kane-cli-skill@0.1.5
VERIFIED· install onlyPublisher claims: "End-to-end (E2E) test generation and execution: generate use-cases, acceptance criteria, scenarios and tests from requirements, then run them on desktop web, Android and iOS (emulators, simulators and real devices) with execution evidence and coverage." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher testmuai · publishing for 214 daysInstalls 1,127Last detonated 2d ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
CRITICAL
HTML comment carrying imperative instructions to the agentskills/references/assurance-parsing.md:1 · HTML comment carrying imperative instructions to the agent
AST01kane-cli skill reference: NDJSON wire contract for the assurance conversational commands (context ingest/extract / design tests / maintain reconcile / cover witFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.CRITICAL
HTML comment carrying imperative instructions to the agentskills/references/agent-contract.md:1 · HTML comment carrying imperative instructions to the agent
AST01kane-cli skill reference: the agent contract for a folder linked to a shared project (kane-cli 0.10.0+). Which agent flag each command takes, the NDJSON shapes,Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.CRITICAL
HTML comment carrying imperative instructions to the agentskills/references/first-run.md:1 · HTML comment carrying imperative instructions to the agent
AST01Read this when the agent config shows no completed onboarding (a first session). Owns the run-first rule and its detected defaults, the first-run tour (verbatimFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.CRITICAL
HTML comment carrying imperative instructions to the agentskills/references/policy.md:1 · HTML comment carrying imperative instructions to the agent
AST01kane-cli skill reference: evidence policies and verdicts (judge a sealed pack against a policy YAML: lint-policy, evidence verdict, --policy/--policy-id on testFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.CRITICAL
HTML comment carrying imperative instructions to the agentskills/references/debug.md:1 · HTML comment carrying imperative instructions to the agent
AST01Read this when a kane-cli run failed and you need to diagnose. Owns the evidence-pack layout (the only source of run logs), how to read a sealed pack, the debugFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.CRITICAL
HTML comment carrying imperative instructions to the agentskills/references/explore.md:1 · HTML comment carrying imperative instructions to the agent
AST01kane-cli skill reference: exploration on HyperExecute, and the tests it designs into a shared project. Read when the person asks to explore an app, map its flowFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.CRITICAL
HTML comment carrying imperative instructions to the agentskills/references/live-strip.md:1 · HTML comment carrying imperative instructions to the agent
AST01Read this when the person asks to watch runs live, asks about the status line, or right after a first run in Claude Code (to offer the strip). Owns what the livFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.CRITICAL
HTML comment carrying imperative instructions to the agentskills/references/cards.md:1 · HTML comment carrying imperative instructions to the agent
AST01Read this when presenting the result of any kane-cli run, saved test or suite. Owns every result card: run passed, run failed, didn't start, stopped early, prodFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.CRITICAL
HTML comment carrying imperative instructions to the agentskills/references/objectives-cookbook.md:1 · HTML comment carrying imperative instructions to the agent
AST01Read this when authoring objective strings — for either `kane-cli run "..."` or step bodies inside a `_test.md`. Owns the full catalog of action verbs, assertioFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
npx invocation of non-well-known packagecli.js:110 · npx invocation of non-well-known package — may execute untrusted code
AST06console.log(`To undo: npx ${PACKAGE} strip disable`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli.js:166 · npx invocation of non-well-known package — may execute untrusted code
AST06const STRIP_USAGE = `Usage: npx ${PACKAGE} strip enable|disable|status [--host claude-code]`;Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli.js:165 · npx invocation of non-well-known package — may execute untrusted code
AST06const PREFS_USAGE = `Usage: npx ${PACKAGE} prefs --watch <v> --purpose <v> [--narration <v>]`;Fix: Pin versions and sources; vendor anything fetched at install time.CRITICAL
HTML comment carrying imperative instructions to the agentskills/references/test-manager.md:1 · HTML comment carrying imperative instructions to the agent
AST01Read this for the Test Manager (TMS) agent surface — what gets uploaded, where the run lands, the `projects` / `folders` subcommands and their NDJSON wire shapeFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
npx invocation of non-well-known packagecli.js:215 · npx invocation of non-well-known package — may execute untrusted code
AST06console.log(`To undo: npx ${PACKAGE} strip disable`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagecli.js:113 · npx invocation of non-well-known package — may execute untrusted code
AST06console.log(`Left off. To turn it on later: npx ${PACKAGE} strip enable`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commandskills/SKILL.md:224 · Process kill command — agent can terminate processes
AST05| `--timeout <s>` | Hard kill after N seconds | No limit |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.CRITICAL
HTML comment carrying imperative instructions to the agentskills/references/testmd.md:1 · HTML comment carrying imperative instructions to the agent
AST01Read this when the user wants to save, persist, version-control, or re-run a browser test. Owns _test.md file format, replay/cascade rules, testmd subcommands, Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.CRITICAL
HTML comment carrying imperative instructions to the agentskills/references/ready-check.md:1 · HTML comment carrying imperative instructions to the agent
AST01Read this at the start of every session that will use kane-cli. Owns the preflight script, the ready check card (full, one-line and problem versions), which proFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.Cost to the agent
Instructions loaded
≈9,846 tok
1 file · 33 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for @testmuai/kane-cli-skill@0.1.5 as of 2d ago. This is the package itself, not its dependencies.