devops-skill@2.0.0
CAUTIONPublisher claims: "Full-lifecycle 2025/2026 cloud-native DevOps & DevSecOps engineering skill for AI agents (Pi, Claude Code, Cursor, Windsurf, Roo, OpenCode)" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-02 and scored it 75/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Rule modification attempt; Rule modification attempt; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
CRITICAL
Rule modification attempttemplates/kubernetes/gateway-api-httproute.yaml:73 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01MEDIUM
npx invocation of non-well-known packagebin/cli.js:84 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06CRITICAL
Rule modification attempttemplates/kubernetes/gateway-api-httproute.yaml:91 · Rule modification attempt — overwriting existing instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Destructive file system command detectedscripts/k8s-dry-run-validate.sh:30 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05MEDIUM
npx invocation of non-well-known packagebin/cli.js:52 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packagescripts/validate-all.sh:170 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
File permission modification commandSKILL.md:163 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
File permission modification commandSKILL.md:31 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05HIGH
Access to sensitive file pathsSKILL.md:59 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
npx invocation of non-well-known packagebin/cli.js:82 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Destructive file system command detectedscripts/audit-image.sh:41 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05MEDIUM
npx invocation of non-well-known packagebin/cli.js:83 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packagebin/cli.js:81 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packagescripts/validate-all.sh:171 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Destructive file system command detectedscripts/scan-secrets.sh:25 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05MEDIUM
File permission modification commandSKILL.md:41 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
npx invocation of non-well-known packagescripts/validate-all.sh:172 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
Destructive file system command detectedtemplates/containers/Dockerfile.temurin21.java:22 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05What would make this Verified
5 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim reaan_dev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
- File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim reaan_dev