Skills/npm/cli

cli@6.2.4

CAUTION· startup only

Publisher claims: "Microi吾码 AI 开发 CLI 与多宿主 Plugin：服务器连接、Skills、MCP、V8 同步和低代码交付" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher microi.net · publishing for 103 daysInstalls 8,324Last detonated 7d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

Code inventory arrives with this version's next honeypot run.
It will ask for
unknown until the next run
Where it talks to
unknown until the next run
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Not enough was observed to say yet. Startup only; authenticated tool behavior not tested. This version's code has not been inventoried for credentials and hosts either; both arrive with its next honeypot run (popular servers first). `vet-skills try cli` runs it now and prints the full answer.

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-07 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Privileged sudo command; Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessexec /usr/bin/date
0.1sprocessexec /usr/bin/timeout
0.1sclaimedno tools/list reply (exit 0)
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actionscripts/microi-cli.js:48 · File type combined with upload action — agent may exfiltrate local data files`).trimEnd()}isLocalModified(e,t){try{if(!v.existsSync(e))return!1;let n=v.statSync(e),r=new Date(t);return isNaN(r.getTime())?!1:n.mtime.getTime()>r.getTime()+1e3}catch{return!1}}getLocalModifiedTimeFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsskills/microi.v8.js:577 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst BLOCKED = /^(?:\.git|\.env|private|private-source|privatesource|source|_origin)$/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionscripts/microi-cli.js:25 · File type combined with upload action — agent may exfiltrate local data files`,document:{version:1,values:{...o.values}}}}finally{try{le.existsSync(i)&&le.unlinkSync(i)}catch{}try{le.closeSync(r)}catch{}try{le.unlinkSync(t)}catch{}}}readDocument(){if(!le.existsSync(this.filePaFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/microi-cli.js:3 · Unicode escape sequence detected — may contain obfuscated payloads`,r:"\r",t:" ",'"':'"',"\\":"\\","/":"/"},Qe=class s extends ji{static make(e){return new s(e)}constructor(e){super(Object.assign({},e,{readableObjectMode:!0})),this._packKeys=this._packStrings=this._Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Privileged sudo commandskills/microi-deployment/SKILL.md:255 · Privileged sudo command — agent may execute with elevated privileges- 自动化检查：提供只执行权限门禁的无副作用入口；在本地 Linux 容器分别覆盖 root 且无 sudo、普通帐号且无 sudo、普通帐号通过 sudo 提权三种场景，断言成功路径最终 `uid=0`、失败路径发生在步骤 1 之前且不创建 `/microi`。源码契约同时锁定正常安装与 `--repair-app` 均调用同一门禁，并执行 `bash -n`。Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionscripts/microi-cli.js:3 · File type combined with upload action — agent may exfiltrate local data files`,r:"\r",t:" ",'"':'"',"\\":"\\","/":"/"},Qe=class s extends ji{static make(e){return new s(e)}constructor(e){super(Object.assign({},e,{readableObjectMode:!0})),this._packKeys=this._packStrings=this._Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Auto-update or dynamic fetch configurationscripts/microi-cli.js:1437 · Auto-update or dynamic fetch configuration — agent may load new code at runtime\u901A\u7528\u9009\u9879\uFF1A--workspace <\u76EE\u5F55>\uFF08\u9ED8\u8BA4\u5F53\u524D\u76EE\u5F55\uFF09\u3001--profile <\u5E8F\u53F7/OsClient/\u540D\u79F0/mcpName>\u3001--json`}async function Ti(s,e)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsscripts/microi-cli.js:1404 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files`).trimEnd(),preservedNames:r}}function oi(s,e,t,n,r){K.mkdirSync(W.dirname(s),{recursive:!0});let i=K.existsSync(s)?K.readFileSync(s,"utf8"):"",o=We(),{cleaned:a,preservedNames:c}=Jo(i,o),l=Object.vaFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationskills/microi.v8.js:705 · Credential pass-through configuration — agent relays sensitive credentials// Do not pass secrets, arbitrary URLs or a caller-selected storage endpoint.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
