Skills/npm/sandbox

sandbox@0.6.0

CAUTION· startup only

Publisher claims: "See every MCP message: chat with any LLM and MCP server, compare models, call tools, and see what your AI editor sends to your MCP servers. 100% local. One command: npx @mokalabs/sandbox" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher mokalabs · publishing for 50 daysInstalls 23,021Last detonated 9 min ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
MOKA_TOKENVERCEL_OIDC_TOKEN or --no-authConfiguration, not credentials: COUNTER, MOKA_CONFIG, MOKA_HOME, MOKA_HOST, MOKA_NO_OPEN, MOKA_PUBLIC_URL, MOKA_STUDIO_ASYNC_HOOKS, MOKA_SYSTEM_CA, NODE_USE_ENV_PROXY, NODE_USE_SYSTEM_CA, NOTES_DIR, OLLAMA_HOST
Where it talks to
mokalabs.dev (its own)Also a2ui.org, vercel.com, hono.dev, cloudflare.com, unpkg.com, openxmlformats.org, foo.bar — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names a2ui.org, vercel.com, hono.dev, cloudflare.com, unpkg.com, openxmlformats.org, foo.bar as well as its own vendor. The guard injects MOKA_TOKEN, VERCEL_OIDC_TOKEN only into requests to mokalabs.dev (and its subdomains) and refuses the rest.

$vet-skills run --secrets MOKA_TOKEN=mokalabs.dev,VERCEL_OIDC_TOKEN=mokalabs.dev -- npx -y @mokalabs/sandbox

