kilotest@65.2.1
VERIFIED· startup onlyPublisher claims: "Ensemble testing for front-end web quality" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher jrpool · publishing for 167 daysInstalls 13,372Last detonated 36 h ago
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
ALERT_API_KEYAUTH_CODEConfiguration, not credentials: AI_MODEL0_INPUT_PRICE, AI_MODEL0_OUTPUT_PRICE, AI_SERVICE0_BALANCE_THRESHOLD, ALERT_API_HOST, ALERT_API_PATH, ALERT_FROM, ALLOW_INTERNAL_TARGETS, AWAIT_JOB_POLL_MS, AWAIT_JOB_TIMEOUT_MS, CERT, DB_DIR, FEATURE_REQUESTS_PATH, KEY, MANAGER_EMAIL, PROTOCOL, SMOKE_HOST, TEST_ENV_MAX_VAR, TESTARO_WORKERS, THIS_KILOTEST_HOST, TUTORIAL_AI_COMMENTS_PATH, TUTORIAL_WEB_COMMENTS_PATH, WAVE_BALANCE_THRESHOLD- Where it talks to
- no vendor host named in the codeAlso kilotest.com, example.org, fire.org, thefire.org, farmsanctuary.org, eo.org, x.org, homesite.org, neworg.example, x.example, fixture.example, fs.example, other.example, a.example, c.example, lobehub.com, unknown.example, b.org, a.org, pdx.edu, womensliberationfront.org, thekccf.org, cvs.com, cvshealth.com, gone.example, nonexistent.invalid, example.net — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names kilotest.com, example.org, fire.org, thefire.org, farmsanctuary.org, eo.org, x.org, homesite.org, neworg.example, x.example, fixture.example, fs.example, other.example, a.example, c.example, lobehub.com, unknown.example, b.org, a.org, pdx.edu, womensliberationfront.org, thekccf.org, cvs.com, cvshealth.com, gone.example, nonexistent.invalid, example.net as well as its own vendor. The guard injects ALERT_API_KEY, AUTH_CODE only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- npx -y @jrpool/kilotest
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-13 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 40 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
19sprocessdependency install exit 0
39sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-JjQwAw/task/home/work/acme-api/.claude/skills/kilotest/web/tutorialWeb/index.ts' } Node.js v22.23.5
39sprocessscript backend runs setup only
39sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathsutil.ts:939 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// so a variable set (e.g. in .env) after this module first loads still takes effect. UsedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actionindex.ts:390 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log('Cannot send error response because the response has ended.');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Access to sensitive file pathsindex.test.ts:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// imported, prevents a real .env file's alert credentials from ever taking effect.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
URL to a private-network addressindex.test.ts:1486 · URL to a private-network address — a LAN or development target
AST07t.mock.method(globalThis, 'fetch', async () => ({url: 'https://192.168.1.1/test'}) as Response);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File type combined with upload actionsmokeTest.ts:233 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`FAIL: POST ${mcpPath} initialize -> error: ${message}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
URL to a private-network addressutil.test.ts:544 · URL to a private-network address — a LAN or development target
AST07await getAllowedRedirectURL('https://example.com/a', fakeFetch('https://10.0.0.5/b'), fakeLookup('93.184.216.34')),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Access to sensitive file pathstest/setup.ts:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05// rather than relying on a developer's .env keeps tests independent of the environment.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagepackage.json:19 · npx invocation of non-well-known package — may execute untrusted code
AST06"publish:lhm": "npx -y @lobehub/market-cli plugin update --dir .",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionscripts/generate-llms.ts:40 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`Wrote ${outputPath}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/prePR.ts:65 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log('Submit a pull request, merge it to main, then run: npm run postPR');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/generate-lhm.ts:75 · File type combined with upload action — agent may exfiltrate local data files
AST07// Builds the lhm.plugin.json inputSchema for a tool: like outputSchema below, but LobeHub’sexisting input schemas never carry additionalProperties, so that key is dropped.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
HTTP URL with a raw public IP addressutil.test.ts:504 · HTTP URL with a raw public IP address — a hard-coded destination that domain-based monitoring cannot name
