Skills/npm/pushary

pushary@1.9.140

CAUTION· not started

Publisher claims: "Human-in-the-loop (HITL) for AI agents: ask a person for approvals or answers by push notification. One command connects Claude Code, Codex, Cursor, Gemini CLI and more." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher github actions · publishing for 414 daysInstalls 15,892Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
API_KEY_PREFIX_SHAPEPARTNER_API_KEYS_URLPUSHARY_API_KEYSHELL_INERT_URL_PASSWORD_UNIT or --no-ask-password / --with-tokenConfiguration, not credentials: ANSWER_PATH_SUFFIX, APPROVALS_PATH, CLAUDE_CONFIG_DIR, CODEX_EVENT_KEY, CODEX_HOME, DEVICE_KEY_PATH, DISPLAY, EPISODE_PATH, GEMINI_CLI_HOME, HERMES_HOME, IDENTITY_PATH, MACHINES_PATH, OPENCODE_CONFIG_DIR, PATHEXT, PLUGIN_LOCATIONS_KEY, ProgramFiles, ProgramW6432, PUSHARY_AGENT_NAME, PUSHARY_AUTO_DECISION_BEACON, PUSHARY_AUTO_NOTIFY_SESSION_END, PUSHARY_BASE_URL, PUSHARY_BELL_QUIET, PUSHARY_BELL_UPGRADE_AT, PUSHARY_COMMAND_DIR, PUSHARY_CONFIG_FILE, PUSHARY_DEFER_BYPASS, PUSHARY_GATE_TIMEOUT_MS, PUSHARY_GATE_TOOLS, PUSHARY_LEDGER_FILE, PUSHARY_MCP_PATH_PREFIX, PUSHARY_MODEL_PRICING, PUSHARY_NO_BROWSER, PUSHARY_PIN_GLOBAL_VERSION, PUSHARY_RECEIPTS, PUSHARY_RECIPIENT_PIN_FILE, PUSHARY_RESPECT_PERMISSION_MODE
Where it talks to
pushary.com (its own)Also apple.com, nodejs.org, claude.ai, discord.gg, microsoft.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names apple.com, nodejs.org, claude.ai, discord.gg, microsoft.com as well as its own vendor. The guard injects API_KEY_PREFIX_SHAPE, PARTNER_API_KEYS_URL, PUSHARY_API_KEY, SHELL_INERT_URL_PASSWORD_UNIT only into requests to pushary.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets API_KEY_PREFIX_SHAPE=pushary.com,PARTNER_API_KEYS_URL=pushary.com,PUSHARY_API_KEY=pushary.com,SHELL_INERT_URL_PASSWORD_UNIT=pushary.com -- npx -y pushary

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Auto-update or dynamic fetch configuration; Privileged sudo command; Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 2 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
1.8sprocessdependency install exit 1 · npm error code EUNSUPPORTEDPROTOCOL npm error Unsupported URL Type "workspace:": workspace:* npm error A complete log of this run can be found in: /tmp/ks-detonate-yOHcV4/task/home/.npm/_logs/2026-11-11T06_37_10_737Z-debug-0.log
1.8sclaimednot started: dependency install failed (exit 1); the server itself was not observed
1.8sprocessscript backend runs setup only
1.8sprocessno install scripts to re-run

