Skills/npm/kya

kya@0.33.6

CAUTION· not started

Publisher claims: "Audit trail and traceability for AI agents. See what every coding agent did and check each tool call against policy." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher shield-agent · publishing for 94 daysInstalls 6,510Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
KYA_API_KEYKYA_MCP_HTTP_TOKENSHIELD_API_KEYConfiguration, not credentials: CLAUDE_CODE_ENTRYPOINT, CLAUDE_SESSION_ID, CLAUDECODE, CODEX_HOME, CODEX_SESSION, CURSOR_AGENT, CURSOR_SESSION_ID, CURSOR_TRACE_ID, GITHUB_ACTIONS, GROK_BUILD, GROK_SESSION, KYA_AGENT_ID, KYA_BASE_URL, KYA_CTA, KYA_HOLD, KYA_HOME, KYA_HOST, KYA_MCP_PORT, KYA_OFFLINE, KYA_OTLP_ENDPOINT, KYA_OTLP_HEADERS, KYA_OTLP_METRICS_ENDPOINT, KYA_QUIET, KYA_SANDBOX, KYA_SESSION_ID, KYA_TENANT_HINT, OPENAI_CODEX, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, OTEL_EXPORTER_OTLP_METRICS_ENDPOINT, TERM_PROGRAM, XAI_GROK
Where it talks to
shield-agent.com (its own)Also githubcopilot.com, context7.com, figma.com, atlassian.com, notion.com, linear.app, sentry.dev, zapier.com, exa.ai — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names githubcopilot.com, context7.com, figma.com, atlassian.com, notion.com, linear.app, sentry.dev, zapier.com, exa.ai as well as its own vendor. The guard injects KYA_API_KEY, KYA_MCP_HTTP_TOKEN, SHIELD_API_KEY only into requests to shield-agent.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets KYA_API_KEY=shield-agent.com,KYA_MCP_HTTP_TOKEN=shield-agent.com,SHIELD_API_KEY=shield-agent.com -- npx -y @shield-agent/kya

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 62/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: References a credential file in the home directory; Access to sensitive file paths; Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 5 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
5.4sprocessdependency install exit 1 · (Use `node --trace-warnings ...` to show where the warning was created) npm error Cannot read properties of null (reading 'edgesOut') npm error A complete log of this run can be found in: /tmp/ks-detonate-YHow1o/task/home/.npm/_logs/2026-11-11T08_42_57_120Z-debug-0.log
5.4sclaimednot started: dependency install failed (exit 1); the server itself was not observed
5.4sprocessscript backend runs setup only
5.4sprocessno install scripts to re-run

Static findings

HIGH
References a credential file in the home directorydist/guard-pack.js:372 · References a credential file in the home directory* Credential files the never-list does not already cover (it has ssh keys, `~/.aws/credentials`, gcloudFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsdist/commands/orr.js:708 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst SECRET_SKIP_BASENAME_RE = /(^\.env\.(example|sample|template)$)|(\.(example|sample|template)\.[^.]+$)/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/host-reload.js:25 · Auto-update or dynamic fetch configuration — agent may load new code at runtimedetail: "Kiro hot-reloads mcp.json on save - only the new server starts",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/cli.js:66 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesNEVER_SECRET_READ ssh/cloud/kube/docker/railway credentials, .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/guard-pack.js:372 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Credential files the never-list does not already cover (it has ssh keys, `~/.aws/credentials`, gcloudFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/gate/config.js:61 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesthrow new UsageError(`${where}.env must be an object of string values`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Reads credential paths from the home directorydist/ioc/scan.js:102 · Reads credential paths from the home directoryout.push(finding(ioc, check, `~/.ssh/authorized_keys line ${line}`));Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Image alt text carrying instructionsREADME.md:104 · Image alt text carrying instructionsGateway section: local MCP gate with listeners, routes, backends, policies, and a dry-run playgroundFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsdist/cli.js:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesinit Scaffold .kya/ config + sample tools + .env.exampleFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Reads credential paths from the home directorydist/guard-pack.js:372 · Reads credential paths from the home directory* Credential files the never-list does not already cover (it has ssh keys, `~/.aws/credentials`, gcloudFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsdist/guard-pack.js:373 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* credential files, npmrc, netrc, git-credentials, `.env`, `*.pem`, `*.key`). Returns the kind for the rule id.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detecteddist/guard-pack.js:198 · Destructive file system command detected// `rm -rf "$X"` with X unset runs `rm -rf ""`; `"$X/"` runs `rm -rf /`. Both are the bug this rule is for.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Prompt injectionREADME.md:445 · Prompt injection — known jailbreak technique reference · informational: not an instruction file**ChatGPT Apps (chatgpt.com):** deferred. Developer Mode wants OAuth. Use Codex until then.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
File type combined with upload actiondist/cli.js:730 · File type combined with upload action — agent may exfiltrate local data filesio.log(" POST /mcp (JSON-RPC)");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commanddist/cli.js:88 · Process kill command — agent can terminate processeskill Pause an agent (--id)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commanddist/fs-atomic.js:53 · File permission modification command — agent changes file ownership/permissions/* win32 chmod semantics differ; POSIX correctness is what matters */Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commanddist/cli.js:5 · Process kill command — agent can terminate processes* | agents | agent | passport | kill | approvals | sessions | shrinkFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/cli.d.ts:5 · Process kill command — agent can terminate processes* | agents | agent | passport | kill | approvals | sessions | shrinkFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/dash/dash.js:140 · Process kill command — agent can terminate processes"OSS desk: kya agents | kill | wrap | invoke | shrink",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/ioc/scan.js:102 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesout.push(finding(ioc, check, `~/.ssh/authorized_keys line ${line}`));Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/cli.js:147 · npx invocation of non-well-known package — may execute untrusted codenpx @shield-agent/kya eval-tool --offline --tool-id org.sample.never.event --irreversibleFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Authorization escalation languageREADME.md:445 · Authorization escalation language · informational: not an instruction file**ChatGPT Apps (chatgpt.com):** deferred. Developer Mode wants OAuth. Use Codex until then.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagedist/cli.js:148 · npx invocation of non-well-known package — may execute untrusted codenpx @shield-agent/kya eval-tool --offline --tool-id org.sample.data.write --irreversibleFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/cli.js:162 · Process kill command — agent can terminate processesnpx @shield-agent/kya kill --id <agent-id>Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/cli.js:146 · npx invocation of non-well-known package — may execute untrusted codenpx @shield-agent/kya init --base-url http://127.0.0.1:8090 --host ideFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:149 · npx invocation of non-well-known package — may execute untrusted codenpx @shield-agent/kya register-agent --name solo-builder --version-hash dev-localFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:150 · npx invocation of non-well-known package — may execute untrusted codenpx @shield-agent/kya register-agent --name ops --version-hash dev --break-glass-reason "prod hotfix"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
MCP server using network transport (SSE/HTTP)dist/index.d.ts:20 · MCP server using network transport (SSE/HTTP) — data sent over networkexport { startHttpMcp, type HttpMcpServer } from "./mcp/http.js";Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04

Cost to the agent

Instructions loaded
≈64 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @shield-agent/kya@0.33.6 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

18 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential paths from the home directory≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim shield-agent: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  4. References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim shield-agentPropose a patch to the maintainer