged sudo command — agent may execute with elevated privileges* `sudo -A` runs `SUDO_ASKPASS` (`<bridge>/askpass`, a two-line script theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/link/link.js:86 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction filelog(` Run \`phren init --apply-starter-update\` to refresh global/AGENTS.md and global skills.`);Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagedist/hooks.js:162 · npx invocation of non-well-known package — may execute untrusted code* (`npx -y @phren/cli …`), which cannot go stale, and for commands with noFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/init/init.js:356 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslog(` Would set PHREN_PATH in ${path.join(storageRepoRoot, ".env")}`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/init/setup.js:481 · npx invocation of non-well-known package — may execute untrusted codefix: hookEntrypointOk ? undefined : "Rebuild phren: `npm run build` or reinstall the package, and ensure npm/npx is available for hook fallbacks",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/init/setup.js:323 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst envPath = path.join(repoRoot, ".env");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/hooks.js:220 · npx invocation of non-well-known package — may execute untrusted codesessionStart: `npx -y ${packageSpec} hook-session-start`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/bridge/pair.js:359 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`\n⚠ SSH isn't answering on this computer. ${sshHint()}\n Pairing can finish now; the phone connects once SSH is on.`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/hooks.d.ts:133 · npx invocation of non-well-known package — may execute untrusted code* skip wrappers (hooks fall back to node/npx invocation).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/ui/assets.js:2 · File type combined with upload action — agent may exfiltrate local data files…oadProjects() {\n fetch(authUrl('/api/projects')).then(function(r) { return r.json(); }).then(function(data) {\n _projectData = data;\n renderProjectCards(data);\n if (_selectedProject) {\n var cards = document.querySelectorAll('.project-c…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/bridge/pair.js:284 · File type combined with upload action — agent may exfiltrate local data files…edKey(scope, text); const fingerprint = await hostFingerprint(); console.log(`Authorized ${SCOPE_KEY_COMMENT[scope]} for ${scope}: ${scope === "gitboy-write" ? "POST /v1/projects/<project>/findings and tasks/complete only" : "GET /v1/proje…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commanddist/bridge/sudo.js:25 · Privileged sudo command — agent may execute with elevated privileges* flags, its parent is the installed script, that script's parent is a sudoFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/bridge/pair.js:374 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(" In the Phren app: Agents → Add computer → Scan pairing code\n");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/hooks.d.ts:16 · npx invocation of non-well-known package — may execute untrusted code* commands that resolve here must fall back to `npx -y <spec>` (whichFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/hooks.d.ts:12 · npx invocation of non-well-known package — may execute untrusted code* True if a path lives inside an ephemeral npx download cacheFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commanddist/bridge/sudo.js:22 · Privileged sudo command — agent may execute with elevated privileges* agent.sock and holds the connection. The password must reach sudo and noFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/hooks.js:110 · npx invocation of non-well-known package — may execute untrusted code* self-healing fallback is fragile: npx prunes that cache and the `<hash>`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commanddist/bridge/push.js:48 · Privileged sudo command — agent may execute with elevated privileges/** A sudo request waiting for its password. The command is what the ownerFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/cli/config.js:102 · File type combined with upload action — agent may exfiltrate local data filesconsole.log("Tips: '--project <name>' for a project's merged config, '--diff' for only customised values, '--json' for machine-readable output.\n");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/status.js:60 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(`${RED}phren not found${RESET}. Run ${CYAN}npx @phren/cli init${RESET} to set up.`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/bridge/link.js:112 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// The address the Hook dials skips ~/.ssh/config, so resolve the alias the way ssh does.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commanddist/bridge/pair.js:219 · Privileged sudo command — agent may execute with elevated privileges: "Start the SSH server, for example: sudo systemctl enable --now sshd";Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/init/setup.js:476 · npx invocation of non-well-known package — may execute untrusted code: "Hook entrypoint missing and npx unavailable, hooks will fail";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commanddist/bridge/sudo.js:34 · Privileged sudo command — agent may execute with elevated privileges* process's pid gets nothing. (sudo creates askpass's stdout pipe as root,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/hooks.js:108 · npx invocation of non-well-known package — may execute untrusted code* True if a path lives inside an ephemeral npx download cacheFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈49 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @phren/cli@0.3.73 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

5 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim phren: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim phrenPropose a patch to the maintainer