model-salt@1.0.3
VERIFIED· startup onlyPublisher claims: "Randomness from outside the model, so one prompt gives different answers that still fit the ask." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
MODEL_SALT_POOL_TOKENConfiguration, not credentials: MODEL_SALT_POOL, SALT_CLAUDE, SALT_CODEX, SALT_IN_CONTEXT, SALT_LOG, SALT_RUNNER_MODEL, SEED_CODEX_HOME- Where it talks to
- modelsalt.com (its own)Also random.org, lfdr.de, cloudflare.com, drand.sh — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names random.org, lfdr.de, cloudflare.com, drand.sh as well as its own vendor. The guard injects MODEL_SALT_POOL_TOKEN only into requests to modelsalt.com (and its subdomains) and refuses the rest.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-12 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 20 s · 2 scenarios · 0 deviationsStatic findings
const r = spawnSync(CODEX, ['mcp', 'list', '--json', '--disable', 'plugins'], { env: { ...process.env, ...env }, encoding: 'utf8', timeout: 30000 });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.// usage: npx -y @modelsalt/model-salt setup <claude|codex|gemini|kimi> [--agents-md] [--dry-run]Fix: Pin versions and sources; vendor anything fetched at install time.const p = spawn(bin, args, { cwd, env: { ...process.env, ...env }, stdio: ['pipe', 'pipe', 'pipe'] });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.// npx -y @modelsalt/model-salt uninstall <claude|codex|gemini|kimi> [--dry-run]Fix: Pin versions and sources; vendor anything fetched at install time.if (!c) console.error(`usage: npx -y @modelsalt/model-salt ${verb} <${Object.keys(CLIENTS).join('|')}>${verb === 'setup' ? ' [--agents-md]' : ''} [--dry-run]`);Fix: Pin versions and sources; vendor anything fetched at install time.…del Salt line from an earlier setup; it is kept beside the skill. To drop it: \`npx -y @modelsalt/model-salt uninstall kimi\`, then \`npx -y @modelsalt/model-salt set…Fix: Pin versions and sources; vendor anything fetched at install time.npx -y @modelsalt/model-salt uninstall <claude|codex|gemini|kimi> take out everything setup addedFix: Pin versions and sources; vendor anything fetched at install time.npx -y @modelsalt/model-salt setup <claude|codex|gemini|kimi> add it to your client (--dry-run shows what it would change)Fix: Pin versions and sources; vendor anything fetched at install time.// usage: node src/stdio.mjs <service> [--steps <file>] [--log <file>] (published: npx -y @modelsalt/model-salt <service>)Fix: Pin versions and sources; vendor anything fetched at install time.npx -y @modelsalt/model-salt <anthropic|openai> the MCP server over stdio, for a client to start`);Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for @modelsalt/model-salt@1.0.3 as of 2d ago. This is the package itself, not its dependencies.