Skills/npm/mcp-sanitizer

mcp-sanitizer@1.4.3

CAUTION· install only

Publisher claims: "Comprehensive security sanitization library for Model Context Protocol (MCP) servers with trusted security libraries" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher starman69 · publishing for 466 daysInstalls 2,765Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-09 and scored it 74/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathssrc/utils/validation-utils.js:270 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Directory or file names that hold credentials; `.env.*` is matched separately.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/sanitizer/validators/index.js:300 · File type combined with upload action — agent may exfiltrate local data filesreturn await validators.sql.sanitize(input, options);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathssrc/config/security-policies.js:328 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'.env', '.example', '.template'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/sanitizer/mcp-sanitizer.js:23 · File type combined with upload action — agent may exfiltrate local data files* console.log('Sanitized input:', result.sanitized);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandsrc/config/security-policies.js:262 · Privileged sudo command — agent may execute with elevated privileges'sudo rm', 'sudo del'Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
References a credential file in the home directorysrc/utils/validation-utils.js:199 · References a credential file in the home directory// user's home directory (e.g. ~/.ssh/id_rsa) pass with blocked=false.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathssrc/utils/validation-utils.js:282 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* substrings, so a sensitive first segment (`.env`, `.ssh/id_rsa`) is caught.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/sanitizer/validators/command.js:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/\.env/i // Environment filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/utils/validation-utils.js:273 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files'.npmrc', '.netrc', '.env', '.git-credentials'Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/config/security-policies.js:285 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesblockedDirectories: ['/etc/passwd', '/etc/shadow']Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedsrc/config/security-policies.js:261 · Destructive file system command detected'rm -rf', 'del /s', 'format', 'mkfs',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/utils/validation-utils.js:199 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// user's home directory (e.g. ~/.ssh/id_rsa) pass with blocked=false.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionsrc/sanitizer/validators/index.js:296 · File type combined with upload action — agent may exfiltrate local data filesreturn await validators.sql.validate(input, options);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈55 tok
1 file · 36 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for mcp-sanitizer@1.4.3 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

6 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim starman69: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim starman69Propose a patch to the maintainer
mcp-sanitizer@1.4.3 safety verdict: Caution (install only) — KillerSkills