Skills/npm/ignarucli

ignarucli@0.4.0

CAUTION· install only

Publisher claims: "Ignaru Studio from your terminal: give your coding agent a design canvas and taste. `npx -y ignarucli mcp --root .` serves the canvas, the design rules and skills, real fonts and screenshots over MCP; `ignaru connect <agent>` adds it to Claude Code, Codex" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher jawadjalal · publishing for 16 daysInstalls 992Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: URL with embedded credentials; URL with embedded credentials; URL with embedded credentials. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actiondist/shot.js:28 · File type combined with upload action — agent may exfiltrate local data files…still:n.still,query:n.query,audit:n.audit,full:n.full,out:n.out,url:n.url,json:n.json,help:n.help},positionals:r})}catch(t){return u(p(t))}}function G(e,t){if(t===void 0)return h(void 0);let n=Number(t);return!Number.isInteger(n)||n<1||n>_…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/check.js:57 · npx invocation of non-well-known package — may execute untrusted code…cutable doesn't exist/i.test(t)?"Chromium for Playwright is not installed. Run `npx playwright-core install chromium` (in a checkout: `npm run install-browser` in harness/)":`Chro…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/check.js:59 · File type combined with upload action — agent may exfiltrate local data files…or a serif, say so in DESIGN.md and list `serif-display` in `.ignaru/tells-allow.json` with that reason (`{"allow": ["serif-display"], "why": "the brief asks for a serif"}`).',headlineLines:"Shorten the copy until the headline (an h1, an h…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/shot.js:29 · npx invocation of non-well-known package — may execute untrusted code…cutable doesn't exist/i.test(t)?"Chromium for Playwright is not installed. Run `npx playwright-core install chromium` (in a checkout: `npm run install-browser` in harness/)":`Chro…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/ad.js:108 · File type combined with upload action — agent may exfiltrate local data files…\]]*)?/gi;Ha=/\bgenerated:\s*[a-z0-9][\w./-]*\s+run\s+[\w-]{4,}|\(gen\/[\w./-]+\.json\)/i,Cr=e=>Fr(e).length>0||Ha.test(e);_u=e=>{let t=e.toLowerCase();return/^(refs?|references?|reference screenshots?)\b/.test(t)?"refs":/^logo/.test(t)?"l…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/ad.js:390 · File type combined with upload action — agent may exfiltrate local data files…ng"}catch{return"missing"}}}function Ip(e,t,n){return n?`not rendered: no render.json in ${t} (run ad render ${e})`:`not rendered: no render.json in ${t}, and this machine has no browser to render with (run \`ignaru browser install\`, then…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageharness/skills/ad/render.ts:745 · npx invocation of non-well-known package — may execute untrusted codethrow new Error(`could not start Chrome at ${chrome} (${why.replace(/npx playwright[^.]*\.?/gi, "").trim()}). ${NO_CHROME}`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
URL with embedded credentialsharness/fonts/fonts.json:139 · URL with embedded credentials — may be phishing or credential leaking"css": "https://fonts.googleapis.com/css2?family=Manrope:wght@400;500;600;700;800&display=swap",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
npx invocation of non-well-known packagedist/main.js:1121 · npx invocation of non-well-known package — may execute untrusted codeexamples: ["ignaru mcp", "claude mcp add ignaru-studio -- npx -y ignarucli mcp --root /path/to/project"],Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/ad.js:314 · File type combined with upload action — agent may exfiltrate local data files…eval score "$(pwd)" --ads-root "${t.adsRoot}"`].join(` `)+` `),ge(V.join(s,"plan.json"),{at:new Date().toISOString(),adsRoot:t.adsRoot,brands:i,routing:n}),{run:s,jobs:r}}var ci={system:"You are the head of growth at this company choosing …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/cards.js:129 · File type combined with upload action — agent may exfiltrate local data files…{JSON.stringify(E,null,2)} `),{direction:T(a,"DIRECTION.md"),json:T(a,"direction.json"),tokens:T(a,"tokens.css"),cards:O,used:x}}function _e(t,e={}){if(!Array.isArray(t)||t.length!==3)throw new Error("pickCard needs exactly three cards");l…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/check.js:58 · File type combined with upload action — agent may exfiltrate local data files…ry(t=>typeof t=="string")}function ra(){let e=JSON.parse(qi(V(ea,"tells-defaults.json"),"utf8")),t=[];if(typeof e!="object"||e===null)return t;for(let[n,r]of[["neutrals","neutral"],["accents","accent"]]){let o=e[n];if(!(typeof o!="object"|…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
