Skills/npm/scenescout

scenescout@3.35.0

CAUTION· startup only

Publisher claims: "SceneScout — exploratory UI testing for AI coding agents. An MCP server that gives any agent (Claude Code, Cursor, VS Code Copilot, Codex, Gemini CLI and others) a structured view of a running web app, always-on oracles, a network-level write policy, memo" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher brunoboto96 · publishing for 57 daysInstalls 6,261Last detonated 4 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
EXPORT_TOKENGH_TOKENGITHUB_TOKENJIRA_API_TOKENLIVE_TOKEN_FILENO_CREDENTIALS or --max-tokensConfiguration, not credentials: CLAUDE_CONFIG_DIR, ComSpec, DISPLAY, GITHUB_ACTIONS, GITHUB_API_URL, GITHUB_STEP_SUMMARY, GITHUB_WORKFLOW_REF, GITHUB_WORKSPACE, JIRA_BASE_URL, JIRA_EMAIL, JIRA_ISSUE_TYPE, JIRA_LINK_TYPE, JIRA_PROJECT_KEY, LEAVE_MARKER_PATH, PATHEXT, SCENESCOUT_WATCHDOG_MS, SSH_CONNECTION, SSH_TTY, WAYLAND_DISPLAY, XPATH_OF_SRC
Where it talks to
no vendor host named in the codeAlso schemastore.org, atlassian.net, azure.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names schemastore.org, atlassian.net, azure.com as well as its own vendor. The guard injects EXPORT_TOKEN, GH_TOKEN, GITHUB_TOKEN, JIRA_API_TOKEN, LIVE_TOKEN_FILE, NO_CREDENTIALS only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y scenescout

