Skills/npm/kxm

kxm@0.7.216

CAUTION· install only

Publisher claims: "KXM local-first multi-agent orchestration and operator dashboard" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher kontextmind · publishing for 67 daysInstalls 14,033Last detonated 30 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-13 and scored it 65/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Collapsed <details> block carrying instructions; Collapsed <details> block carrying instructions; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Collapsed <details> block carrying instructionsREADME.md:160 · Collapsed <details> block carrying instructions<summary>PowerShell</summary> ```powershell # Step 1: ignore runtime state Add-Content .gitignore ".kxm/state/", ".kxm/logs/", ".kxm/backups/" # Step 2: start tFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Collapsed <details> block carrying instructionsdocs/guides/pi-workers.md:37 · Collapsed <details> block carrying instructions<summary>PowerShell</summary> ```powershell $env:KXM_SERVER_URL = "http://127.0.0.1:7331" $env:KXM_AUTH_TOKEN = "replace-with-the-project-token" $env:KXM_WORKDIFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commandscripts/assignment-run.mjs:1019 · File permission modification command — agent changes file ownership/permissionsconst chmod = deps.chmodSync ?? chmodSync;Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
Fake instruction boundary tagdocs/operations/deploy.md:305 · Fake instruction boundary tag · informational: not an instruction file| Platform-wide | `svc-<system>-<purpose>` |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesscripts/emit-codex-artifacts.mjs:237 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file* and update the AGENTS.md command block. Owned skills are replaced; unrelatedFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Privileged sudo commandscripts/ci-postgres-17.sh:83 · Privileged sudo command — agent may execute with elevated privilegessudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "${packages[@]}"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagepackage.json:55 · npx invocation of non-well-known package — may execute untrusted code"test:packages": "npx nx run-many -t test --output-style=static",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandplugins/kxm/src/cli.ts:1390 · Privileged sudo command — agent may execute with elevated privileges.option("--sudo", "Use sudo privileges on remote file")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Collapsed <details> block carrying instructionsdocs/operations.md:118 · Collapsed <details> block carrying instructions<summary>PowerShell</summary> ```powershell $env:KXMD_HUB_TOKEN = op read "op://Private/kxmd/admin-token" kxm hub bind --cloud --token-env KXMD_HUB_TOKEN http:/Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagepackage.json:57 · npx invocation of non-well-known package — may execute untrusted code"build:packages": "npx nx run-many -t build --output-style=stream"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Collapsed <details> block carrying instructionsdocs/operations/deploy.md:109 · Collapsed <details> block carrying instructions<summary>PowerShell</summary> ```powershell Set-Location C:\srv\kxm\product $env:KXM_HOST = "127.0.0.1" $env:KXM_PORT = "7331" $env:KXM_AUTH_TOKEN = Get-ContentFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Fake instruction boundary tagdocs/operations/deploy.md:306 · Fake instruction boundary tag · informational: not an instruction file| Tenant-scoped | `svc-<tenant>-<system>-<purpose>` |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionplugins/kxm/src/cli.ts:387 · File type combined with upload action — agent may exfiltrate local data filesprint(runtime.io, runtime.json, payload, JSON.stringify(output, null, 2));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandplugins/kxm/src/cli.ts:1382 · Privileged sudo command — agent may execute with elevated privileges.option("--sudo", "Execute remote command with sudo privileges")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/ci-postgres-17.sh:112 · File permission modification command — agent changes file ownership/permissionschmod 600 "$pwfile"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commandscripts/ci-postgres-17.sh:82 · Privileged sudo command — agent may execute with elevated privilegessudo -n apt-get updateFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandscripts/harness-run.mjs:1600 · File permission modification command — agent changes file ownership/permissionsconst chmod = options.chmodSync ?? chmodSync;Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagepackage.json:56 · npx invocation of non-well-known package — may execute untrusted code"check:packages": "npx nx run-many -t build,test:coverage,typecheck --output-style=static",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈42 tok
1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for @kontextmind/kxm@0.7.216 as of 30 h ago. This is the package itself, not its dependencies.

What would make this Verified

15 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Text that tells the agent to ignore its instructions≈ +9 on the totalDelete phrases like "ignore previous instructions", "override", "bypass" from SKILL.md and tool descriptions. Describe what the skill does; do not instruct the agent about other rules.
  2. Unclaimed publisher≈ +8 on the totalClaim kontextmind: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim kontextmindPropose a patch to the maintainer