runner@0.3.67
CAUTION· install onlyPublisher claims: "Make your computer and your agents Cloop machines: device login, the machine daemon, the Cloop MCP server, and Claude Code hooks." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher cloop · publishing for 38 daysInstalls 9,251Last detonated 32 h ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-13 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
MEDIUM
npx invocation of non-well-known packagedist/box-NMG35YB2.js:2942 · npx invocation of non-well-known package — may execute untrusted code
AST06log(`npx is not on PATH, so ${to} cannot start`);Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/box-NMG35YB2.js:3010 · npx invocation of non-well-known package — may execute untrusted code
AST06async function adopt(from, kind, { services: given, script = process.argv[1] ?? "cloop", npx = findNpx() } = {}) {Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/box-NMG35YB2.js:2930 · npx invocation of non-well-known package — may execute untrusted code
AST06const npx = findNpx();Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/box-NMG35YB2.js:2940 · npx invocation of non-well-known package — may execute untrusted code
AST06const npx = findNpx();Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsdist/chunk-IK7YYRMU.js:2926 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05...env.map(([key, value]) => `set "${key}=${cmdValue(value)}"`),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiondist/box-NMG35YB2.js:1327 · File type combined with upload action — agent may exfiltrate local data files
AST07(r) => this.log(`send thread=${thread} after its prompt delivered=${r.delivered}`),Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/box-NMG35YB2.js:282 · File type combined with upload action — agent may exfiltrate local data files
AST07obj(await this.json("POST", `/v1/sessions/${encodeURIComponent(id)}/${command}`, body)).receiptFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Access to sensitive file pathsdist/chunk-IK7YYRMU.js:2845 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05return unitEnv({ ...env, CLOOP_ORIGIN: origin, CLOOP_MESH_URL: env.CLOOP_MESH_URL || origin });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiondist/box-NMG35YB2.js:1297 · File type combined with upload action — agent may exfiltrate local data files
AST07this.log(`send thread=${id} waits for its run's prompt`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/chunk-6LYMSWSB.js:109 · File type combined with upload action — agent may exfiltrate local data files
AST07…ached from your shell (for example \`nohup npm run dev -- --port 5173 > /tmp/dev.log 2>&1 &\`), and check it answers on its port. Then list it as an output: {"kind": "preview", "title": "The new sign-in page", "port": 5173, "path": "/s…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Privileged sudo commanddist/chunk-IK7YYRMU.js:3197 · Privileged sudo command — agent may execute with elevated privileges
AST05return { ok: false, command: `sudo loginctl enable-linger ${user}` };Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actiondist/chunk-7LPSTDZE.js:232 · File type combined with upload action — agent may exfiltrate local data files
AST07deps.log(`[runner:media] sent work=${workId} class=${output.kind}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.CRITICAL
Pipe-to-shell patterndist/chunk-IK7YYRMU.js:216 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06] : ["sh", "-c", "curl -fsSL https://claude.ai/install.sh | bash"];Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathsdist/chunk-IK7YYRMU.js:2974 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05...env.map(([key, value]) => `Environment=${systemdAssignment(`${key}=${value}`)}`),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiondist/box-NMG35YB2.js:278 · File type combined with upload action — agent may exfiltrate local data files
AST07return parseReceipt(obj(await this.json("POST", "/v1/sessions", body)).receipt);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Access to sensitive file pathsdist/chunk-IK7YYRMU.js:2275 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05env: { ...process.env, ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known packagedist/chunk-IK7YYRMU.js:3055 · npx invocation of non-well-known package — may execute untrusted code
AST06const base = script.includes("/_npx/") ? "npx -y @cloop/runner@latest" : "cloop";Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/chunk-IK7YYRMU.js:2801 · npx invocation of non-well-known package — may execute untrusted code
AST06var NPX = process.platform === "win32" ? "npx.cmd" : "npx";Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Remote installer piped to shelldist/chunk-IK7YYRMU.js:216 · Remote installer piped to shell
AST07] : ["sh", "-c", "curl -fsSL https://claude.ai/install.sh | bash"];Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandpackage.json:38 · File permission modification command — agent changes file ownership/permissions
AST05"build": "tsup && chmod 644 dist/*.js && chmod 755 dist/index.js",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
npx invocation of non-well-known packagedist/chunk-IK7YYRMU.js:2790 · npx invocation of non-well-known package — may execute untrusted code
AST06return "npx is not on PATH, so the service cannot run Cloop. Install Node.js with npm, which ships npx, and run `cloop connect` again.";Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/chunk-IK7YYRMU.js:2025 · npx invocation of non-well-known package — may execute untrusted code
AST06return `This computer is no longer a ${env} Cloop machine. To connect it again: ${["npx -y @cloop/runner@latest connect", ENVIRONMENTS[env].flag].filter(Boolean).join(" ")}`;Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈57 tok
1 file · 35 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for @cloop/runner@0.3.67 as of 30 h ago. This is the package itself, not its dependencies.
What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Unclaimed publisher≈ +8 on the totalClaim cloop: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
- File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim cloopPropose a patch to the maintainer