kilotest@63.2.2
VERIFIED· not startedPublisher claims: "Ensemble testing for front-end web quality" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher jrpool · publishing for 167 daysInstalls 13,372Last detonated 7d ago
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
Code inventory arrives with this version's next honeypot run.- It will ask for
- unknown until the next run
- Where it talks to
- unknown until the next run
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Not enough was observed to say yet. Not started: dependency install failed; the server itself was not observed. This version's code has not been inventoried for credentials and hosts either; both arrive with its next honeypot run (popular servers first). `vet-skills try kilotest` runs it now and prints the full answer.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-07 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 1 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.8sprocessdependency install exit 1
1.0sprocessexec /usr/bin/date
1.0sprocessexec /usr/bin/timeout
1.0sclaimedno tools/list reply (exit 0)
1.0sprocessscript backend runs setup only
1.0sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathsutil.ts:997 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// so a variable set (e.g. in .env) after this module first loads still takes effect. UsedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
URL to a private-network addressindex.test.ts:1425 · URL to a private-network address — a LAN or development target
AST07t.mock.method(globalThis, 'fetch', async () => ({url: 'https://192.168.1.1/test'}) as Response);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File type combined with upload actionindex.ts:398 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log('Cannot send error response because the response has ended.');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
URL to a private-network addressindex.test.ts:1564 · URL to a private-network address — a LAN or development target
AST07type: 'test', which: 'axe', actualURL: 'https://192.168.1.1/test',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File type combined with upload actionsmokeTest.ts:227 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`FAIL: POST ${mcpPath} initialize -> ${probe.statusCode} (body: ${probe.body.slice(0, 120)})`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Access to sensitive file pathsindex.test.ts:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// imported, prevents a real .env file's alert credentials from ever taking effect.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagepackage.json:13 · npx invocation of non-well-known package — may execute untrusted code
AST06"lint": "npx eslint && npx htmlhint web error.html && out=$(npx markdownlint-cli2 2>&1); code=$?; if [ $code -ne 0 ]; then echo \"$out\"; exit $code; fi && node scripts/check-docs.ts",Fix: Pin versions and sources; vendor anything fetched at install time.LOW
URL to a private-network addressindex.test.ts:1425 · URL to a private-network address — a LAN or development target
AST07t.mock.method(globalThis, 'fetch', async () => ({url: 'https://192.168.1.1/test'}) as Response);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.LOW
URL to a private-network addressindex.test.ts:1154 · URL to a private-network address — a LAN or development target
AST07url: 'https://192.168.1.1/page',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.LOW
URL to a private-network addressindex.test.ts:1564 · URL to a private-network address — a LAN or development target
AST07type: 'test', which: 'axe', actualURL: 'https://192.168.1.1/test',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.LOW
URL to a private-network addressindex.test.ts:1154 · URL to a private-network address — a LAN or development target
AST07url: 'https://192.168.1.1/page',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File type combined with upload actionscripts/generate-lhm.ts:84 · File type combined with upload action — agent may exfiltrate local data files
AST07// Builds the lhm.plugin.json outputSchema for a tool, reordering keys to match the file’s existing convention ($schema placed just before additionalProperties and definitions).Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionsmokeTest.ts:224 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`PASS: POST ${mcpPath} initialize -> ${probe.statusCode} (valid MCP response)`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/prePR.ts:3 · File type combined with upload action — agent may exfiltrate local data files
AST07Prepares a release pull request on the current feature branch: verifies a clean working tree, bumps the package version, regenerates the generated files (openapi.yaml, openapi-3.0.yaml, lhm.plugin.jsoFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/buildDemoVideo.ts:121 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`Wrote ${outputPath}: ${slides.length} slides, ${totalSeconds} seconds`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/prePR.ts:65 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log('Submit a pull request, merge it to main, then run: npm run postPR');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Access to sensitive file pathstest/setup.ts:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// rather than relying on a developer's .env keeps tests independent of the environment.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actionscripts/generate-llms.ts:34 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`Wrote ${outputPath}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/generate-openapi.ts:163 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`Wrote ${output30Path}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionsmokeTest.ts:243 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`PASS: POST ${mcpPath} bad accept -> ${probe.statusCode} (JSON-RPC error)`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionsmokeTest.ts:233 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`FAIL: POST ${mcpPath} initialize -> error: ${message}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
URL to a private-network addressutil.test.ts:499 · URL to a private-network address — a LAN or development target
AST07assert.equal(await isAllowedTarget('https://192.168.1.1/page'), false);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File type combined with upload actionscripts/generate-lhm.ts:121 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`Wrote ${outputPath}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionsmokeTest.ts:246 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`FAIL: POST ${mcpPath} bad accept -> ${probe.statusCode} (body: ${probe.body.slice(0, 120)})`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagepackage.json:19 · npx invocation of non-well-known package — may execute untrusted code
AST06"publish:lhm": "npx -y @lobehub/market-cli plugin update --dir .",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Access to sensitive file pathstest/setup.ts:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05dotenv does not override existing env vars. This prevents the .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actionscripts/generate-lhm.ts:77 · File type combined with upload action — agent may exfiltrate local data files
AST07// Builds the lhm.plugin.json inputSchema for a tool: like outputSchema below, but LobeHub’sexisting input schemas never carry additionalProperties, so that key is dropped.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/generate-openapi.ts:160 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`Wrote ${outputPath}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
URL to a private-network addressutil.test.ts:532 · URL to a private-network address — a LAN or development target
AST07await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://10.0.0.5/page'), fakeLookup('93.184.216.34')),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.LOW
URL to a private-network addressutil.test.ts:514 · URL to a private-network address — a LAN or development target
AST07assert.equal(await isAllowedTarget('https://192.168.1.1/page'), true);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
URL using raw IP addressutil.test.ts:504 · URL using raw IP address — may bypass domain-based filtering
AST07assert.equal(await isAllowedTarget('https://93.184.216.34/page'), true);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.LOW
URL to a private-network addressutil.test.ts:499 · URL to a private-network address — a LAN or development target
AST07assert.equal(await isAllowedTarget('https://192.168.1.1/page'), false);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.LOW
URL to a private-network addressutil.test.ts:546 · URL to a private-network address — a LAN or development target
AST07assert.equal(await isAllowedRedirectTarget('https://192.168.1.1/page', fetchImpl), true);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Outbound HTTP to raw IP addressutil.test.ts:504 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07assert.equal(await isAllowedTarget('https://93.184.216.34/page'), true);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.LOW
URL to a private-network addressutil.test.ts:532 · URL to a private-network address — a LAN or development target
AST07await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://10.0.0.5/page'), fakeLookup('93.184.216.34')),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.LOW
URL to a private-network addressutil.test.ts:514 · URL to a private-network address — a LAN or development target
AST07assert.equal(await isAllowedTarget('https://192.168.1.1/page'), true);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.LOW
URL to a private-network addressutil.test.ts:546 · URL to a private-network address — a LAN or development target
AST07assert.equal(await isAllowedRedirectTarget('https://192.168.1.1/page', fetchImpl), true);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.Cost to the agent
Instructions loaded
≈47 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @jrpool/kilotest@63.2.2 as of 7d ago. This is the package itself, not its dependencies.