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-14 and scored it 75/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 29 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
9.1sprocessdependency install exit 0
29sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-1RSZQW/task/home/work/acme-api/.claude/skills/scenescout/dist/engine/check-report.js' } Node.js v22.23.5
29sprocessscript backend runs setup only
29sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagedist/cli.js:541 · npx invocation of non-well-known package — may execute untrusted code// a checkout nor an npx run leaves the command on PATH. Not having it costsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/engine/uploads.js:13 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* repository holds `.env`. Credential-shaped paths are therefore refused byFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/ci-run.js:313 · File type combined with upload action — agent may exfiltrate local data fileso.log(` turn ${spend.turns}: ${turn.calls.map((c) => c.name || "(unnamed)").join(", ")} — ${(spend.usage.input + spend.usage.output).toLocaleString("en-US")} tokens so far`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/engine/open.js:164 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst { [OPEN_ENV]: _setting, ...env } = deps.env;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/browsers.js:130 · npx invocation of non-well-known package — may execute untrusted codereturn fromCheckout ? `node dist/cli.js install ${flags}` : `npx -y scenescout install ${flags}`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:477 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(`✗ Browser download failed — run \`npx playwright install ${missing.join(" ")}\` and check your network/proxy.`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli.js:543 · npx invocation of non-well-known package — may execute untrusted codelet cli = isEphemeralRoot(packageRoot) ? `npx -y ${CLI_NAME}` : `node ${path.join(packageRoot, "dist", "cli.js")}`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/engine/uploads.js:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* `~/.aws` does not make its files ordinary.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/cli.js:548 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`· Putting \`${CLI_NAME}\` on PATH skipped (--no-command). Until then the command is: ${cli}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsdist/engine/uploads.js:25 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst SECRET_FILE = /^(\.env.*|\.npmrc|\.netrc|\.pgpass|.*\.(pem|key|p8|p12|pfx|ppk|jks|keystore|asc|kdbx))$/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/export-run.js:664 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files? githubApi(o.github, client(o.github.apiUrl, { ...credentials.headers, ...GITHUB_HEADERS }, http))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/cli.js:775 · npx invocation of non-well-known package — may execute untrusted codereturn fail(`Chromium could not be downloaded. Check the network or proxy and run this again, or download it by hand: npx playwright install ${downloads.join(" ")}`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/installer.js:614 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn electron ? { ...env, ELECTRON_RUN_AS_NODE: "1" } : env;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
navigator.sendBeacon()dist/engine/browser.js:6978 · navigator.sendBeacon() — can silently exfiltrate datanavigator.sendBeacon(url, "");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/cli.js:780 · npx invocation of non-well-known package — may execute untrusted codereturn fail(`the download finished, but ${still.join(", ")} is still not where Playwright looks for it. Run: npx playwright install ${still.join(" ")}`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/export-run.js:584 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files? githubApi(o.github, client(o.github.apiUrl, { ...credentials.headers, ...GITHUB_HEADERS }, http))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/tools/explore.js:217 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…rigin), and a credential-shaped one (a dotfile or anything in a hidden folder, `.env*`, an SSH key, `*.pem`/`*.key`/`*.p8`/`*.p12`/`*.pfx`/`*.ppk`/`*.jks`/`*.keysto…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/engine/uploads.js:113 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// avatar.png into .ssh/ and a link named .env to anything are both refused.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/installer.js:147 · npx invocation of non-well-known package — may execute untrusted code* An npx run executes from a cache directory that npm may delete at any time;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/engine/launch.js:37 · npx invocation of non-well-known package — may execute untrusted code`On Linux, if system libraries are missing: npx playwright install --with-deps ${target}`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/first-run.js:516 · npx invocation of non-well-known package — may execute untrusted codeout.push(needsSignInText(walled, `${code(`npx -y scenescout login ${shellArg(result.url)} --role <name>`)} saves a sign-in, and an agent run then attaches as that role`, "page"));Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/cli.js:567 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`· \`${CLI_NAME}\` was not put on PATH (${done.detail}). To do it by hand: ${done.manual}\n Until then the command is: ${cli}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/cli.js:664 · File type combined with upload action — agent may exfiltrate local data filesresult = await runCheck(options, (line) => console.log(line), inputs);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/cli.js:663 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Checking ${options.url} …${inputs.flows.length > 0 ? ` (and ${inputs.flows.length} saved flow(s))` : ""}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/installer.js:246 · npx invocation of non-well-known package — may execute untrusted code* plus the server script. From an npx run it must NOT be: the script then livesFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actiondist/tools/explore.js:127 · File type combined with upload action — agent may exfiltrate local data files…=Save]' (never snapshot refs). The same steps, saved to .scenescout/flows/<name>.json with expect-text / expect-url / expect-request steps added, are replayed by `scenescout check` on every pull request. An `upload` step attaches a file as…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/first-run.js:532 · npx invocation of non-well-known package — may execute untrusted code…e past that a site is usually paginating rather than showing new pages. ${code(`npx -y scenescout check ${shellArg(result.url)} --paths /a,/b`)} measures pages by nam…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/engine/launch.js:35 · npx invocation of non-well-known package — may execute untrusted code` npx -y scenescout install --browser-only --browsers ${target}\n` +Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/engine/reaper.js:62 · Process kill command — agent can terminate processes/* already gone or not ours to kill */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/prompts.js:236 · npx invocation of non-well-known package — may execute untrusted codegithub: "npx -y scenescout export --to github --repo owner/app",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/first-run.js:510 · npx invocation of non-well-known package — may execute untrusted codeout.push(`The start page moved to ${to}, so its links count as another site's and were not followed. To look further, run it there: ${code(`npx -y scenescout ${shellArg(`${to}/`)}`)}.`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/mcp-server.js:110 · Process kill command — agent can terminate processes// on Windows the SIGTERM a client sends next is a plain kill that runs noFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/first-run.js:543 · npx invocation of non-well-known package — may execute untrusted codeconst NEXT_LINE = "Next: let your coding agent explore it and file what it finds (npx -y scenescout install), gate pull requests with npx -y scenescout check in CI, " +Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/installer.js:248 · npx invocation of non-well-known package — may execute untrusted code* silently stops working. There the launcher is `npx -y scenescout serve`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/first-run.js:505 · npx invocation of non-well-known package — may execute untrusted code…to a sign-in page, so this is what a visitor who is not signed in sees. ${code(`npx -y scenescout login ${shellArg(result.url)} --role <name>`)} saves a sign-in, so a…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/installer.js:237 · npx invocation of non-well-known package — may execute untrusted code/** The release an npx launcher line pins, or null when it is unpinned or not this package's launcher. A pre-release such as `3.26.0-beta.1` counts. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/installer.js:233 · npx invocation of non-well-known package — may execute untrusted code/** Whether a registered argument line is this package's npx launcher: unpinned (older installs) or pinned to any release. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/prompts.js:237 · npx invocation of non-well-known package — may execute untrusted codejira: "npx -y scenescout export --to jira --jira-url https://your-site.atlassian.net --jira-project KEY",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈99 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for scenescout@3.35.0 as of 2 h ago. This is the package itself, not its dependencies.

What would make this Verified

5 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim brunoboto96: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. navigator.sendBeacon()≈ +4 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  4. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim brunoboto96Propose a patch to the maintainer