cli@6.3.0
CAUTION· startup onlyPublisher claims: "Microi吾码 AI 开发 CLI 与多宿主 Plugin：服务器连接、Skills、MCP、V8 同步和低代码交付" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher microi.net · publishing for 103 daysInstalls 8,324Last detonated 3d ago
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- microi.net (its own)
- What the honeypot saw
- no credential files read · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Connect it under the guard. Startup only; authenticated tool behavior not tested. The code names no credential variable and talks to microi.net, its own; the guard pins the network to what the honeypot saw and logs every call.
$vet-skills run --net declared -- npx -y @microi.net/cli
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Credential pass-through configuration. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 20 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
20sclaimedstartup only: exited (0) before answering · push <file> 显式推送一个已拉取的 V8 文件 sync status [--scope ...] 比较本地与远端差异 doctor 检查连接、Token、AI 与 MCP 配置 通用选项：--workspace <目录>（默认当前目录）、--profile <序号/OsClient/名称/mcpName>、--json
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathsskills/microi-microservice/SKILL.md:218 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- 登录使用统一 `V8.Login` 与 DiyToken，不创建第二套用户体系。Token 失效后回到认证门；禁止在 URL、日志、源码、`.env` 或业务数据中保存 Token。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsskills/microi-microservice/SKILL.md:122 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05- 目录扫描必须排除 `node_modules`、`dist`、`build`、`coverage`、缓存、版本库和 UniApp 构建目录；发现 `.env`、证书、私钥、符号链接或越过根目录时失败关闭。Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Credential pass-through configurationskills/ai-engine/SKILL.md:155 · Credential pass-through configuration — agent relays sensitive credentials
AST02…nse、登录/API Key、付费订阅、供应商配额或并发保护。 - 管理中转权益复用 Managed `platform-ai-account`：先 `GetRelayTokenAccount({TargetUserId})`，再 `SetRelayTokenLimit({TargetUserId,IsUnlimited,Expecte…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Credential pass-through configurationskills/microi.v8.js:717 · Credential pass-through configuration — agent relays sensitive credentials
AST02// Do not pass secrets, arbitrary URLs or a caller-selected storage endpoint.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/microi-cli.js:1404 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05….values(e).find(f=>typeof f.command=="string"),g=String(l?.command||""),u={...l?.env||{}},d=Object.fromEntries(Object.entries(u).filter(([f])=>!f.startsWith("MICROI…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandskills/microi-deployment/SKILL.md:262 · Privileged sudo command — agent may execute with elevated privileges
AST05- 自动化检查：提供只执行权限门禁的无副作用入口；在本地 Linux 容器分别覆盖 root 且无 sudo、普通帐号且无 sudo、普通帐号通过 sudo 提权三种场景，断言成功路径最终 `uid=0`、失败路径发生在步骤 1 之前且不创建 `/microi`。源码契约同时锁定正常安装与 `--repair-app` 均调用同一门禁，并执行 `bash -n`。Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathsskills/microi.v8.js:577 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05const BLOCKED = /^(?:\.git|\.env|private|private-source|privatesource|source|_origin)$/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Auto-update or dynamic fetch configurationscripts/microi-cli.js:1437 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06…instanceof Error?c.message:String(c)}`},t)}return}if(process.env.MICROI_DISABLE_AUTO_UPDATE!=="1")try{Lr({currentVersion:Ge(),workspace:ge(e,"workspace")||process.cwd(),sourceCliPath:process.argv[1]})}catch{}if(n==="plugin"&&r==="path"){le…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Unicode escape sequence detectedscripts/microi-cli.js:3 · Unicode escape sequence detected — may contain obfuscated payloads
AST07…V8\u4E8B\u4EF6",Rt="\u5B57\u6BB5V8\u4E8B\u4EF6",gn="\u8282\u70B9",Xr={InFormV8:"\u524D\u7AEF\u8868\u5355\u8FDB\u5165V8\u4E8B\u4EF6",SubmitFormV8:"\u524D\u7AEF\u8868\u5355\u63D0\u4EA4\u524DV8\u4E8B…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.MEDIUM
