Skills/npm/multi-repo-dev

multi-repo-dev@1.1.2

BLOCKED

Publisher claims: "Multi-repository development workflow with independent workspaces and automated Git operations | 多仓库需求开发完整工作流,支持跨项目协同开发、需求对齐、代码实现和提交推送" Observed in sandbox: calls github.com only, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher yonsun-w · joined 5 days agoInstalls 17Last detonated 5d ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-27 and scored it 47/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Destructive file system command detected; Pipe-to-shell pattern; Direct script execution from GitHub raw URL. Summary: calls github.com only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios
t+CategoryObserved action
0.2sfilesystemread ~/.netrc
0.2snetworkCONNECT https://github.com
0.2sprocessexec /usr/bin/mkdir
0.2sprocessexec /usr/bin/git
0.2sprocessexec /usr/lib/git-core/git
0.2sprocessexec /usr/lib/git-core/git-remote-https
0.2sprocessexited 128: fatal: unable to access 'https://github.com/Yonsun-w/multi-repo-dev.git/': CONNECT tunnel failed, response 403
0.2sfilesystemread ~/.netrc
0.2snetworkCONNECT https://github.com
0.2snetworkCONNECT https://github.com
0.2sprocessexec /usr/bin/git
0.2sprocessexec /usr/lib/git-core/git
0.2sprocessexec /usr/lib/git-core/git-remote-https
0.2sprocessexited 128: fatal: unable to access 'https://github.com/Yonsun-w/multi-repo-dev.git/': CONNECT tunnel failed, response 403
0.2sprocessscript backend runs setup only
0.2sprocessscript backend runs setup only

Static findings

HIGH
Destructive file system command detectedSKILL.md:151 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patterninstall.sh:4 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Remote installer piped to shellinstall.sh:4 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Direct script execution from GitHub raw URLinstall.sh:4 · Direct script execution from GitHub raw URL — unverified code sourceFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Destructive file system command detectedSKILL.md:148 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

What would make this Verified

33 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs.
  2. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  3. Unclaimed publisher≈ +8 on the totalClaim yonsun-w: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yonsun-w