kxm@0.7.214
VERIFIED· install onlyPublisher claims: "KXM local-first multi-agent orchestration and operator dashboard" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher kontextmind · publishing for 67 daysInstalls 14,033Last detonated 7d ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 80/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
LOW
Collapsed <details> block carrying instructionsREADME.md:160 · Collapsed <details> block carrying instructions · informational: not an instruction file · informational: not an instruction file
AST01<summary>PowerShell</summary> ```powershell # Step 1: ignore runtime state Add-Content .gitignore ".kxm/state/", ".kxm/logs/", ".kxm/backups/" # Step 2: start tFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Privileged sudo commandscripts/ci-postgres-17.sh:82 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo -n apt-get updateFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagepackage.json:55 · npx invocation of non-well-known package — may execute untrusted code
AST06"test:packages": "npx nx run-many -t test --output-style=static",Fix: Pin versions and sources; vendor anything fetched at install time.LOW
Collapsed <details> block carrying instructionsdocs/operations.md:118 · Collapsed <details> block carrying instructions · informational: not an instruction file · informational: not an instruction file
AST01<summary>PowerShell</summary> ```powershell $env:KXMD_HUB_TOKEN = op read "op://Private/kxmd/admin-token" kxm hub bind --cloud --token-env KXMD_HUB_TOKEN http:/Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Collapsed <details> block carrying instructionsdocs/operations/deploy.md:109 · Collapsed <details> block carrying instructions · informational: not an instruction file · informational: not an instruction file
AST01<summary>PowerShell</summary> ```powershell Set-Location C:\srv\kxm\product $env:KXM_HOST = "127.0.0.1" $env:KXM_PORT = "7331" $env:KXM_AUTH_TOKEN = Get-ContentFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Collapsed <details> block carrying instructionsdocs/guides/pi-workers.md:37 · Collapsed <details> block carrying instructions · informational: not an instruction file · informational: not an instruction file
AST01<summary>PowerShell</summary> ```powershell $env:KXM_SERVER_URL = "http://127.0.0.1:7331" $env:KXM_AUTH_TOKEN = "replace-with-the-project-token" $env:KXM_WORKDIFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Privileged sudo commandscripts/ci-postgres-17.sh:83 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "${packages[@]}"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandplugins/kxm/src/cli.ts:1390 · Privileged sudo command — agent may execute with elevated privileges
AST05.option("--sudo", "Use sudo privileges on remote file")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandplugins/kxm/src/cli.ts:1382 · Privileged sudo command — agent may execute with elevated privileges
AST05.option("--sudo", "Execute remote command with sudo privileges")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.LOW
Fake instruction boundary tagdocs/operations/deploy.md:305 · Fake instruction boundary tag · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01| Platform-wide | `svc-<system>-<purpose>` |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File type combined with upload actionplugins/kxm/src/cli.ts:387 · File type combined with upload action — agent may exfiltrate local data files
AST07print(runtime.io, runtime.json, payload, JSON.stringify(output, null, 2));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagepackage.json:57 · npx invocation of non-well-known package — may execute untrusted code
AST06"build:packages": "npx nx run-many -t build --output-style=stream"Fix: Pin versions and sources; vendor anything fetched at install time.LOW
Fake instruction boundary tagdocs/operations/deploy.md:306 · Fake instruction boundary tag · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01| Tenant-scoped | `svc-<tenant>-<system>-<purpose>` |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File permission modification commandscripts/harness-run.mjs:1600 · File permission modification command — agent changes file ownership/permissions
AST05const chmod = options.chmodSync ?? chmodSync;Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.LOW
Instructs the agent to modify its persistent memory or instruction filesscripts/emit-codex-artifacts.mjs:237 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file
AST01* and update the AGENTS.md command block. Owned skills are replaced; unrelatedFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
File permission modification commandscripts/ci-postgres-17.sh:112 · File permission modification command — agent changes file ownership/permissions
AST05chmod 600 "$pwfile"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
npx invocation of non-well-known packagepackage.json:56 · npx invocation of non-well-known package — may execute untrusted code
AST06"check:packages": "npx nx run-many -t build,test:coverage,typecheck --output-style=static",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandscripts/assignment-run.mjs:1019 · File permission modification command — agent changes file ownership/permissions
AST05const chmod = deps.chmodSync ?? chmodSync;Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.Cost to the agent
Instructions loaded
≈42 tok
1 file · 81 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for @kontextmind/kxm@0.7.214 as of 7d ago. This is the package itself, not its dependencies.