URL with embedded credentialsharness/fonts/fonts.json:23 · URL with embedded credentials — may be phishing or credential leaking"css": "https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
URL with embedded credentialsharness/fonts/fonts.json:178 · URL with embedded credentials — may be phishing or credential leaking"css": "https://fonts.googleapis.com/css2?family=Hanken+Grotesk:wght@400;500;600;700&display=swap",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
npx invocation of non-well-known packagedist/text.js:7 · npx invocation of non-well-known package — may execute untrusted code…cutable doesn't exist/i.test(n)?"Chromium for Playwright is not installed. Run `npx playwright-core install chromium` (in a checkout: `npm run install-browser` in harness/)":`Chro…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
URL with embedded credentialsharness/fonts/fonts.json:63 · URL with embedded credentials — may be phishing or credential leaking"css": "https://fonts.googleapis.com/css2?family=Geist:wght@300;400;500;600;700&display=swap",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
LOW
Fake instruction boundary tagREADME.md:180 · Fake instruction boundary tag · informational: not an instruction fileignaru video "<prompt>" [--seconds <n>] [--aspect <a>] [--dry-run]Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actiondist/ad.js:104 · File type combined with upload action — agent may exfiltrate local data files…a list"}function Ra(e,t){if(e!==void 0){let p=vr(e);if(p)throw new Error(`canvas.json cannot be merged: ${p}`)}let n=e??{},o=[...n.pages??[]],s=p=>typeof p.section=="string"&&p.section.trim()?p.section.trim():void 0,r=p=>p?o.map(s).find(h=…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Fake instruction boundary tagharness/core/RULES.md:181 · Fake instruction boundary tag · informational: not an instruction file- `image gen "<prompt>" --out <path>` / `image photo "<query>"`: generated art or a licence-safe photo.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actiondist/check.js:60 · File type combined with upload action — agent may exfiltrate local data files…a!==null)for(let l of yf(a))r(l,`DESIGN.md (${s(i)})`);for(let l of[hn(o,"tokens.json"),hn(o,".ignaru","tokens.json")]){let c=await Qo(l);if(c===null)continue;let u;try{u=JSON.parse(c)}catch{continue}for(let d of bf(u))r(d.family,`tokens.j…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/ad.js:141 · npx invocation of non-well-known package — may execute untrusted code…` `)[0]:String(g);throw new Error(`could not start Chrome at ${m} (${b.replace(/npx playwright[^.]*\.?/gi,"").trim()}). ${un}`)}op(ce.join(o,"feed"),{recursive:!0});for(let g of l){let b=Dt(ce.join(n…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
URL with embedded credentialsharness/fonts/fonts.json:100 · URL with embedded credentials — may be phishing or credential leaking"css": "https://fonts.googleapis.com/css2?family=Instrument+Sans:wght@400;500;600;700&display=swap",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
npx invocation of non-well-known packagedist/init.js:141 · npx invocation of non-well-known package — may execute untrusted codeexamples: ["npx ignarucli init", "npx ignarucli init --site acme.com", "ignaru init --no-open"],Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Fake instruction boundary tagREADME.md:178 · Fake instruction boundary tag · informational: not an instruction fileignaru ask "<prompt>" [--thread <id>] [--model <id>] Ask the agentFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagepackage.json:4 · npx invocation of non-well-known package — may execute untrusted code…u Studio from your terminal: give your coding agent a design canvas and taste. `npx -y ignarucli mcp --root .` serves the canvas, the design rules and skills, real fo…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/ad.js:3 · File type combined with upload action — agent may exfiltrate local data files…d:!1},messages:[{role:"system",content:s},{role:"user",content:d}]})}),S=await w.json().catch(()=>({})),$=S.choices?.[0]?.message?.content,v=a??600,E=S.usage?.completion_tokens;if(w.ok&&S.choices?.[0]?.finish_reason==="length"&&typeof E=="…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈13,682 tok
4 files · 80 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for ignarucli@0.4.0 as of 4d ago. This is the package itself, not its dependencies.

What would make this Verified

3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim jawadjalal: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim jawadjalalPropose a patch to the maintainer