MCP server using network transport (SSE/HTTP)scripts/microi-cli.js:1408 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04…(W.join(s,".vscode","mcp.json"),"servers",p),kt(W.join(s,".cursor","mcp.json"),"mcpServers",p);let m=Object.fromEntries(Object.entries(p).map(([h,S])=>[h,Yo(S,l,u)]));kt(W.join(s,".trae","mcp.json"),"mcpServers",m,!0);let f=Object.fromEntr…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.HIGH
Access to sensitive file pathsskills/playwright-e2e/SKILL.md:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…/.tmp/microi-e2e/<项目相对路径>/`，**不再**写入 `tests/e2e/`、根目录 `playwright.config.js` 或 `.env.e2e.example`。 > - `playwright.config.js` 位于 `.microi-e2e/playwright.config.js`，…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actionscripts/microi-cli.js:36 · File type combined with upload action — agent may exfiltrate local data files
AST07…||!q.existsSync(n))return;let r=[];try{r=q.readdirSync(n).filter(i=>i.endsWith(".json")).slice(0,200)}catch{return}for(let i of r){let o=Gt.join(n,i);try{let a=JSON.parse(q.readFileSync(o,"utf-8")),c=this.normalizeApiBaseUrl(String(a.apiBa…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionskills/microi-db-schema/SKILL.md:121 · File type combined with upload action — agent may exfiltrate local data files
AST07…`Microi.Client/src/views/form-engine/diy-field-component/` 和 `diy-component-list.json` 为事实源。当前常用组件包括：`Text`、`Guid`、`Textarea`、`NumberText`、`DateTime`、`Select`、`MultipleSelect`、`Radio`、`Checkbox`、`Switch`、`Rate`、`Progress`、`Slider`、`ColorPi…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionskills/v8-debugging/SKILL.md:18 · File type combined with upload action — agent may exfiltrate local data files
AST07| 后端 V8 的 `console.log` / `console.error` | 租户系统日志（MongoDB）；MCP/调试执行同时返回当次 `ConsoleOutput` | 临时诊断、性能日志 |Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/microi-cli.js:48 · File type combined with upload action — agent may exfiltrate local data files
AST07…ce().getSyncRootDir();ft(t),Ke(t,[".backups/","**/.backups/",".microi-mcp-tokens.json","**/.microi-mcp-tokens.json"])}catch{}}shortBackupKey(e){return require("crypto").createHash("sha1").update(e||"").digest("hex").slice(0,10)}getMenuButt…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/microi-cli.js:3 · File type combined with upload action — agent may exfiltrate local data files
AST07…equire("path")),ee=$(require("fs")),gs=$(require("crypto"));var lt=".microi-meta.json",un=".microi-config.json",It=".microi-mcp-tokens.json";var qr=".mcp.json";var Ne="Microi-V8-Engine";var ut="\u63A5\u53E3\u5F15\u64CE",Yr="V8\u4E8B\u4EF6"…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/microi-cli.js:25 · File type combined with upload action — agent may exfiltrate local data files
AST07…d(C),C&&(m.headers.Authorization=`Bearer ${C}`);let h=`${n}${l}`;if(e.silent||ye.log("API",`\u27A1\uFE0F ${e.method} ${h}`),e.body&&!e.silent){let S=JSON.stringify(this.maskSensitiveBody(e.body));ye.appendLine(` Body: ${S.length>500?S.subs…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/microi-cli.js:21 · File type combined with upload action — agent may exfiltrate local data files
AST07…"),le=$(require("fs")),kn=$(require("path")),jt=".microi-workspace-secrets.dpapi.json";async function Kt(s,e,t=()=>{}){if(t(),s.storeMany){await s.storeMany(e);return}for(let[n,r]of Object.entries(e))t(),await s.store(n,r)}var Is=["$ErrorA…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Process kill commandskills/job-engine/SKILL.md:111 · Process kill command — agent can terminate processes
AST05- 若要求 `kill -9` 前也零丢失，业务成功响应前必须获得共享 outbox/MQ/WAL 持久化确认。Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Instructions loaded
≈157,441 tok
54 files · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @microi.net/cli@6.3.0 as of 3d ago. This is the package itself, not its dependencies.
What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim microi.net: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim microi.netPropose a patch to the maintainer