AST07assert.equal(await isAllowedTarget('https://93.184.216.34/page'), true);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File type combined with upload actionscripts/propose-site-mapping.ts:296 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`Wrote ${outputPath}. No report was modified.`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagepackage.json:13 · npx invocation of non-well-known package — may execute untrusted code
AST06"lint": "npx eslint && npx htmlhint web error.html && out=$(npx markdownlint-cli2 2>&1); code=$?; if [ $code -ne 0 ]; then echo \"$out\"; exit $code; fi && node scripts/check-docs.ts",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actionscripts/generate-lhm.ts:123 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`Wrote ${outputPath}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
URL to a private-network addressindex.test.ts:1215 · URL to a private-network address — a LAN or development target
AST07url: 'https://192.168.1.1/page',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Access to sensitive file pathstest/setup.ts:8 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05dotenv does not override existing env vars. This prevents the .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actionscripts/generate-openapi.ts:163 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`Wrote ${output30Path}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionsmokeTest.ts:246 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`FAIL: POST ${mcpPath} bad accept -> ${probe.statusCode} (body: ${probe.body.slice(0, 120)})`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
URL using a raw public IP addressutil.test.ts:504 · URL using a raw public IP address — may bypass domain-based filtering
AST07assert.equal(await isAllowedTarget('https://93.184.216.34/page'), true);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File type combined with upload actionscripts/generate-openapi.ts:160 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`Wrote ${outputPath}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/prePR.ts:3 · File type combined with upload action — agent may exfiltrate local data files
AST07…ion, regenerates the generated files (openapi.yaml, openapi-3.0.yaml, lhm.plugin.json, the opening paragraph of llms.txt, server.json, and the version field of lhm.plugin.json), commits and pushes the result, records the branch name for po…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionscripts/buildDemoVideo.ts:121 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`Wrote ${outputPath}: ${slides.length} slides, ${totalSeconds} seconds`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
URL to a private-network addressutil.test.ts:532 · URL to a private-network address — a LAN or development target
AST07await isAllowedRedirectTarget('https://example.com/page', fakeFetch('https://10.0.0.5/page'), fakeLookup('93.184.216.34')),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.LOW
URL to a private-network addressutil.test.ts:499 · URL to a private-network address — a LAN or development target
AST07assert.equal(await isAllowedTarget('https://192.168.1.1/page'), false);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File type combined with upload actionscripts/generate-lhm.ts:82 · File type combined with upload action — agent may exfiltrate local data files
AST07// Builds the lhm.plugin.json outputSchema for a tool, reordering keys to match the file’s existing convention ($schema placed just before additionalProperties and definitions).Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionsmokeTest.ts:224 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`PASS: POST ${mcpPath} initialize -> ${probe.statusCode} (valid MCP response)`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
URL to a private-network addressutil.test.ts:514 · URL to a private-network address — a LAN or development target
AST07assert.equal(await isAllowedTarget('https://192.168.1.1/page'), true);Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File type combined with upload actionsmokeTest.ts:243 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`PASS: POST ${mcpPath} bad accept -> ${probe.statusCode} (JSON-RPC error)`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.LOW
URL to a private-network addressindex.test.ts:1625 · URL to a private-network address — a LAN or development target
AST07type: 'test', which: 'axe', actualURL: 'https://192.168.1.1/test',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
File type combined with upload actionsmokeTest.ts:227 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log(`FAIL: POST ${mcpPath} initialize -> ${probe.statusCode} (body: ${probe.body.slice(0, 120)})`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.Cost to the agent
Instructions loaded
≈47 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @jrpool/kilotest@65.2.1 as of 36 h ago. This is the package itself, not its dependencies.