Skills/npm/cli

cli@0.9.4

CAUTION· install only

Publisher claims: "One config to rule them all — sync MCP servers, skills and AGENTS.md across 18 AI coding tools, and package them as Agent Plugins." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher agents-dev · publishing for 280 daysInstalls 148KLast detonated 2d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 75/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Collapsed <details> block carrying instructions; Collapsed <details> block carrying instructions; Collapsed <details> block carrying instructions. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Collapsed <details> block carrying instructionsREADME.md:344 · Collapsed <details> block carrying instructions<summary><b>Can I target an MCP server to specific tools only?</b></summary> <br/> Yes, with <code>"targets"</code> in the definition or <code>--target</code> oFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Collapsed <details> block carrying instructionsREADME.md:356 · Collapsed <details> block carrying instructions<summary><b>How do I upgrade from 0.8.x?</b></summary> <br/> Run any command. <code>.agents/agents.json</code> migrates from schema 3 to 4 automatically and theFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Collapsed <details> block carrying instructionsREADME.md:326 · Collapsed <details> block carrying instructions<summary><b>Why does Claude Code use <code>.mcp.json</code> now?</b></summary> <br/> Project scope is the location Anthropic documents for teams: it lives in thFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsdist/commands/doctor.js:519 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (localOverride?.env && key in localOverride.env)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/commands/status.js:204 · File type combined with upload action — agent may exfiltrate local data filesui.json(output);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/core/mcpImport.js:377 · npx invocation of non-well-known package — may execute untrusted code` agents mcp add figma-mcp --command npx --arg "@figma/mcp-server"\n\n` +Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/core/renderers.js:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslines.push(`[mcp_servers.${quoteTomlKey(server.name)}.env]`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/core/mcpImport.js:158 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst env = readStringMap(value.env ?? value.environment, `${serverName}.env`, (key) => validateEnvKey(key, 'environment variable'));Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/core/skills.js:221 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* reaches the bridge. A link to `~/.ssh/id_rsa` would arrive the same way, as a realFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
References a credential file in the home directorydist/core/skills.js:221 · References a credential file in the home directory* reaches the bridge. A link to `~/.ssh/id_rsa` would arrive the same way, as a realFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:298 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction filegit add .agents/agents.json .agents/skills/ AGENTS.md && git commit -m "Add agents config"Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈57 tok
1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for @agents-dev/cli@0.9.4 as of 2d ago. This is the package itself, not its dependencies.

What would make this Verified

5 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim agents-dev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim agents-devPropose a patch to the maintainer