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-15 and scored it 62/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Image alt text carrying instructions; Hex-encoded string detected; Hidden zero-width characters detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
20sclaimedstartup only: exited (0) before answering · (node:619) [UNDICI-EHPA] Warning: EnvHttpProxyAgent is experimental, expect them to change at any time. (Use `node --trace-warnings ...` to show where the warning was created) ✗ Cannot find module '/tmp/ks-detonate-5NbUS0/task/home/work/acme-api/.claude/skills/sandbox/dist/chunk-DQBZ5B5J.js' imported from /tmp/ks-detonate-5NbUS0/task/home/work/acme-api/.claude/skills/sandbox/dist/index.js
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actiondist/index.js:4331 · File type combined with upload action — agent may exfiltrate local data filesreturn c.json(await engine.previewUi(input, workspaceId));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/web/assets/sql-CP0rg-5b.js:1 · File type combined with upload action — agent may exfiltrate local data files…acketed"},{"include":"#comments"},{"captures":{"1":{"name":"keyword.other.create.sql"},"2":{"name":"keyword.other.sql"},"5":{"name":"entity.name.function.sql"}},"match":"(?i:^\\\\s*(create(?:\\\\s+or\\\\s+replace)?)\\\\s+(aggregate|convers…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Image alt text carrying instructionsREADME.md:34 · Image alt text carrying instructionsTool tests run on two local models, three times each, with a failed run's wrong argumentFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packageSKILL.md:6 · npx invocation of non-well-known package — may execute untrusted codeSee every MCP message: chat with any LLM and MCP server, compare models, call tools, and see what your AI editor sends to your MCP servers. 100% local. One command: npx @mokalabs/sandboxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/web/assets/php-CQT4wx5i.js:1 · File type combined with upload action — agent may exfiltrate local data files…hp"},"5":{"name":"invalid.illegal.trailing-whitespace.php"}},"contentName":"text.xml","end":"^\\\\s*(\\\\3)(?![0-9A-Z_a-z\\\\x7F-\\\\x{10FFFF}])","endCaptures":{"0":{"name":"punctuation.section.embedded.end.php"},"1":{"name":"keyword.opera…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Hex-encoded string detecteddist/web/assets/core-C0nYwqGS.js:3 · Hex-encoded string detected — may contain obfuscated payloads… t}var Gt=/["&'<>`]/g,Kt=/[\uD800-\uDBFF][\uDC00-\uDFFF]/g,qt=/[\x01-\t\v\f\x0E-\x1F\x7F\x81\x8D\x8F\x90\x9D\xA0-\uFFFF]/g,Jt=/[|\\{}()[\]^$+*?.]/g,Yt=new WeakMap;function Xt(e,t){return e=e.r…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hidden zero-width characters detecteddist/web/assets/html-BcACZWSP.js:1 · Hidden zero-width characters detected — may conceal content…ude":"#math"},{"include":"#svg"},{"begin":"(<)([A-Za-z][.0-9A-Z_a-z·À-ÖØ-öø-ͽͿ-῿‌‍‿⁀⁰-↏Ⰰ-⿯、-퟿豈-﷏ﷰ-�𐀀-\\\\x{EFFFF}]*-[-.0-9A-Z_a-z·À-ÖØ-öø-ͽͿ-῿‌‍‿⁀⁰-↏Ⰰ-⿯、-퟿豈-﷏ﷰ-…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
npx invocation of non-well-known packagedist/moka.schema.json:750 · npx invocation of non-well-known package — may execute untrusted code"description": "Models, MCP servers, skills and workspaces for Moka (npx @mokalabs/sandbox)."Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/web/assets/src-B6xuSHsQ.js:1 · File type combined with upload action — agent may exfiltrate local data files…tal=console.error?console.error.bind(console,c(`FATAL`),`color: orange`):console.log.bind(console,`\x1B[35m`,c(`FATAL`))),t<=a.error&&(o.error=console.error?console.error.bind(console,c(`ERROR`),`color: orange`):console.log.bind(console,`\…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/web/assets/vue-BcFuTOIy.js:1 · File type combined with upload action — agent may exfiltrate local data files…terns":[{"include":"#tag-stuff"},{"begin":"(?<=>)","end":"(?=</)","name":"source.json","patterns":[{"include":"source.json"}]}]},{"begin":"([-0-:A-Za-z]+)\\\\b(?=[^>]*\\\\blang\\\\s*=\\\\s*([\\"']?)jsonc\\\\b\\\\2)","beginCaptures":{"1":{"…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagepackage.json:4 · npx invocation of non-well-known package — may execute untrusted code…and see what your AI editor sends to your MCP servers. 100% local. One command: npx @mokalabs/sandbox", "license": "MIT", "type": "module", "bin": { "sandbox": "./dist/cli.j…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Hidden zero-width characters detecteddist/web/assets/core-C0nYwqGS.js:3 · Hidden zero-width characters detected — may conceal content…¤`,yen:`¥`,brvbar:`¦`,sect:`§`,uml:`¨`,copy:`©`,ordf:`ª`,laquo:`«`,not:`¬`,shy:`­`,reg:`®`,macr:`¯`,deg:`°`,plusmn:`±`,sup2:`²`,sup3:`³`,acute:`´`,micro:`µ`,para…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
