Skills/npm/fetcher-mcp

fetcher-mcp@0.4.1

CAUTION

Publisher claims: "MCP server for fetching web content using Playwright browser" Observed in sandbox: sends data to cdn.playwright.dev.

Registry npm (MCP server)Publisher jaeger · joined 11 days agoInstalls 17,888Last detonated 1 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-05 and scored it 57/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: sends data to cdn.playwright.dev.

Behavior trace

Honeypot run · 4 s · 2 scenarios
t+CategoryObserved action
2.8sfilesystemread ~/.cache/ms-playwright/.links · ~/.cache/ms-playwright/.links/012449f02ce4f07fac91ce0c44bf51274bc3c21b · ~/.cache/ms-playwright outside project
2.8sfilesystemwrote ~/.cache/ms-playwright/.links/012449f02ce4f07fac91ce0c44bf51274bc3c21b
2.8snetworkCONNECT https://cdn.playwright.dev · undeclared
2.8snetworkCONNECT https://cdn.playwright.dev · undeclared
2.8snetworkCONNECT https://cdn.playwright.dev · undeclared
2.8snetworkCONNECT https://cdn.playwright.dev · undeclared
2.8snetworkCONNECT https://cdn.playwright.dev · undeclared
2.8sprocessexec /app/apps/web/node_modules/.bin/playwright
2.8sprocessexec /usr/bin/sed
2.8sprocessexec /usr/bin/dirname
2.8sprocessexec /usr/bin/uname
2.8sprocessexited 1: at process.processTicksAndRejections (node:internal/process/task_queues:89:21)
3.6sprocessdependency install exit 1
3.7sprocessexec /usr/bin/date
3.7sprocessexec /usr/bin/timeout
3.7sclaimedno tools/list reply (exit 0)
3.7sprocessscript backend runs setup only

Static findings

LOW
Context shift attemptREADME.md:255 · Context shift attempt — trying to change operational mode · informational: not an instruction fileFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Context shift attemptREADME.md:257 · Context shift attempt — trying to change operational mode · informational: not an instruction fileFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagebuild/tools/browserInstall.js:125 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Context shift attemptREADME.md:156 · Context shift attempt — trying to change operational mode · informational: not an instruction fileFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Context shift attemptREADME.md:235 · Context shift attempt — trying to change operational mode · informational: not an instruction fileFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagebuild/tools/browserInstall.js:51 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepackage.json:18 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebuild/tools/browserInstall.js:127 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebuild/tools/browserInstall.js:122 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebuild/tools/browserInstall.js:95 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈50 tok
1 file · 22 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

23 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  2. Unclaimed publisher≈ +8 on the totalClaim jaeger: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim jaeger