Skills/npm/epsimo-agent

epsimo-agent@0.3.0

BLOCKED

Publisher claims: "AI Agent Skill - Build production-ready AI applications with multi-agent orchestration, Virtual Database, streaming conversations, and React UI Kit. For Claude Code, Cursor, Windsurf, and 30+ AI coding agents." Observed in sandbox: calls github.com only, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher thierryteisseire · joined 5 days agoInstalls 58Last detonated 5d ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-28 and scored it 34/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Pipe-to-shell pattern; Pipe-to-shell pattern; Pipe-to-shell pattern. Summary: calls github.com only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios
t+CategoryObserved action
0.3sfilesystemread ~/.netrc
0.3sfilesystemread ~/.epsimo/repo/.git/config · ~/.epsimo/repo/.git/packed-refs · ~/.epsimo/repo/.git/HEAD · ~/.epsimo/repo/.git · ~/.epsimo/repo/.git/hooks · ~/.epsimo/repo/.git/objects outside project
0.3sfilesystemwrote ~/.epsimo/repo/.git/hooks/pre-push.sample · ~/.epsimo/repo/.git/hooks/push-to-checkout.sample · ~/.epsimo/repo/.git/hooks/applypatch-msg.sample · ~/.epsimo/repo/.git/hooks/fsmonitor-watchman.sample · ~/.epsimo/repo/.git/hooks/post-update.sample · ~/.epsimo/repo/.git/hooks/commit-msg.sample
0.3snetworkCONNECT https://github.com
0.3sprocessexec /usr/bin/cut
0.3sprocessexec /usr/bin/mkdir
0.3sprocessexec /usr/bin/git
0.3sprocessexec /usr/lib/git-core/git
0.3sprocessexec /usr/lib/git-core/git-remote-https
0.3sprocessexited 128: fatal: unable to access 'https://github.com/thierryteisseire/epsimo-agent.git/': CONNECT tunnel failed, response 403
0.3sprocessscript backend runs setup only
0.3sprocessscript backend runs setup only

Static findings

CRITICAL
Pipe-to-shell patterninstall.sh:5 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patterninstall.sh:4 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patterninstall.sh:137 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Direct script execution from GitHub raw URLinstall.sh:5 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionepsimo/templates/components/ThreadChat/ThreadChat.tsx:282 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandinstall.sh:99 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shellinstall.sh:4 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Privileged sudo commandinstall.sh:104 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionepsimo/templates/components/ThreadChat/ThreadChat.tsx:627 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commandSKILL.md:48 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Direct script execution from GitHub raw URLinstall.sh:137 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedepsimo/auth.py:64 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Direct script execution from GitHub raw URLinstall.sh:4 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/verify_skill.py:15 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/auth.py:76 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Remote installer piped to shellinstall.sh:137 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commandskills/epsimo-agent/SKILL.md:48 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellinstall.sh:5 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07

What would make this Verified

46 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim thierryteisseire: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  5. Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim thierryteisseire