Skills/npm/clokio-mcp

clokio-mcp@0.36.1

CAUTION· install only

Publisher claims: "Model Context Protocol (MCP) server for Clokio - manage tasks, projects, clients, employees, attendance and documents from Claude and any MCP client." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher amitmatat · publishing for 49 daysInstalls 4,677Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 76/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; URL to the cloud instance metadata address. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagedist/version.js:10 · npx invocation of non-well-known package — may execute untrusted code* That second use is not cosmetic. `npx -y clokio-mcp` can serve a cached oldFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/client.js:224 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// new URL() resolution is unrestricted: `file:///etc/passwd`, `data:...`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/index.js:12 · npx invocation of non-well-known package — may execute untrusted code* Or register with: claude mcp add clokio -- npx -y clokio-mcpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/tools/tickets.js:110 · Unicode escape sequence detected — may contain obfuscated payloadsconst RESIDUE = /^[\s|\-_=*.~#\u2022\u00B7\u25AA\u25CF\u25E6\u2023\u2500-\u257F]+$/;Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagedist/tools/employee.js:34 · npx invocation of non-well-known package — may execute untrusted code// mcp_version is added client-side, as the admin whoami does: `npx -yFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/tools/projects.js:339 · npx invocation of non-well-known package — may execute untrusted code// It exists for one reason: `npx -y clokio-mcp` can serve a CACHED oldFix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
URL to the cloud instance metadata addressdist/client.js:225 · URL to the cloud instance metadata address — reads the VM's credentials// and `http://169.254.169.254/...` all resolve to themselves rather thanFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07

Cost to the agent

Instructions loaded
≈63 tok
1 file · 19 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for clokio-mcp@0.36.1 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

4 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. URL to the cloud instance metadata address≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim amitmatat: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  5. Unicode escape sequence detected≈ +2 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim amitmatatPropose a patch to the maintainer