passioncode@0.2.39
CAUTIONPublisher claims: "Set up PassionCode.ai on a computer with one command — the apps from their verified releases, their MCP servers for every coding agent and the PassionCode.ai skills — and check and repair it with the same command or `doctor`." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher passioncode-ai · joined 0 days agoInstalls 9,323Last detonated 28 min ago
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-26 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: npx invocation of non-well-known package; npx invocation of non-well-known package; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
HIGH
npx invocation of non-well-known packageREADME.md:11 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packageCHANGELOG.md:930 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Access to sensitive file pathsCHANGELOG.md:641 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
npx invocation of non-well-known packageCHANGELOG.md:950 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packageREADME.md:29 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packageCHANGELOG.md:846 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packageREADME.md:12 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packageREADME.md:46 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packageSECURITY.md:68 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06CRITICAL
Rule addition attemptCHANGELOG.md:379 · Rule addition attempt — injecting new instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
npx invocation of non-well-known packageCHANGELOG.md:849 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packageCHANGELOG.md:328 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packageREADME.md:35 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Process kill commandREADME.md:32 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
npx invocation of non-well-known packagebin/passioncode.js:27 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packageSECURITY.md:77 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Access to sensitive file pathslib/launcher.js:318 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md:325 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Auto-update or dynamic fetch configurationbin/passioncode.js:130 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Process kill commandpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md:308 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
npx invocation of non-well-known packagebin/passioncode.js:25 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packagelib/setup.js:234 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Access to sensitive file pathslib/launcher.js:248 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathslib/mcp-probe.js:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md:135 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Auto-update or dynamic fetch configurationlib/launcher.js:506 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packagebin/passioncode.js:24 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packagebin/passioncode.js:22 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packagelib/setup.js:233 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packagelib/doctor.js:18 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packagebin/passioncode.js:26 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Process kill commandlib/doctor.js:238 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Python subprocess execution detectedpayload/plugins/observatory-log/hooks/session-start.sh:79 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05HIGH
Outbound HTTP to raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_hub.py:211 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
Refusal suppressionpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/board.md:141 · Refusal suppression — attempting to prevent safety responsesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Python subprocess execution detectedpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_kit.py:68 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05HIGH
Outbound HTTP to raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-hub.mjs:159 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
Access to sensitive file pathspayload/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md:118 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Refusal suppressionpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/usage.md:98 · Refusal suppression — attempting to prevent safety responsesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Refusal suppressionpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/interop.md:186 · Refusal suppression — attempting to prevent safety responsesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Outbound HTTP to raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_hub.py:9 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
Access to sensitive file pathspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/package.md:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
File permission modification commandpayload/plugins/observatory-log/hooks/session-start.sh:49 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05HIGH
Outbound HTTP to raw IP addresspayload/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md:58 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
Process kill commandpayload/plugins/fabric-agent-adapter/skills/working-with-fabric/references/project-board.md:198 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Outbound HTTP to raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md:44 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
Coercive compliance languagepayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md:4 · Coercive compliance languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Outbound HTTP to raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-hub.mjs:7 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
npx invocation of non-well-known packagepayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/package.md:5 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Process kill commandpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md:32 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
npx invocation of non-well-known packagepayload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md:318 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Access to sensitive file pathspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/package.md:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Outbound HTTP to raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md:46 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07MEDIUM
URL using raw IP addresspayload/plugins/observatory-log/skills/handling-secrets/SKILL.md:56 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07MEDIUM
URL using raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-hub.mjs:7 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07MEDIUM
URL using raw IP addresspayload/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md:58 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
npx invocation of non-well-known packagepayload/plugins/passioncode/skills/setting-up-passioncode/SKILL.md:90 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
URL using raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-hub.mjs:159 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
Access to sensitive file pathspayload/plugins/passioncode/skills/working-in-passioncode/SKILL.md:154 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
npx invocation of non-well-known packagepayload/plugins/passioncode/skills/working-in-passioncode/SKILL.md:137 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packagepayload/plugins/passioncode/hooks/session-start.js:66 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Outbound HTTP to raw IP addresspayload/plugins/observatory-log/skills/handling-secrets/SKILL.md:56 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
Auto-update or dynamic fetch configurationpayload/plugins/passioncode/trust.json:2 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
File type combined with upload actionpayload/plugins/fabric-agent-adapter/skills/working-with-fabric/references/session-hooks.md:23 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
URL using raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_hub.py:211 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
npx invocation of non-well-known packagepayload/plugins/passioncode/skills/setting-up-passioncode/SKILL.md:39 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Instructs the agent to modify its persistent memory or instruction filespayload/plugins/passioncode/hooks/repo-rules.js:5 · Instructs the agent to modify its persistent memory or instruction filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
npx invocation of non-well-known packagepayload/plugins/passioncode/hooks/session-start.js:5 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packagepayload/plugins/passioncode/hooks/update-check.js:172 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
npx invocation of non-well-known packagepayload/plugins/passioncode/skills/setting-up-passioncode/SKILL.md:28 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
URL using raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_hub.py:9 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
Access to sensitive file pathspayload/plugins/observatory-log/skills/handling-secrets/SKILL.md:114 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathspayload/plugins/observatory-log/skills/handling-secrets/SKILL.md:71 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Auto-update or dynamic fetch configurationpayload/plugins/passioncode/hooks/session-start.js:4 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Instructs the agent to modify its persistent memory or instruction filespayload/plugins/passioncode/hooks/repo-rules.js:40 · Instructs the agent to modify its persistent memory or instruction filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01MEDIUM
File type combined with upload actionpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-hub.mjs:247 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07HIGH
Access to sensitive file pathspayload/plugins/observatory-log/skills/handling-secrets/SKILL.md:115 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
npx invocation of non-well-known packagepayload/plugins/passioncode/hooks/session-start.js:82 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06HIGH
Auto-update or dynamic fetch configurationpayload/plugins/observatory-log/hooks/session-start.sh:100 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
URL using raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/protocol.md:44 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
Process kill commandpayload/plugins/passioncode/skills/setting-up-passioncode/SKILL.md:74 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05MEDIUM
URL using raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md:46 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim passioncode-ai: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- npx invocation of non-well-known package≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Process kill command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- Python subprocess execution detected≈ +4 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim passioncode-ai