Skills/npm/pi-mcp-adapter

pi-mcp-adapter@6.0.0

CAUTION

Publisher claims: "MCP (Model Context Protocol) adapter extension for Pi coding agent" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher nicobailon · joined 0 days agoInstalls 1.6MLast detonated 2 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathsdist/agent-plugin-loader.js:330 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/agent-plugin-loader.js:214 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/agent-dir.js:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/agent-plugin-loader.js:328 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/claude-plugin-loader.js:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/agent-dir.js:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/http-ca.js:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/mcp-auth.js:380 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/mcp-oauth-provider.js:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/mcp-auth-fetch.js:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/claude-plugin-loader.js:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/metadata-cache.js:136 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/config.js:866 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/mcp-auth.js:338 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/mcp-oauth-provider.js:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/metadata-cache.js:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/metadata-cache.js:127 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/jev-key-store.js:76 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/jev-key-store.js:147 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/mcp-auth-fetch.js:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/logger.js:128 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/jev-client.js:30 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/mcp-auth.js:378 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/mcp-auth.js:129 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/claude-plugin-loader.js:281 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/mcp-auth.js:261 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/npx-resolver.js:372 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/server-manager.js:941 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/utils.js:168 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/utils.js:122 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/secure-keyring.js:101 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/secure-keyring.js:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/utils.js:128 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/server-manager.js:1876 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/utils.js:153 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/metadata-cache.js:216 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/server-manager.js:1882 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/npx-resolver.js:373 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsdist/server-manager.js:158 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

Outbound HTTP to raw IP addressdist/config.js:87 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

Process kill commanddist/types.d.ts:477 · Process kill command — agent can terminate processes

AST05

MEDIUM

URL using raw IP addressdist/config.js:87 · URL using raw IP address — may bypass domain-based filtering

AST07

HIGH

Outbound HTTP to raw IP addressdist/config.js:1310 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

HIGH

npx invocation of non-well-known packagedist/npx-resolver.js:34 · npx invocation of non-well-known package — may execute untrusted code

AST06

MEDIUM

MCP server using network transport (SSE/HTTP)dist/jev-client.js:106 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

URL using raw IP addressdist/config.js:1310 · URL using raw IP address — may bypass domain-based filtering

AST07