File type combined with upload actiondist/web/assets/dagre-C-rnJpZF.js:1 · File type combined with upload action — agent may exfiltrate local data files…(e):n.rhs.push(e)}),n}function ui(e,t){var n=Pn();try{return t()}finally{console.log(e+` time: `+(Pn()-n)+`ms`)}}function di(e,t){return t()}function fi(e){function t(n){var r=e.children(n),i=e.node(n);if(r.length&&E(r,t),Object.prototype.…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/web/assets/pdf-Ci7i7T5q.js:3 · File type combined with upload action — agent may exfiltrate local data files…n(4376),f=n(9297),p=n(655),m=n(6198),h=n(4659),g=n(9039),_=n(8235),v=n(4495),y=a.JSON,b=a.Number,x=a.SyntaxError,S=y&&y.parse,C=o(`Object`,`keys`),w=Object.getOwnPropertyDescriptor,T=s(``.charAt),E=s(``.slice),D=s(/./.exec),O=s([].push),k=…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/cli.js:35 · npx invocation of non-well-known package — may execute untrusted codenpx @mokalabs/sandbox [config.json] [options]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationdist/web/assets/sql-CP0rg-5b.js:1 · Auto-update or dynamic fetch configuration — agent may load new code at runtime…ation|auto|auto_cleanup|auto_close|auto_create_statistics|auto_drop|auto_shrink|auto_update_statistics|auto_update_statistics_async|automated_backup_preference|automatic|autopilot|availability|availability_mode|backup|backup_priority|base6…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detecteddist/web/assets/pdf-Ci7i7T5q.js:3 · Unicode escape sequence detected — may contain obfuscated payloads…00b5\u037e\u0eb3\u2000-\u200a\u202f\u2126\ufb00-\ufb04\ufb06\ufb20-\ufb36\ufb38-\ufb3c\ufb3e\ufb40\ufb41\ufb43\ufb44\ufb46-\ufba1\ufba4-\ufba9\ufbae-\ufbb1\ufbd3-\ufbdc\ufbde-\ufbe7\ufbea-\ufbf8\ufbfc\u…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Hidden zero-width characters detecteddist/web/assets/katex-HrBcstkf.js:251 · Hidden zero-width characters detected — may conceal content…t`],[G([],[])]);x.style.height=A(-u),b=[G([`vlist-r`],[y,G([`vlist-s`],[new Le(`​`)])]),G([`vlist-r`],[x])]}else b=[G([`vlist-r`],[y])];var S=G([`vlist-t`],b);re…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Base64 encoding combined with network calldist/web/assets/pdf-Ci7i7T5q.js:3 · Base64 encoding combined with network call — potential data exfiltration…/this.PDF};async function xe(e,t=`text`){if(Oe(e,document.baseURI)){let n=await fetch(e);if(!n.ok)throw Error(n.statusText);switch(t){case`blob`:return n.blob();case`bytes`:return n.bytes();case`json`:return n.json()}return n.text()}return…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Bidirectional text override characters detecteddist/web/assets/katex-HrBcstkf.js:255 · Bidirectional text override characters detected — may hide content direction… ?)[ \r ]*`,ta=`[̀-ͯ]`,na=RegExp(ta+`+$`),ra=`(`+Xi+`+)|`+(ea+`|`)+`([!-\\[\\]-‧‪-퟿豈-￿]`+(ta+`*`)+`|[\ud800-\udbff][\udc00-\udfff]`+(ta+`*`)+`|\\\\verb\\*([^]).*…Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Hidden zero-width characters detecteddist/web/assets/less-DVTAwKKz.js:1 · Hidden zero-width characters detected — may conceal content…lation"}]},{"include":"#style-function"},{"match":"--|-?(?:[A-Z_a-z·À-ÖØ-öø-ͽͿ-῿‌‍‿⁀⁰-↏Ⰰ-⿯、-퟿豈-﷏ﷰ-�𐀀-\\\\x{EFFFF}]|\\\\\\\\(?:\\\\N|\\\\H|\\\\h{1,6}[R\\\\s]))(?…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Access to sensitive file pathsdist/index.js:2580 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* `.env` can get bindings (environment variables, secrets, KV namespaces, D1 database, R2 bucket etc.) in Cloudflare Workers.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/web/assets/katex-HrBcstkf.js:256 · File type combined with upload action — agent may exfiltrate local data files…d`,e=>ca(e,!0,!0,!0)),$(`\\message`,e=>{var t=e.consumeArgs(1)[0];return console.log(t.reverse().map(e=>e.text).join(``)),``}),$(`\\errmessage`,e=>{var t=e.consumeArgs(1)[0];return console.error(t.reverse().map(e=>e.text).join(``)),``}),$(…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈82 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

18 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim mokalabs: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Obfuscated code≈ +5 on the totalRemove base64-assembled strings, eval of decoded text and minified blobs. Reviewers and scanners both treat unreadable code as hostile.
  4. Hex-encoded string detected≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
  5. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  6. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim mokalabsPropose a patch to the maintainer