Skills/npm/pushary

pushary@1.9.150

CAUTION· not started

Publisher claims: "Human-in-the-loop (HITL) for AI agents: ask a person for approvals or answers by push notification. One command connects Claude Code, Codex, Cursor, Gemini CLI and more." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher github actions · publishing for 415 daysInstalls 15,613Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
API_KEY_PREFIX_SHAPEPARTNER_API_KEYS_URLPUSHARY_API_KEYSHELL_INERT_URL_PASSWORD_UNIT or --no-ask-passwordConfiguration, not credentials: CLAIM_PATH, CLAUDE_CONFIG_DIR, CLIENT_REPORT_PATH, CODEX_EVENT_KEY, CODEX_HOME, DEVICE_KEY_PATH, DISPLAY, GROK_SESSION_ID, HERMES_COMMAND_ALLOWLIST_KEY, HERMES_GATE_TOOLS_KEY, IDENTITY_PATH, MACHINES_PATH, OPENCODE_CONFIG_DIR, PATHEXT, PLUGIN_LOCATIONS_KEY, ProgramFiles, ProgramW6432, PUSHARY_ADMISSION_FILE, PUSHARY_API_URL, PUSHARY_APP_REGISTER_TIMEOUT_MS, PUSHARY_AUTO_DECISION_BEACON, PUSHARY_BASE_URL, PUSHARY_BELL_QUIET, PUSHARY_BELL_UPGRADE_AT, PUSHARY_COMMAND_DIR, PUSHARY_DEFER_BYPASS, PUSHARY_LEDGER_FILE, PUSHARY_MCP_PATH_PREFIX, PUSHARY_MODEL_PRICING, PUSHARY_NO_BROWSER, PUSHARY_PIN_GLOBAL_VERSION, PUSHARY_RECEIPTS, PUSHARY_RESPECT_PERMISSION_MODE, PUSHARY_SPAWN_ID, PUSHARY_TASK_TITLES, PUSHARY_TRANSCRIPTS
Where it talks to
pushary.com (its own)Also apple.com, nodejs.org, claude.ai, discord.gg, microsoft.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names apple.com, nodejs.org, claude.ai, discord.gg, microsoft.com as well as its own vendor. The guard injects API_KEY_PREFIX_SHAPE, PARTNER_API_KEYS_URL, PUSHARY_API_KEY, SHELL_INERT_URL_PASSWORD_UNIT only into requests to pushary.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets API_KEY_PREFIX_SHAPE=pushary.com,PARTNER_API_KEYS_URL=pushary.com,PUSHARY_API_KEY=pushary.com,SHELL_INERT_URL_PASSWORD_UNIT=pushary.com -- npx -y pushary

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Auto-update or dynamic fetch configuration; Auto-update or dynamic fetch configuration; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 2 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
2.0sprocessdependency install exit 1 · npm error code EUNSUPPORTEDPROTOCOL npm error Unsupported URL Type "workspace:": workspace:* npm error A complete log of this run can be found in: /tmp/ks-detonate-rbrfxk/task/home/.npm/_logs/2026-11-15T08_41_28_104Z-debug-0.log
2.0sclaimednot started: dependency install failed (exit 1); the server itself was not observed
2.0sprocessscript backend runs setup only
2.1sprocessno install scripts to re-run

