Skills/npm/patchwork-os

patchwork-os@1.2.5

CAUTION

Publisher claims: "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher oolab-labs · joined 0 days agoInstalls 24,102Last detonated 59 min ago
Dispute verdict

Behavior trace

Honeypot run · 1 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.7sprocessdependency install exit 1
0.9sprocessexec /usr/bin/timeout
0.9sprocessexited 1: Node.js v22.23.4
0.9sclaimedno tools/list reply (exit 1)
0.9sprocessscript backend runs setup only

Static findings

CRITICAL
Credential pass-through configurationdist/server.js:1750 · Credential pass-through configuration — agent relays sensitive credentials
AST02
HIGH
Process kill commandREADME.md:153 · Process kill command — agent can terminate processes
AST05
CRITICAL
Privileged sudo commanddist/tools/lsp.js:1015 · Privileged sudo command — agent may execute with elevated privileges
AST05
HIGH
Auto-update or dynamic fetch configurationREADME.md:159 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06
HIGH
Access to sensitive file pathsdist/bridge.js:1056 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
Access to sensitive file pathsdist/bridge.js:1060 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
Process kill commanddist/index.js:2008 · Process kill command — agent can terminate processes
AST05
HIGH
Tunneling service URLdist/config.js:792 · Tunneling service URL — may route traffic to attacker infrastructure
AST07
HIGH
Process kill commanddist/index.js:4192 · Process kill command — agent can terminate processes
AST05
HIGH
Outbound HTTP to raw IP addressdist/bridge.js:1114 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Instructs the agent to modify its persistent memory or instruction filesdist/index.js:471 · Instructs the agent to modify its persistent memory or instruction files
AST01
HIGH
Instructs the agent to modify its persistent memory or instruction filesdist/index.js:492 · Instructs the agent to modify its persistent memory or instruction files
AST01
HIGH
Instructs the agent to modify its persistent memory or instruction filesdist/index.js:501 · Instructs the agent to modify its persistent memory or instruction files
AST01
HIGH
Access to sensitive file pathsdist/bridge.js:1061 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
Instructs the agent to modify its persistent memory or instruction filesdist/index.js:515 · Instructs the agent to modify its persistent memory or instruction files
AST01
HIGH
Instructs the agent to modify its persistent memory or instruction filesdist/config.js:864 · Instructs the agent to modify its persistent memory or instruction files
AST01
HIGH
Process kill commanddist/bridge.js:2141 · Process kill command — agent can terminate processes
AST05
HIGH
Instructs the agent to modify its persistent memory or instruction filesdist/index.js:508 · Instructs the agent to modify its persistent memory or instruction files
AST01
HIGH
Process kill commanddist/lockfile.js:234 · Process kill command — agent can terminate processes
AST05
HIGH
Process kill commanddist/index.js:4201 · Process kill command — agent can terminate processes
AST05
HIGH
npx invocation of non-well-known packagedist/index.js:362 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
Outbound HTTP to raw IP addressdist/index.js:746 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Outbound HTTP to raw IP addressdist/index.js:1333 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Access to sensitive file pathsdist/index.js:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
Outbound HTTP to raw IP addressdist/index.js:1900 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
npx invocation of non-well-known packagedist/index.js:361 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
URL with embedded credentialsdist/oauth.d.ts:40 · URL with embedded credentials — may be phishing or credential leaking
AST07
HIGH
Access to sensitive file pathsdist/index.js:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
Access to sensitive file pathsdist/index.js:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
Process kill commanddist/index.js:5206 · Process kill command — agent can terminate processes
AST05
HIGH
Auto-update or dynamic fetch configurationdist/index.js:1027 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06
HIGH
Outbound HTTP to raw IP addressdist/index.js:2361 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Access to sensitive file pathsdist/index.js:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
Auto-update or dynamic fetch configurationdist/index.js:1071 · Auto-update or dynamic fetch configuration — agent may load new code at runtime
AST06
HIGH
Outbound HTTP to raw IP addressdist/index.js:2158 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Process kill commanddist/processTree.js:90 · Process kill command — agent can terminate processes
AST05
HIGH
Instructs the agent to modify its persistent memory or instruction filesdist/prompts.js:91 · Instructs the agent to modify its persistent memory or instruction files
AST01
HIGH
Instructs the agent to modify its persistent memory or instruction filesdist/prompts.js:440 · Instructs the agent to modify its persistent memory or instruction files
AST01
MEDIUM
URL using raw IP addressdist/bridge.js:1114 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
Outbound HTTP to raw IP addressdist/oauth.js:302 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
HIGH
Instructs the agent to modify its persistent memory or instruction filesdist/prompts.js:451 · Instructs the agent to modify its persistent memory or instruction files
AST01
MEDIUM
URL using raw IP addressdist/index.js:2158 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
Process kill commanddist/processTree.js:12 · Process kill command — agent can terminate processes
AST05
MEDIUM
URL using raw IP addressdist/index.js:1900 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
Process kill commanddist/processTree.js:53 · Process kill command — agent can terminate processes
AST05
MEDIUM
File type combined with upload actiondist/config.d.ts:86 · File type combined with upload action — agent may exfiltrate local data files
AST07
HIGH
Access to sensitive file pathsdist/riskSignals.js:120 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
MEDIUM
URL using raw IP addressdist/index.js:746 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
URL with embedded credentialsdist/oauth.js:978 · URL with embedded credentials — may be phishing or credential leaking
AST07
HIGH
Instructs the agent to modify its persistent memory or instruction filesdist/prompts.js:442 · Instructs the agent to modify its persistent memory or instruction files
AST01
HIGH
Process kill commanddist/processTree.js:40 · Process kill command — agent can terminate processes
AST05
MEDIUM
URL using raw IP addressdist/index.js:1333 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
Process kill commanddist/server.js:2112 · Process kill command — agent can terminate processes
AST05
HIGH
Process kill commanddist/processTree.js:5 · Process kill command — agent can terminate processes
AST05
HIGH
URL with embedded credentialsdist/oauth.js:94 · URL with embedded credentials — may be phishing or credential leaking
AST07
HIGH
Instructs the agent to modify its persistent memory or instruction filesdist/prompts.js:664 · Instructs the agent to modify its persistent memory or instruction files
AST01
MEDIUM
URL using raw IP addressdist/index.js:2361 · URL using raw IP address — may bypass domain-based filtering
AST07
MEDIUM
File type combined with upload actiondist/index.js:3775 · File type combined with upload action — agent may exfiltrate local data files
AST07
MEDIUM
URL using raw IP addressdist/oauth.js:302 · URL using raw IP address — may bypass domain-based filtering
AST07