File type combined with upload actionscripts/microi-cli.js:21 · File type combined with upload action — agent may exfiltrate local data files`,"utf-8"),ee.renameSync(n,e)}finally{try{ee.existsSync(n)&&ee.unlinkSync(n)}catch{}}}async mutateWorkspaceConfig(e){let t=this.getWorkspaceConfigPath();if(!t)throw new Error("\u8BF7\u5148\u6253\u5F00Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsskills/playwright-e2e/SKILL.md:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files> **2026-05 更新（重要）**：Microi.Agent 插件生成的E2E 配置、用例和帮助器保留在 `<projectRoot>/.microi-e2e/`；运行产物统一输出到 `<gitRoot>/.tmp/microi-e2e/<项目相对路径>/`，**不再**写入 `tests/e2e/`、根目录 `playwright.config.js` 或 `.env.e2e.examplFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsskills/microi-microservice/SKILL.md:216 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- 登录使用统一 `V8.Login` 与 DiyToken，不创建第二套用户体系。Token 失效后回到认证门；禁止在 URL、日志、源码、`.env` 或业务数据中保存 Token。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionscripts/microi-cli.js:36 · File type combined with upload action — agent may exfiltrate local data files`,{encoding:"utf-8",mode:384});for(let h=0;;h++)try{q.renameSync(p,r);break}catch(S){let b=S.code;if(!["EPERM","EACCES","EBUSY"].includes(b||"")||h>=3)throw S;await new Promise(P=>setTimeout(P,20*2**hFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsskills/microi-microservice/SKILL.md:120 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- 目录扫描必须排除 `node_modules`、`dist`、`build`、`coverage`、缓存、版本库和 UniApp 构建目录；发现 `.env`、证书、私钥、符号链接或越过根目录时失败关闭。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationskills/ai-engine/SKILL.md:155 · Credential pass-through configuration — agent relays sensitive credentials- 管理中转权益复用 Managed `platform-ai-account`：先 `GetRelayTokenAccount({TargetUserId})`，再 `SetRelayTokenLimit({TargetUserId,IsUnlimited,ExpectedUnlimited})`。后两参数必须为布尔值，ExpectedUnlimited 必须来自刚回读状态；仅当前配置主租户、数Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
MCP server using network transport (SSE/HTTP)scripts/microi-cli.js:1408 · MCP server using network transport (SSE/HTTP) — data sent over network`;(!K.existsSync(s)||i!==m)&&ci(s,m)}function qo(s,e){let t=e.label||e.sysShortTitle||e.sysTitle||e.apiBaseUrl||"\u672A\u547D\u540D\u670D\u52A1\u5668";return W.join(s.getSyncRootDir(),s.buildServerDirFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
File type combined with upload actionskills/v8-debugging/SKILL.md:18 · File type combined with upload action — agent may exfiltrate local data files| 后端 V8 的 `console.log` / `console.error` | 租户系统日志（MongoDB）；MCP/调试执行同时返回当次 `ConsoleOutput` | 临时诊断、性能日志 |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionskills/microi-db-schema/SKILL.md:121 · File type combined with upload action — agent may exfiltrate local data files表单控件以 `Microi.Client/src/views/form-engine/diy-field-component/` 和 `diy-component-list.json` 为事实源。当前常用组件包括：`Text`、`Guid`、`Textarea`、`NumberText`、`DateTime`、`Select`、`MultipleSelect`、`Radio`、`Checkbox`Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandskills/job-engine/SKILL.md:111 · Process kill command — agent can terminate processes- 若要求 `kill -9` 前也零丢失，业务成功响应前必须获得共享 outbox/MQ/WAL 持久化确认。Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈154,866 tok
54 files · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @microi.net/cli@6.2.4 as of 7d ago. This is the package itself, not its dependencies.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim microi.net: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  5. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim microi.netPropose a patch to the maintainer