Skills/npm/shipsecure-mcp

shipsecure-mcp@0.1.1

CAUTION

Publisher claims: "MCP server and agent skill that ships npm packages from GitHub securely: Snyk and npm audit scans, gated releases, trusted or staged npm publishing, SBOMs and verification reports, and public docs sync with private-data scanning." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher rcb0727 · publishing for 7 daysInstalls 360Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
SHIPSECURE_MCP_NPM_TOKENSNYK_TOKENSNYK_TOKEN_PAGESOCKET_SECURITY_API_TOKENConfiguration, not credentials: CODEX_HOME, SHIPSECURE_MCP_CONFIG, SHIPSECURE_MCP_NO_BACKGROUND_NPM, SHIPSECURE_MCP_POLL_MS, SHIPSECURE_MCP_RELEASE_SETTLE_MS, SHIPSECURE_MCP_SKILL_OVERLAY, SHIPSECURE_MCP_STATE
Where it talks to
no vendor host named in the codeAlso ntfy.sh, snyk.io, osv.dev, git-scm.com, socket.dev — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names ntfy.sh, snyk.io, osv.dev, git-scm.com, socket.dev as well as its own vendor. The guard injects SHIPSECURE_MCP_NPM_TOKEN, SNYK_TOKEN, SNYK_TOKEN_PAGE, SOCKET_SECURITY_API_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y shipsecure-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-10 and scored it 65/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 33 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
13sprocessdependency install exit 0
33sclaimed30 tools: snyk_status, setup_status, vuln_scan, repo_check, secret_scan, redaction_scan, dependency_review, dependabot_apply, build_compare, maintenance_check, trusted_publisher_check, dev_status, dev_sync, finish_feature, propose_feature, finish_approved, promote, land_fix, ship_status, patch_status, ship_preflight, ship_release_commit, ship_push, local_gate, needs_you
33sprocessscript backend runs setup only
33sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagedist/setup/status.js:119 · npx invocation of non-well-known package — may execute untrusted code* The npm the wizard runs through npx for `npm trust` and `npm stage`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/setup/status.js:274 · npx invocation of non-well-known package — may execute untrusted code…ail: `no ${deps.configPath}`, fix: "Run the setup wizard (shipsecure-mcp setup, npx shipsecure-mcp setup, or npm run setup in a checkout) to create it." }); } else { …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commanddist/secrets.js:199 · Privileged sudo command — agent may execute with elevated privileges…e, detail: "secret-tool is not installed", fix: "Install it (Debian and Ubuntu: sudo apt install libsecret-tools; Fedora: sudo dnf install libsecret) with a keyring …Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsdist/packScan.js:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ name: "environment file", re: /(^|\/)\.env(\.[^/]*)?$/i, severity: "never" },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/exec.js:49 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn { ...env, ...extra };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/setup/wizard.js:509 · npx invocation of non-well-known package — may execute untrusted code…ou approve it with 2FA on npmjs.com (the package's Staged Packages tab) or with npx --yes npm@${STAGE_NPM} stage approve. Your npm account needs 2FA turned on.`); …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/ship/publish.js:206 · npx invocation of non-well-known package — may execute untrusted code…om/package/${pkg}, Staged Packages tab; your phone works), or in your terminal: npx --yes npm@${STAGE_NPM} stage approve ${stageId ?? "<stage id from: npx --yes npm@" + …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/setup/status.js:312 · File permission modification command — agent changes file ownership/permissions…il: `other users on this machine can read it (mode ${mode.toString(8)})`, fix: `chmod 600 ${deps.configPath}: it holds your redaction terms (names, hosts) and project…Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagedist/npmLinks.js:110 · npx invocation of non-well-known package — may execute untrusted code/** The real runner: npx npm@<pinned> in a detached process group, output to a log file. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/setup/wizard.js:604 · npx invocation of non-well-known package — may execute untrusted code…with ~/.npm-global/bin on your PATH) or use a Node.js version manager, then run npx shipsecure-mcp setup again.`); } else { io.print("Then Claude Code and the git…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/hooks.js:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* with the reason fed back to Claude. Gitignored files (.env) are whereFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/setup/status.js:124 · npx invocation of non-well-known package — may execute untrusted code/** npx arguments that run PINNED_NPM with these npm arguments. */Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/setup/status.js:421 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…p wizard: it adds a Claude Code hook that blocks that (gitignored files such as .env are left alone)." }); return items; } /** This checkout's built server, for…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdist/setup/cli.js:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst r = crossSpawn.sync(cmd, args, { stdio: "inherit", env: { ...process.env, ...env } });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsconfig.example.json:198 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/setup/wizard.js:607 · npx invocation of non-well-known package — may execute untrusted codeio.print("Then Claude Code and the git hooks point at the npx copy, which can disappear when npm clears its cache: run npx shipsecure-mcp setup again if they stop working.");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/setup/wizard.js:589 · npx invocation of non-well-known package — may execute untrusted code* npx runs shipsecure-mcp from a temporary cache folder npm may clear, butFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
