Skills/npm/server

server@3.10.2

CAUTION· startup only

Publisher claims: "Reticle CLI, bridge and MCP server: a coding agent drives your running web app from the inside and gets a verdict with evidence, for change verification, access control, accessibility, performance and SEO checks." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher reticlehq · publishing for 127 daysInstalls 14,578Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
no vendor host named in the codeAlso reticle.sh, nodejs.org, tauri.localhost, posthog.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it under the guard. Startup only; authenticated tool behavior not tested. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- npx -y @reticlehq/server

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-15 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 30 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
9.5sprocessdependency install exit 0
30sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-ooggTS/task/home/work/acme-api/.claude/skills/@reticlehq/server/dist/command/cli/cloud-login.js' } Node.js v22.23.5
30sprocessscript backend runs setup only
30sprocessno install scripts to re-run

Static findings

MEDIUM
Process kill commanddist/command/cli/cli-kill.js:242 · Process kill command — agent can terminate processes: `pid ${String(pid)} survived SIGKILL, so it is not yours to kill (permissions) or is an ` +Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/command/cli/cli-parse.js:214 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* The instructions used to ask an agent for three steps: append to .env, check .gitignore, confirm.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/trace.js:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* `process.env` from the project's .env AFTER every module has been imported, so a value captured atFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/telemetry/dev-repo.js:7 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* `.env` and the daemon honours it. But `.env` is gitignored, so it exists only on the machine thatFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:29 · npx invocation of non-well-known package — may execute untrusted code…ools?** A client loads MCP servers only at start, so a prompt cannot add them. `npx @reticlehq/server init --relaunch` prints the command that resumes this conversation with the too…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/trace.d.ts:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* `process.env` from the project's .env AFTER every module has been imported, so a value captured atFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
URL with embedded credentialsdist/telemetry/git-facts.js:43 · URL with embedded credentials — may be phishing or credential leaking/** `[email protected]:Acme/Web.git` / `https://u:[email protected]/Acme/Web` → `github.com/acme/web`. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathsdist/telemetry/telemetry.js:153 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Developing Reticle is not using Reticle. The `.env` carrying RETICLE_TELEMETRY=0 is gitignored,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/telemetry/dev-repo.js:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* `.env` is the convenient one and is useful to every user: put `RETICLE_TELEMETRY=0` in a project'sFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/command/cli/cli-kill.js:79 · Process kill command — agent can terminate processes/** How long after SIGKILL before we accept the process is not ours to kill and say so. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/command/cli/cli-usage.js:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files--license <key> write an enterprise key to .env and keep .env out of gitFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/telemetry/dev-repo.js:51 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Load `<dir>/.env` into `env`. Best-effort and deliberately minimal — no expansion, no multiline.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/command/cli.js:437 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// options — fold in a project-local `.env`. Values already in the environment always win.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:118 · npx invocation of non-well-known package — may execute untrusted code…ambiguity`, `feature_request`, `improvement`, `experience`. Tools unreachable? `npx @reticlehq/server feedback --agent --kind <kind> "what happened"`. A bug in the app under test is…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:14 · npx invocation of non-well-known package — may execute untrusted codenpx @reticlehq/server@latestFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/telemetry/dev-repo.d.ts:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* Load `<dir>/.env` into `env`. Best-effort and deliberately minimal — no expansion, no multiline.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/telemetry/dev-repo.d.ts:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* A variable already present in the environment ALWAYS wins. A .env that overrode an explicitFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:24 · npx invocation of non-well-known package — may execute untrusted codeRETICLE_INSTALL_SOURCE=skill_file npx @reticlehq/server@latest initFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/telemetry/dev-repo.js:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files/** Strip one layer of matching quotes from a .env value. */Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/command/cli.js:441 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// `.env` — or in the repo root when the editor started inside the app — was never read, and theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/command/cli/cli-parse.js:212 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* The key, written to .env by the command rather than by hand.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddist/command/cli/cli-kill.js:120 · Process kill command — agent can terminate processes* daemon that ignored SIGTERM until a human ran `kill -9` by hand, which is the moment the `lsof -ti`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:50 · npx invocation of non-well-known package — may execute untrusted code> Tell the maintainers what you build: Discord https://discord.gg/BwAbzv9ZRz, a call https://calendar.app.google/h9NRDbBBQetyTzWM6, or `npx @reticlehq/server feedback --contact [email protected] "..."`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/command/cli/cli-kill.js:4 · Process kill command — agent can terminate processes* The obvious incantation, `lsof -ti tcp:4400 | xargs kill -9`, also kills `reticle mcp`: the proxyFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/command/cli/cli-parse.js:168 · npx invocation of non-well-known package — may execute untrusted code…e one with reticle_verify { action: "explore", persona: "<who does what>" }, or npx @reticlehq/server verify <url> --explore --persona "<who does what>"'; const ENV_FLAG = '--env'; …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/status-payload.js:81 · npx invocation of non-well-known package — may execute untrusted code`version instead: npx @reticlehq/server@${pin} restart`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/command/cli/cloud-kit.js:108 · npx invocation of non-well-known package — may execute untrusted code: reason.replace(/\.$/, '')}. Run \`npx @reticlehq/server connect\`.`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/launch-chromium.js:8 · npx invocation of non-well-known package — may execute untrusted code* then refused with "Chromium is not installed for Playwright. Run: npx playwright@… installFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/surface/http-server.js:177 · npx invocation of non-well-known package — may execute untrusted code// tool result. That is the pair the user hits after `npm update`: a cached npx MCP packageFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/command/cli/cli-usage.js:301 · npx invocation of non-well-known package — may execute untrusted codeconst HEAD = 'usage: reticle <command> (or npx @reticlehq/server <command>)';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/portal/bridge/bridge.js:407 · npx invocation of non-well-known package — may execute untrusted code* dialling a daemon npx served from cache. Advice naming the wrong component is worse thanFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/launch-chromium.js:6 · npx invocation of non-well-known package — may execute untrusted code* (npx pulled it in with the server) but its browser build is not, because that is a separateFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/command/cli/cli-usage.js:10 · npx invocation of non-well-known package — may execute untrusted code* will happily fetch and run it. So the npx spelling leads every page.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/command/cli.js:579 · Process kill command — agent can terminate processes// the race, and one kill on one well-known port was a machine-wide outage.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/launch-chromium.d.ts:6 · npx invocation of non-well-known package — may execute untrusted code* (npx pulled it in with the server) but its browser build is not, because that is a separateFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/command/cli.js:462 · npx invocation of non-well-known package — may execute untrusted code// `version_skew`, and the unpinned `npx @reticlehq/server` every agent entry uses resolves theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/launch-chromium.js:134 · npx invocation of non-well-known package — may execute untrusted code* Run directly rather than through the `npx playwright@<version>` the hint prints. They install theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/command/cli/cli-usage.js:9 · npx invocation of non-well-known package — may execute untrusted code* not: `npx reticle` resolves the PACKAGE named `reticle`, which belongs to somebody else, and npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/launch-chromium.d.ts:8 · npx invocation of non-well-known package — may execute untrusted code* then refused with "Chromium is not installed for Playwright. Run: npx playwright@… installFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈3,894 tok
1 file · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @reticlehq/server@3.10.2 as of 24 min ago. This is the package itself, not its dependencies.

What would make this Verified

3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim reticlehq: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim reticlehqPropose a patch to the maintainer