Skills/npm/patchwork-os

patchwork-os@1.2.7

CAUTION· not started

Publisher claims: "Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher oolab-labs · publishing for 210 daysInstalls 9,323Last detonated 28 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ANTHROPIC_API_KEYBRIDGE_WEBHOOK_SECRETCLAUDE_IDE_BRIDGE_TOKENDASHBOARD_SESSION_SECRETGEMINI_API_KEYOPENAI_API_KEYXAI_API_KEY or --fixed-token / --webhook-secretConfiguration, not credentials: BRIDGE_BIND_ADDRESS, CLAUDE_CONFIG_DIR, CLAUDE_IDE_BRIDGE_CONFIG, CLAUDE_IDE_BRIDGE_CORS_ORIGINS, CLAUDE_IDE_BRIDGE_EDITOR, CLAUDE_IDE_BRIDGE_GRACE_PERIOD, CLAUDE_IDE_BRIDGE_ISSUER_URL, CLAUDE_IDE_BRIDGE_LINTERS, CLAUDE_IDE_BRIDGE_MAX_RESULT_SIZE, CLAUDE_IDE_BRIDGE_TIMEOUT, CLAUDE_IDE_BRIDGE_TRUST_PROXY, FOO, LOCAL_EMBEDDINGS_ENDPOINT, LOCAL_EMBEDDINGS_MODEL, LOCAL_ENDPOINT, LOCAL_ENDPOINT_ALLOW_REMOTE, LOCAL_MODEL, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_SERVICE_NAME, PATCHWORK_BRIDGE_PORT, PATCHWORK_FLAG_, STY, TMUX, WSL_DISTRO_NAME, WSLENV, ZELLIJ, ZELLIJ_SESSION_NAME
Where it talks to
no vendor host named in the codeAlso claude.ai, ngrok-free.app, open-vsx.org, claude.com, ntfy.sh, opentelemetry.io — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names claude.ai, ngrok-free.app, open-vsx.org, claude.com, ntfy.sh, opentelemetry.io as well as its own vendor. The guard injects ANTHROPIC_API_KEY, BRIDGE_WEBHOOK_SECRET, CLAUDE_IDE_BRIDGE_TOKEN, DASHBOARD_SESSION_SECRET, GEMINI_API_KEY, OPENAI_API_KEY, XAI_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y patchwork-os

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Tunneling service URL; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 8 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
7.4sprocessdependency install exit 1 · (Use `node --trace-warnings ...` to show where the warning was created) npm error Cannot read properties of null (reading 'edgesOut') npm error A complete log of this run can be found in: /tmp/ks-detonate-uHb5Aq/task/home/.npm/_logs/2026-11-13T08_38_06_452Z-debug-0.log
7.4sclaimednot started: dependency install failed (exit 1); the server itself was not observed
7.4sprocessscript backend runs setup only
7.5sprocesssecond launch, clock +45 days, CI unset

