Skills/npm/modlens

modlens@3.27.3

CAUTION· install only

Publisher claims: "Plug-in vision for text-only LLMs, powered by the free Antigravity CLI" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher liustack · publishing for 265 daysInstalls 303KLast detonated 6d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-08 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Pipe-to-shell pattern; Credential pass-through configuration. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsdist/main.js:3971 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst chain = [...providerChain(kind, config2, autoOptions?.env ?? process.env)];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe-to-shell patterndist/main.js:2428 · Pipe-to-shell pattern — downloads and immediately executes remote codeinstall: "curl -fsSL https://antigravity.google/cli/install.sh | bash && agy # sign in, then exit"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Credential pass-through configurationdsh/client.js:395 · Credential pass-through configuration — agent relays sensitive credentials* How to render key and proxy credential fields with hidden characters.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
CRITICAL
Pipe-to-shell patterndist/main.js:3797 · Pipe-to-shell pattern — downloads and immediately executes remote code…( "No vision provider is set up on this machine. Install Antigravity CLI (curl -fsSL https://antigravity.google/cli/install.sh | bash, then run agy once to sign in), or configure a key: modlens config set gemini-a…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathsdist/main.js:3994 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn reorderByCooldown(chain, cooldown, config2, autoOptions?.env ?? process.env);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/main.js:4035 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst discovery = autoOptions?.discovery ?? discoverAuto({ env: autoOptions?.env, home: autoOptions?.home });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedsh/index.js:298 · npx invocation of non-well-known package — may execute untrusted code… search the filesystem for the file. Requires a configured modlens engine (run `npx @liustack/modlens doctor` in a terminal to check).', parameters: { type: 'object', …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedsh/index.js:1571 · npx invocation of non-well-known package — may execute untrusted code'[A pasted image could not be read: its media type is not supported. Tell the user, and suggest running `npx @liustack/modlens doctor`.]',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/modlens/scripts/run.sh:71 · npx invocation of non-well-known package — may execute untrusted code# node itself meets the CLI's floor. An old node with a working npx used to beFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Remote installer piped to shelldist/main.js:3797 · Remote installer piped to shell…( "No vision provider is set up on this machine. Install Antigravity CLI (curl -fsSL https://antigravity.google/cli/install.sh | bash, then run agy once to sign in), or configure a key: modlens config set gemini-a…Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
npx invocation of non-well-known packageskills/modlens/SKILL.md:26 · npx invocation of non-well-known package — may execute untrusted code2. Otherwise, if `npx` exists: `npx --yes --package @liustack/[email protected] modlens <args>`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedsh/index.js:1569 · npx invocation of non-well-known package — may execute untrusted code'[A pasted image could not be read: the attachment store did not return it. Tell the user, and suggest running `npx @liustack/modlens doctor`.]',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedsh/index.js:1573 · npx invocation of non-well-known package — may execute untrusted code'[A pasted image could not be read: the vision engine failed. Tell the user, and suggest running `npx @liustack/modlens doctor`.]',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/modlens/scripts/run.sh:96 · npx invocation of non-well-known package — may execute untrusted codeif command -v npx >/dev/null 2>&1 && node_meets_floor; thenFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Remote installer piped to shelldist/main.js:2428 · Remote installer piped to shellinstall: "curl -fsSL https://antigravity.google/cli/install.sh | bash && agy # sign in, then exit"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
File permission modification commanddist/main.js:5102 · File permission modification command — agent changes file ownership/permissionsnote: permissionsOk ? void 0 : "group/world can read this file. Run: chmod 600 to lock it down"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packageskills/modlens/scripts/run.sh:11 · npx invocation of non-well-known package — may execute untrusted code# 2. npx present -> run the pinned npm version.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/modlens/scripts/run.sh:70 · npx invocation of non-well-known package — may execute untrusted code# The npx path runs the CLI on this machine's node, so npx is only usable whenFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/main.js:5376 · File permission modification command — agent changes file ownership/permissions`--out-dir is group- or world-accessible (mode ${(stat.mode & 511).toString(8)}): ${outDir}. Recovered screenshots can hold anything; use a private directory (chmod 700).`Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈1,340 tok
1 file · 33 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for @liustack/modlens@3.27.3 as of 6d ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim liustack: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim liustackPropose a patch to the maintainer