Is hf-mcp-server@0.4.31 safe to install?

Skills/npm/hf-mcp-server

hf-mcp-server@0.4.31

BLOCKED

Publisher claims: "Official Hugging Face MCP Server" Observed in sandbox: static analysis only — behavior not yet observed.

Registry npm (MCP server)Publisher llmindset · joined 0 days agoInstalls 3,793Last detonated 2 h ago

What would fix this Watch Dispute verdict

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-10-26 and scored it 45/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: URL with embedded credentials; Pipe-to-shell pattern; URL with embedded credentials. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only

t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM

File type combined with upload actiondist/web/assets/main-CzX91RcJ.js:8 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)package.json:9 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

Remote installer piped to shelldist/web/mcp-welcome.html:48 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST07

MEDIUM

File type combined with upload actiondist/web/assets/main-CzX91RcJ.js:9 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

MCP server using network transport (SSE/HTTP)dist/web/mcp-welcome.html:48 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

HIGH

URL with embedded credentialsdist/web/assets/main-Dae1yiDe.css:1 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

CRITICAL

Pipe-to-shell patterndist/web/mcp-welcome.html:48 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST06

MEDIUM

MCP server using network transport (SSE/HTTP)package.json:10 · MCP server using network transport (SSE/HTTP) — data sent over networkFix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.

AST04

MEDIUM

File type combined with upload actiondist/web/assets/main-CzX91RcJ.js:52 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actiondist/web/mcp-welcome.html:15 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

HIGH

URL with embedded credentialsdist/web/mcp-welcome.html:53 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST07

HIGH

Base64 encoding combined with network calldist/web/assets/main-CzX91RcJ.js:9 · Base64 encoding combined with network call — potential data exfiltrationFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.

AST07

What would make this Verified

35 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Unclaimed publisher≈ +8 on the totalClaim llmindset: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Obfuscated code≈ +5 on the totalRemove base64-assembled strings, eval of decoded text and minified blobs. Reviewers and scanners both treat unreadable code as hostile.
URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Base64 encoding combined with network call≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.

Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim llmindset