Static findings

MEDIUM
Process kill commanddist/index.js:2008 · Process kill command — agent can terminate processes// Guard against `panic --help` engaging the kill switch — a realFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/bridge.js:1061 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// `npm run install:global` destroys) and never `$PATCHWORK_HOME/.env`.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Tunneling service URLdist/config.js:792 · Tunneling service URL — may route traffic to attacker infrastructure--issuer-url <url> Public URL for OAuth 2.0 (e.g. https://abc.ngrok-free.app)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Privileged sudo commanddist/tools/lsp.js:1015 · Privileged sudo command — agent may execute with elevated privileges"Install universal-ctags for headless fallback: sudo apt-get install universal-ctags (Linux) or brew install universal-ctags (macOS)",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/bridge.js:2141 · Process kill command — agent can terminate processesthis.logger.warn("WARNING: Not running inside tmux, screen, or zellij. SSH disconnection will kill this process.");Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
URL with embedded credentialsdist/oauth.d.ts:40 · URL with embedded credentials — may be phishing or credential leaking* `https://user:pass@…` (embedded credentials) and have the OAuth serverFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathsdist/bridge.js:1056 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// `$PATCHWORK_HOME/.env` second — the file `patchwork init` writes.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/index.js:1071 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeEdit \`index.mjs\`. The bridge hot-reloads on save — your tool is callable from the live Claude session on the next turn. No build step needed for the JS variant.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
URL with embedded credentialsdist/oauth.js:94 · URL with embedded credentials — may be phishing or credential leaking* `https://user:pass@…` (embedded credentials) and have the OAuth serverFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathsdist/riskSignals.js:120 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst credPath = /\.ssh\b|\.aws\b|\bid_rsa\b|\bid_ed25519\b|\.env\b|\bcredentials\b|\.npmrc\b|\.netrc\b/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
URL with embedded credentialsdist/oauth.js:978 · URL with embedded credentials — may be phishing or credential leaking// Reject userinfo (e.g. https://user:pass@evil/), non-default ports, andFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Auto-update or dynamic fetch configurationdist/index.js:1027 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeEdit \`src/index.ts\`. \`tsc --watch\` rebuilds, the bridge hot-reloads, your tool is callable from the live Claude session on the next turn.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/index.js:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Try both "../.env" (compiled dist/) and ".env" (tsx src/ dev run)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/index.js:5206 · Process kill command — agent can terminate processes"Walks every gate in runtime order — kill switch, tool registration, worker\n" +Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/index.js:4192 · Process kill command — agent can terminate processes// asserts refusals, kill switch, no-resend on uncertain delivery, replay andFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Credential pass-through configurationdist/server.js:1750 · Credential pass-through configuration — agent relays sensitive credentials// above any realistic relay token.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Access to sensitive file pathsdist/index.js:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_fileURLToPath(new URL(".env", import.meta.url)),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/config.d.ts:86 · File type combined with upload action — agent may exfiltrate local data files* `~/.patchwork/config.json`; previously only set by POST /settings, soFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/index.js:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_fileURLToPath(new URL("../.env", import.meta.url)),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/bridge.js:1060 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// candidates from `import.meta.url`, so it reads `<install-dir>/.env` (whichFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/index.js:4201 · Process kill command — agent can terminate processes"effective governed policy, policy-matrix refusal, kill switch, uncertain\n" +Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/index.js:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Load .env from repo root if present (connector credentials, etc.).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/prompts.js:91 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction filedescription: "Generate bridge workflow rules and quick-reference table, then write them into CLAUDE.md.",Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/index.js:501 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileprocess.stderr.write(`CLAUDE.md bridge block already up to date (v${PACKAGE_VERSION}) — no changes made.\n`);Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commanddist/processTree.js:5 · Process kill command — agent can terminate processes* Node's `child.kill()` and the AbortSignal-driven kill that `spawn({ signal })`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/index.js:471 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file--write Write to CLAUDE.md in the workspace (default: print to stdout)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commanddist/processTree.js:40 · Process kill command — agent can terminate processes// POSIX: process-group kill (works when child was spawned detached:true →Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/index.js:508 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileprocess.stderr.write(`Updated CLAUDE.md bridge block to v${PACKAGE_VERSION}.\n`);Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/prompts.js:442 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file"Based on the project info from Phase 1, create or update the project's CLAUDE.md.",Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagedist/index.js:361 · npx invocation of non-well-known package — may execute untrusted code// off `process.env._` sent `npx patchwork-os@beta init` into the legacyFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/prompts.js:451 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file…ilities` at the start of each session..."', "- Bug fix methodology (test-first: write failing test, fix, confirm)", "- Documentation & memory rules (update CLAUDE.md after arch changes, save decisions to memory, prune stale instructions)",…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commanddist/processTree.js:90 · Process kill command — agent can terminate processes// POSIX: try process-group kill first (works when target was spawnedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/config.js:864 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileinit One-command setup: install extension + write CLAUDE.md + registerFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commanddist/processTree.js:12 · Process kill command — agent can terminate processes* On Windows there's no process-group concept, so the canonical way to killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/server.js:2112 · Process kill command — agent can terminate processes// /kill-switch — dedicated endpoint for the global write-tier kill switch.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/processTree.js:53 · Process kill command — agent can terminate processes// override `child.kill` and short-circuits the spawn/auto-kill flow.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/lockfile.js:234 · Process kill command — agent can terminate processes// any kill failure would WRONGLY delete a legitimateFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/index.js:492 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileprocess.stderr.write("Note: run with --write to append this section to CLAUDE.md and also write .claude/rules/bridge-tools.md\n");Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/prompts.js:440 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file"## Phase 2 — Generate or update CLAUDE.md",Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagedist/index.js:362 · npx invocation of non-well-known package — may execute untrusted code// installer, because npx leaves `_` as the parent's value.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/index.js:515 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileprocess.stderr.write(`Patched existing CLAUDE.md — added missing @import line (v${PACKAGE_VERSION}).\n`);Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actiondist/index.js:3775 · File type combined with upload action — agent may exfiltrate local data files: " ✗ MCP shim not found in ~/.claude.json — re-run init or check Step 3 output above\n");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filesdist/prompts.js:664 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileRe-run project orientation: discover project type, update CLAUDE.md, and verify bridge connectivity.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈92 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for patchwork-os@1.2.7 as of 27 h ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim oolab-labs: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Tunneling service URL≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim oolab-labsPropose a patch to the maintainer