AWS access key pattern detecteddist/redact.js:19 · AWS access key pattern detected — possible hardcoded or harvested key/** Documentation placeholders such as npm_xxxxxxxx, ghp_000000 or AWS's AKIAIOSFODNN7EXAMPLE are not credentials. */Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
npx invocation of non-well-known packagedist/setup/cli.js:3 · npx invocation of non-well-known package — may execute untrusted code* shipsecure-mcp setup the interactive wizard (npx shipsecure-mcp setup; in a checkout: npm run setup)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
References a credential file in the home directorydist/ship/publish.js:76 · References a credential file in the home directory* dir passed as --userconfig (which also keeps any persistent ~/.npmrc tokenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
npx invocation of non-well-known packagedist/setup/wizard.js:602 · npx invocation of non-well-known package — may execute untrusted codeio.print("Installed. From now on: shipsecure-mcp setup (no npx needed).");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Hidden zero-width characters detecteddist/lockfiles.js:352 · Hidden zero-width characters detected — may conceal contentconst text = raw.replace(/^/, "");Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Access to sensitive file pathsdist/secretScan.js:168 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files" 2. Take the ones in the files out: an environment variable, a gitignored .env, or the system credential store, referenced by name.",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/ship/publish.js:402 · npx invocation of non-well-known package — may execute untrusted codeout.push(`FAIL npm lists the stage of ${key} as "${status}", not ready for approval: check it with npx --yes npm@${STAGE_NPM} stage list ${pkgName} before going on.`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/server.js:173 · npx invocation of non-well-known package — may execute untrusted code… fix what is missing, run the setup wizard in a terminal: shipsecure-mcp setup, npx shipsecure-mcp setup, or npm run setup in a checkout" : ""}`); } catch (e) { …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/setup/cli.js:96 · npx invocation of non-well-known package — may execute untrusted codeconsole.log("\nRun shipsecure-mcp setup (npx shipsecure-mcp setup) in a terminal for the interactive wizard.");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/npmLinks.js:77 · npx invocation of non-well-known package — may execute untrusted code// The job runs in its own process group (detached): stop npx and the npm it started together.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/setup/wizard.js:566 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…rom writing a credential into a file git would commit (gitignored files such as .env are left alone). Both run on this computer, without GitHub Actions."); if (…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/index.js:16 · npx invocation of non-well-known package — may execute untrusted code* shipsecure-mcp setup [--check] the setup wizard (npx shipsecure-mcp setup on a new machine)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/hooks.js:231 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files… push. Keep the value out of tracked files: put it in a gitignored file such as .env or the system credential store, and refer to it by name (an environment variabl…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagedist/npmreg.js:10 · npx invocation of non-well-known package — may execute untrusted code…w.npmjs.com/package/${pkg}, Staged Packages tab, with 2FA), or from a terminal: npx --yes npm@${STAGE_NPM} stage list ${pkg}, then npx --yes npm@${STAGE_NPM} stage appro…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/snyk.js:46 · npx invocation of non-well-known package — may execute untrusted code…/ export const SNYK_SIGN_IN_HELP = "Run the setup wizard (shipsecure-mcp setup, npx shipsecure-mcp setup, or npm run setup in a checkout): it opens Snyk's sign-in page in your br…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsdist/hooks.js:218 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// A gitignored file (.env) or one outside a repository is where a credential may live.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈1,995 tok
1 file · 80 in bundle
Tool list per prompt
≈4,991 tok
30 tools · 166 per tool
Handshake
709 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 242

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for shipsecure-mcp@0.1.1 as of 4d ago. This is the package itself, not its dependencies.

What would make this Verified

15 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim rcb0727: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. AWS access key pattern detected≈ +4 on the totalNever read or enumerate credential locations; accept a documented environment variable instead.
  5. References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim rcb0727Propose a patch to the maintainer