Skills/npm/passioncode

passioncode@0.2.58

CAUTION

Publisher claims: "Set up PassionCode.ai on a computer with one command: the apps from their verified releases, their MCP servers for every coding agent and the PassionCode.ai skills. Check and repair it with the same command or `doctor`." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher passioncode-ai · joined 8 days agoInstalls 12,316Last detonated 9 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-03 and scored it 65/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Prompt injection; Rule addition attempt; Prompt injection. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

CRITICAL
Prompt injectionREADME.md:80 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Rule addition attemptCHANGELOG.md:583 · Rule addition attempt — injecting new instructionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
Prompt injectionCHANGELOG.md:122 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Refusal suppressionpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/usage.md:98 · Refusal suppression — attempting to prevent safety responsesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathslib/launcher.js:296 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationbin/passioncode.js:140 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md:334 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Refusal suppressionpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/interop.md:193 · Refusal suppression — attempting to prevent safety responsesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Refusal suppressionpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/board.md:176 · Refusal suppression — attempting to prevent safety responsesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Coercive compliance languagepayload/plugins/fabric-agent-adapter/skills/building-fabric-services/references/lifecycle.md:4 · Coercive compliance languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Authorization escalation languageCHANGELOG.md:122 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md:139 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationlib/launcher.js:554 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathslib/mcp-probe.js:16 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathslib/launcher.js:366 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Authorization escalation languageREADME.md:80 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Outbound HTTP to raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-hub.mjs:159 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
URL with embedded credentialspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_http.py:187 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
URL with embedded credentialspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_http.py:157 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Outbound HTTP to raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_hub.py:9 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathspayload/plugins/fabric-agent-adapter/skills/creating-fabric-agents/SKILL.md:121 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationpayload/plugins/observatory-log/hooks/session-start.sh:100 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Outbound HTTP to raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-hub.mjs:7 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathspayload/plugins/observatory-log/skills/handling-secrets/SKILL.md:114 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Outbound HTTP to raw IP addresspayload/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md:58 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Hidden zero-width characters detectedpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_a2a.py:33 · Hidden zero-width characters detected — may conceal contentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Outbound HTTP to raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_hub.py:211 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathspayload/plugins/observatory-log/skills/handling-secrets/SKILL.md:71 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagebin/passioncode.js:26 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/passioncode.js:22 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathspayload/plugins/observatory-log/skills/handling-secrets/SKILL.md:115 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationpayload/plugins/passioncode/trust.json:2 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/passioncode.js:25 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Outbound HTTP to raw IP addresspayload/plugins/observatory-log/skills/handling-secrets/SKILL.md:56 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagebin/passioncode.js:27 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationpayload/plugins/passioncode/hooks/session-start.js:4 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Instructs the agent to modify its persistent memory or instruction filespayload/plugins/passioncode/hooks/repo-rules.js:40 · Instructs the agent to modify its persistent memory or instruction filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagebin/passioncode.js:24 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathspayload/plugins/passioncode/skills/working-in-passioncode/SKILL.md:154 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Instructs the agent to modify its persistent memory or instruction filespayload/plugins/passioncode/hooks/repo-rules.js:5 · Instructs the agent to modify its persistent memory or instruction filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_kit.py:68 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_hub.py:9 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagelib/setup.js:335 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandlib/doctor.js:362 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
URL using raw IP addresspayload/plugins/fabric-agent-adapter/skills/working-with-fabric/SKILL.md:58 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagelib/setup.js:334 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepayload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md:327 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
URL using raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-hub.mjs:7 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-hub.mjs:159 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedpayload/plugins/observatory-log/hooks/session-start.sh:79 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using raw IP addresspayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric_hub.py:211 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagelib/doctor.js:21 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/scripts/fabric-hub.mjs:247 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandpayload/plugins/fabric-agent-adapter/skills/building-fabric-services/SKILL.md:317 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagepayload/plugins/passioncode/hooks/session-start.js:66 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepayload/plugins/passioncode/hooks/session-start.js:5 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepayload/plugins/passioncode/hooks/update-check.js:172 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepayload/plugins/passioncode/skills/working-in-passioncode/SKILL.md:137 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepayload/plugins/passioncode/skills/setting-up-passioncode/SKILL.md:91 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandpayload/plugins/observatory-log/hooks/session-start.sh:49 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandpayload/plugins/passioncode/skills/setting-up-passioncode/SKILL.md:75 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagepayload/plugins/passioncode/skills/setting-up-passioncode/SKILL.md:39 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
URL using raw IP addresspayload/plugins/observatory-log/skills/handling-secrets/SKILL.md:56 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagepayload/plugins/passioncode/skills/setting-up-passioncode/SKILL.md:28 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepayload/plugins/passioncode/hooks/session-start.js:84 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06

What would make this Verified

15 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim passioncode-ai: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  4. Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  5. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim passioncode-ai