Static findings

MEDIUM
File permission modification commanddist/chunk-K3ORQ3KY.js:5460 · File permission modification command — agent changes file ownership/permissions"Bash(chown -R:*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commanddist/chunk-OZD5FIFS.js:1032 · Process kill command — agent can terminate processes' [ -e "$left" ] && ! kill -0 "${left##*.}" 2>/dev/null && rm -f "$left"',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/chunk-PYH3KFLI.js:1748 · Process kill command — agent can terminate processesif (mode?.kill || mode?.mode === "terminal_only") return;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-HQ3RFANL.js:102 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeif (checkedWithinInterval(input.state.lastCheckAt, input.now, autoUpdateCheckInterval(input.state))) return { kind: "skip", reason: "checked_recently" };Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/chunk-K3ORQ3KY.js:5459 · File permission modification command — agent changes file ownership/permissions"Bash(chmod -R:*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)dist/chunk-HY4GEW3T.js:814 · MCP server using network transport (SSE/HTTP) — data sent over network…ray(value)) return false; const snapshot = value; return typeof snapshot.hadMcpServers === "boolean" && typeof snapshot.mcpServersWasRecord === "boolean" && (!snapshot.hadMcpServers || snapshot.mcpServersWasRecord || Object.hasOwn(snapshot…Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Process kill commanddist/chunk-K3ORQ3KY.js:9774 · Process kill command — agent can terminate processeskill: data.kill === true,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-HQ3RFANL.js:105 · Auto-update or dynamic fetch configuration — agent may load new code at runtimevar autoUpdateReportState = (decision) => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/chunk-HY4GEW3T.js:1245 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesvar ENVIRONMENT_FILE_NAME = ".env";Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/chunk-NPNBR4FS.js:301 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` ${dim("A browser on this computer is subscribed, but no phone is connected yet.")}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/chunk-BANZ4GGS.js:535 · npx invocation of non-well-known package — may execute untrusted code…unsFromATemporaryFolder(entry)) say("This copy of Pushary runs from a temporary npx folder. If that folder is cleared, the cards stop reaching Pushary and Codex keeps work…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/chunk-K3ORQ3KY.js:6860 · File permission modification command — agent changes file ownership/permissions"Bash(chmod -R:*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-HQ3RFANL.js:60 · Auto-update or dynamic fetch configuration — agent may load new code at runtimevar autoUpdateOffReason = (input) => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/chunk-K3ORQ3KY.js:5825 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesvar SECRET_FILE_NAME = /^(?:\.env(?:\.(?!example$|sample$|template$)[\w.-]+)?|(?:secrets?|credentials)\.(?:json|ya?ml|env|toml|ini)|credentials)$/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-HQ3RFANL.js:96 · Auto-update or dynamic fetch configuration — agent may load new code at runtimevar autoUpdateDecision = (input) => {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/chunk-NPNBR4FS.js:828 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` ${dim('This computer keeps its own key. Revoke the extra "Paired agent (mobile)" key at')} ${cyan("pushary.com/dashboard/agent/settings")}${dim(".")}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commanddist/chunk-PYH3KFLI.js:551 · Process kill command — agent can terminate processesreturn { ...unknownMode(), kill: last.state.kill === true };Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commanddist/chunk-K3ORQ3KY.js:6861 · File permission modification command — agent changes file ownership/permissions"Bash(chown -R:*)",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commanddist/chunk-PYH3KFLI.js:1788 · Process kill command — agent can terminate processesif (mode?.kill || mode?.mode === "terminal_only") return;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/chunk-K3ORQ3KY.js:8584 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/(^|[\\/])\.env(\.|$|[\\/])/i,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/chunk-K3ORQ3KY.js:9768 · Process kill command — agent can terminate processesvar isProvenModeResponse = (value) => isRecord(value) && typeof value.kill === "boolean";Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commanddist/chunk-AIZYJJGD.js:83 · Privileged sudo command — agent may execute with elevated privilegesreturn `no: it ${STOPS_AT_LOGOUT}; run \`pushary daemon install\`, or \`sudo loginctl enable-linger $USER\``;Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Auto-update or dynamic fetch configurationdist/chunk-HQ3RFANL.js:98 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeconst offReason = autoUpdateOffReason(input);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/chunk-HY4GEW3T.js:1299 · Auto-update or dynamic fetch configuration — agent may load new code at runtimevar autoUpdateState = () => join7(pusharyDir(), "auto-update.json");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/chunk-K3ORQ3KY.js:8856 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/(^|[\\/])\.env(\.|$|[\\/])/i,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/chunk-PYH3KFLI.js:1392 · npx invocation of non-well-known package — may execute untrusted code// `npx ... doctor` reports npx for that invocation and claude_plugin asFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/chunk-K3ORQ3KY.js:273 · npx invocation of non-well-known package — may execute untrusted codevar PUSHARY_SETUP_COMMAND = "npx pushary@latest setup";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commanddist/chunk-AIZYJJGD.js:76 · Privileged sudo command — agent may execute with elevated privilegestext: `Phone-start ${STOPS_AT_LOGOUT}. To keep it running: \`sudo loginctl enable-linger ${outcome.user}\``Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/chunk-K3ORQ3KY.js:4602 · npx invocation of non-well-known package — may execute untrusted code/** `npx pushary@latest ...`, the documented one-liner. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/chunk-K3ORQ3KY.js:5875 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesvar REDIRECTS_INTO_A_SECRET_FILE = />>?\s*(?:[^\s;|&<>]*\/)?\.env(?:\.[\w-]+)?(?=$|[\s;|&)])/;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈77 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for pushary@1.9.150 as of 24 min ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim github actions: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim github actionsPropose a patch to the maintainer