Static findings

MEDIUM
Process kill commanddist/chunk-B4KAY45V.js:1028 · Process kill command — agent can terminate processes' [ -e "$left" ] && ! kill -0 "${left##*.}" 2>/dev/null && rm -f "$left"',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/chunk-IJMWFHZZ.js:806 · MCP server using network transport (SSE/HTTP) — data sent over network…ray(value)) return false; const snapshot = value; return typeof snapshot.hadMcpServers === "boolean" && typeof snapshot.mcpServersWasRecord === "boolean" && (!snapshot.hadMcpServers || snapshot.mcpServersWasRecord || Object.hasOwn(snapshot…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
HIGH
Auto-update or dynamic fetch configurationdist/chunk-3HORJAQX.js:60 · Auto-update or dynamic fetch configuration — agent may load new code at runtimevar autoUpdateOffReason = (input) => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commanddist/chunk-AIZYJJGD.js:76 · Privileged sudo command — agent may execute with elevated privilegestext: `Phone-start ${STOPS_AT_LOGOUT}. To keep it running: \`sudo loginctl enable-linger ${outcome.user}\``Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commanddist/chunk-QCIZDJSU.js:6449 · File permission modification command — agent changes file ownership/permissions"Bash(chown -R:*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagedist/chunk-N346VCKX.js:1594 · npx invocation of non-well-known package — may execute untrusted code"\`npx pushary@latest setup\` with the key Hermes uses, or Session history turned on in the Pushary Mac app")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detecteddist/chunk-N346VCKX.js:1903 · Python subprocess execution detectedresult = subprocess.run(command, input=json.dumps(payload), text=True, env=_registration_environment(key),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-3HORJAQX.js:98 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeconst offReason = autoUpdateOffReason(input);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/chunk-N346VCKX.js:2456 · npx invocation of non-well-known package — may execute untrusted code…ugins/pushary` and selects Pushary as the approval transport. On any computer, `npx pushary@latest setup --agents hermes` does the same. The plugin can also come from the Hermes …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/chunk-IJMWFHZZ.js:1249 · Auto-update or dynamic fetch configuration — agent may load new code at runtimevar autoUpdateState = () => join6(pusharyDir(), "auto-update.json");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/chunk-QCIZDJSU.js:9286 · Process kill command — agent can terminate processesvar isProvenModeResponse = (value) => isRecord(value) && typeof value.kill === "boolean";Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detecteddist/chunk-N346VCKX.js:2456 · Destructive file system command detected…n**Example - dangerous command approval:**\n\n```json\n{\n "question": "Allow: rm -rf /tmp/build-artifacts/*",\n "type": "confirm",\n "context": "Cleaning up 2.3GB o…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commanddist/chunk-QCIZDJSU.js:5048 · File permission modification command — agent changes file ownership/permissions"Bash(chown -R:*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsdist/chunk-QCIZDJSU.js:5413 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesvar SECRET_FILE_NAME = /^(?:\.env(?:\.(?!example$|sample$|template$)[\w.-]+)?|(?:secrets?|credentials)\.(?:json|ya?ml|env|toml|ini)|credentials)$/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/chunk-QAT2PWRX.js:1031 · Process kill command — agent can terminate processesif (mode?.kill || mode?.mode === "terminal_only") return;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/chunk-QCIZDJSU.js:8426 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/(^|[\\/])\.env(\.|$|[\\/])/i,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commanddist/chunk-QCIZDJSU.js:5047 · File permission modification command — agent changes file ownership/permissions"Bash(chmod -R:*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsdist/chunk-QCIZDJSU.js:5463 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesvar REDIRECTS_INTO_A_SECRET_FILE = />>?\s*(?:[^\s;|&<>]*\/)?\.env(?:\.[\w-]+)?(?=$|[\s;|&)])/;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-3HORJAQX.js:102 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeif (checkedWithinInterval(input.state.lastCheckAt, input.now, autoUpdateCheckInterval(input.state))) return { kind: "skip", reason: "checked_recently" };Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/chunk-7DPPMWTR.js:535 · npx invocation of non-well-known package — may execute untrusted code…unsFromATemporaryFolder(entry)) say("This copy of Pushary runs from a temporary npx folder. If that folder is cleared, the cards stop reaching Pushary and Codex keeps work…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detecteddist/chunk-N346VCKX.js:1747 · Python subprocess execution detectedresult = subprocess.run([helper, "authorize-export"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-3HORJAQX.js:105 · Auto-update or dynamic fetch configuration — agent may load new code at runtimevar autoUpdateReportState = (decision) => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/chunk-QCIZDJSU.js:6448 · File permission modification command — agent changes file ownership/permissions"Bash(chmod -R:*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-3HORJAQX.js:96 · Auto-update or dynamic fetch configuration — agent may load new code at runtimevar autoUpdateDecision = (input) => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commanddist/chunk-AIZYJJGD.js:83 · Privileged sudo command — agent may execute with elevated privilegesreturn `no: it ${STOPS_AT_LOGOUT}; run \`pushary daemon install\`, or \`sudo loginctl enable-linger $USER\``;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/chunk-QCIZDJSU.js:8155 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/(^|[\\/])\.env(\.|$|[\\/])/i,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/chunk-S6LB3SZE.js:551 · Process kill command — agent can terminate processesreturn { ...unknownMode(), kill: last.state.kill === true };Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/chunk-QCIZDJSU.js:9292 · Process kill command — agent can terminate processeskill: data.kill === true,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/chunk-S6LB3SZE.js:1788 · Process kill command — agent can terminate processesif (mode?.kill || mode?.mode === "terminal_only") return;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/chunk-QCIZDJSU.js:4190 · npx invocation of non-well-known package — may execute untrusted code/** `npx pushary@latest ...`, the documented one-liner. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/chunk-QCIZDJSU.js:268 · npx invocation of non-well-known package — may execute untrusted codevar PUSHARY_SETUP_COMMAND = "npx pushary@latest setup";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/chunk-S6LB3SZE.js:1392 · npx invocation of non-well-known package — may execute untrusted code// `npx ... doctor` reports npx for that invocation and claude_plugin asFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/chunk-S6LB3SZE.js:1748 · Process kill command — agent can terminate processesif (mode?.kill || mode?.mode === "terminal_only") return;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈77 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for pushary@1.9.140 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim github actions: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim github actionsPropose a patch to the maintainer