Skills/npm/frely-cli

frely-cli@0.23.39

CAUTION· startup only

Publisher claims: "Frely CLI — FrelyMCP gives ChatGPT, Claude, Codex and other MCP clients access to your computer" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher frelyhq · publishing for 64 daysInstalls 9,563Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
FRELY_CREDENTIAL_KEYFRELY_CREDENTIAL_STOREFRELY_INSTALL_TOKEN or --service-credential-storeConfiguration, not credentials: FRELY_COMPUTER_BIN, FRELY_DATA_DIR, FRELY_DEBUG, FRELY_FRPC_BASE_URL, FRELY_HOME, FRELY_INSTALL_SOURCES, FRELY_MCP_DAYS, FRELY_MCP_URL, FRELY_NETWORK_ALLOW_LOOPBACK, FRELY_NO_BROWSER, FRELY_NO_SERVICE, FRELY_RELAY_URL, FRELY_TASK_MAX_CONCURRENT, XDG_RUNTIME_DIR, XDG_STATE_HOME
Where it talks to
frely.cloud (its own)Also apple.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names apple.com as well as its own vendor. The guard injects FRELY_CREDENTIAL_KEY, FRELY_CREDENTIAL_STORE, FRELY_INSTALL_TOKEN only into requests to frely.cloud (and its subdomains) and refuses the rest.

$vet-skills run --secrets FRELY_CREDENTIAL_KEY=frely.cloud,FRELY_CREDENTIAL_STORE=frely.cloud,FRELY_INSTALL_TOKEN=frely.cloud -- npx -y frely-cli

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-11 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Reads credential paths from the home directory; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 26 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessexited 1: Node.js v22.23.4
5.9sprocessdependency install exit 0
26sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-Lq3AA2/task/home/work/acme-api/.claude/skills/frely-cli/dist/mcp-authorization.js' } Node.js v22.23.4
26sprocessscript backend runs setup only
26sprocesssecond launch, clock +45 days, CI unset
26sprocessexited 1: Node.js v22.23.4

Static findings

HIGH
Access to sensitive file pathsdist/agent-help.d.ts:150 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ead-only tools that run here: only files it asks for leave this computer; .git, .env*, key files, git-ignored and binary files are refused; defaults 1 MiB read and …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Reads credential paths from the home directorydist/runtime/mcp.js:106 · Reads credential paths from the home directory…ace and temp, network to HTTP(S) and ssh (the connection needs no approval, but reading ~/.ssh config and keys does: request_permission resource=ssh). action=run waits up to …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Process kill commanddist/auth.d.ts:165 · Process kill command — agent can terminate processes/** Continues a browser login whose process ended before the owner approved (an agent shell can kill it): waits on the saved device code until it expires. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/skill/entry.d.ts:5 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…read-only tools that run on this computer, only the files it asks for; `.git`, `.env*`, key files and git-ignored files are never sent, and the result lists the fil…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/runtime/mcp.js:106 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…temp, network to HTTP(S) and ssh (the connection needs no approval, but reading ~/.ssh config and keys does: request_permission resource=ssh). action=run waits up to …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/skill/entry.d.ts:5 · MCP server using network transport (SSE/HTTP) — data sent over network… pass as in any MCP client. `frely item config <username/mcp-name>` prints the `mcpServers` JSON for clients that should connect to that one MCP directly.\n\n## What needs FrelyMCP\n\nThe steps above work without FrelyMCP. FrelyMCP is only…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Privileged sudo commanddist/service.js:200 · Privileged sudo command — agent may execute with elevated privilegesreturn `Warning: lingering is off for ${user}, so this device goes offline when your SSH session ends. Run \`sudo loginctl enable-linger ${user}\` to keep it online.`;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/agent-help.js:78 · Process kill command — agent can terminate processes…b, so the call finishes by itself and you need not be told. Never background or kill it." }, { id: "app.install", usage: "frely app install [--force] [--json]", …Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/agent-help.js:27 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file…newest progress line while it runs. --no-progress-summary asks the Agent not to write progress lines (use it when the user says so, for example in AGENTS.md); without a flag the account setting applies. With --read the Agent may read fi…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commanddist/agent-help.js:70 · Process kill command — agent can terminate processes{ id: "kill", usage: "frely kill <device> <id>", auth: "login", effect: "remote-execution", purpose: "Stop a background command on a device." },Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/agent-help.d.ts:673 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ead-only tools that run here: only files it asks for leave this computer; .git, .env*, key files, git-ignored and binary files are refused; defaults 1 MiB read and …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/skill/entry.js:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…d-only tools that run on this computer, only the files it asks for; \`.git\`, \`.env*\`, key files and git-ignored files are never sent, and the result lists the fi…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commanddist/diagnostics.js:62 · File permission modification command — agent changes file ownership/permissions: `Configuration unreadable. Use owner-only permissions: chmod 700 ${dirname(mcpMetadataPath())} && chmod 600 ${mcpMetadataPath()}`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commanddist/app-manager.js:284 · File permission modification command — agent changes file ownership/permissionsd.log("Warning: could not mark the AppImage executable; run chmod +x manually.");Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commanddist/agent-help.d.ts:928 · Process kill command — agent can terminate processesreadonly usage: "frely kill <device> <id>";Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commanddist/app-manager.js:282 · File permission modification command — agent changes file ownership/permissionsconst chmod = await d.run("chmod", ["+x", target]);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commanddist/agent-help.d.ts:405 · Process kill command — agent can terminate processesreadonly usage: "frely kill <device> <id>";Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/agent-help.d.ts:150 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file…newest progress line while it runs. --no-progress-summary asks the Agent not to write progress lines (use it when the user says so, for example in AGENTS.md); without a flag the account setting applies. With --read the Agent may read fi…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsdist/agent-help.js:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ead-only tools that run here: only files it asks for leave this computer; .git, .env*, key files, git-ignored and binary files are refused; defaults 1 MiB read and …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/auth.js:262 · Process kill command — agent can terminate processes/** Continues a browser login whose process ended before the owner approved (an agent shell can kill it): waits on the saved device code until it expires. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/agent-help.d.ts:456 · Process kill command — agent can terminate processes…b, so the call finishes by itself and you need not be told. Never background or kill it."; }, { readonly id: "app.install"; readonly usage: "frely app instal…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/agent-help.js:258 · Process kill command — agent can terminate processeskill: "frely kill <device> <id>",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/link-claim.js:38 · File type combined with upload action — agent may exfiltrate local data filesoptions.log("Remote control was turned off from the web; locking this computer.");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commanddist/agent-help.d.ts:979 · Process kill command — agent can terminate processes…b, so the call finishes by itself and you need not be told. Never background or kill it."; }, { readonly id: "app.install"; readonly usage: "frel…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/provider/key.js:2 · File type combined with upload action — agent may exfiltrate local data files/** The upstream key of a local Provider (a NewAPI, vLLM or other gateway that wants one). Kept with the CLI's other secrets; never in local-providers.json, never uploaded. */Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/skill/access.js:373 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file…lling again. If the user asked not to see progress updates (for example in their AGENTS.md), add \`--no-progress-summary\` to the run command. If the result starts with NEED_FI…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/agent-help.d.ts:673 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file…newest progress line while it runs. --no-progress-summary asks the Agent not to write progress lines (use it when the user says so, for example in AGENTS.md); without a flag the account setting applies. With --read the Agent may read fi…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈59 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for frely-cli@0.23.39 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential paths from the home directory≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim frelyhq: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim frelyhqPropose a patch to the maintainer