Skills/npm/semiotic

semiotic@3.13.0

BLOCKED

Publisher claims: "Verified generative visualization for React and agents, with deterministic chart validation, repair, rendering evidence, and MCP." Observed in sandbox: static analysis only — behavior not yet observed.

Registry npm (MCP server)Publisher nteract · joined 0 days agoInstalls 45,421Last detonated 1 h ago
Dispute verdict

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

CRITICAL
Access to sensitive file pathsREADME.md:154 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/geo.min.js:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageREADME.md:621 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageREADME.md:60 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathsdist/geo.min.js:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/c-GBO32OML.min.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Prompt injectionREADME.md:623 · Prompt injection — known jailbreak technique reference
AST01
HIGH
npx invocation of non-well-known packageREADME.md:59 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Access to sensitive file pathsdist/c-C332PFY6.min.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/c-CPJR4LHF.min.js:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/c-DDZ5TZ7P.min.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsdist/c-E4JDJH4I.min.js:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
Authorization escalation languageREADME.md:623 · Authorization escalation language
AST01
MEDIUM
File type combined with upload actiondist/geo.min.js:156 · File type combined with upload action — agent may exfiltrate local data files
AST07
HIGH
npx invocation of non-well-known packageREADME.md:769 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
URL with suspicious TLDdist/c-DDZ5TZ7P.min.js:1 · URL with suspicious TLD — commonly used for phishing/malware
AST07
HIGH
npx invocation of non-well-known packageREADME.md:770 · npx invocation of non-well-known package — may execute untrusted code
AST06