Skills/npm/site-prompt

site-prompt@0.2.1

CAUTION

Publisher claims: "Point at any part of a website and get a prompt that rebuilds it 1:1, or break it down layer by layer. An MCP server and skill for Claude Code, Codex, Cursor, Gemini CLI and any other coding agent." Observed in sandbox: sends data to site-prompt-stats.orevbajohnt.workers.dev.

Registry npm (MCP server)Publisher johntony1 · publishing for 9 daysInstalls 417Last detonated 3 h ago
What would fix thisWatchDispute verdict

Coverage

Server started and answered tools/list.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios) on 2026-11-14 and scored it 54/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Auto-update or dynamic fetch configuration. Summary: sends data to site-prompt-stats.orevbajohnt.workers.dev.

Behavior trace

Honeypot run · 21 s · 3 scenarios
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.2sfilesystemread ~/.site-prompt/app.new · ~/.site-prompt/app.new/skills · ~/.site-prompt/app.new/skills/site-prompt · ~/.site-prompt/app.new/skills/site-prompt/SKILL.md · ~/.site-prompt/app.new/.claude-plugin · ~/.site-prompt/app.new/.claude-plugin/plugin.json outside project
0.2sfilesystemwrote ~/.site-prompt/app.new/skills/site-prompt/SKILL.md · ~/.site-prompt/app.new/.claude-plugin/plugin.json · ~/.site-prompt/app.new/server/component.mjs · ~/.site-prompt/app.new/server/read.mjs · ~/.site-prompt/app.new/server/kit.mjs · ~/.site-prompt/app.new/server/chrome.mjs
0.2sprocessexec /app/apps/web/node_modules/.bin/which
0.2sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/which
0.2sprocessexec /app/node_modules/.bin/which
0.2sprocessexec /pnpm/which
0.2sprocessexec /usr/local/sbin/which
0.2sprocessexec /usr/local/bin/which
0.2sprocessexec /usr/sbin/which
0.2sprocessexec /usr/bin/which
0.2sprocessinstall script run in the sandbox
0.4sfilesystemread ~/.site-prompt/app · ~/.site-prompt/app/.claude-plugin · ~/.site-prompt/app/commands · ~/.site-prompt/app/server · ~/.site-prompt/app/skills · ~/.site-prompt/app/skills/site-prompt outside project
0.4sfilesystemwrote ~/.site-prompt/app.new/skills/site-prompt/SKILL.md · ~/.site-prompt/app.new/.claude-plugin/plugin.json · ~/.site-prompt/app.new/server/component.mjs · ~/.site-prompt/app.new/server/read.mjs · ~/.site-prompt/app.new/server/kit.mjs · ~/.site-prompt/app.new/server/chrome.mjs
0.4sprocessexec /usr/bin/dirname
0.4sprocessexec /app/apps/web/node_modules/.bin/which
0.4sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/which
0.4sprocessexec /app/node_modules/.bin/which
0.4sprocessexec /pnpm/which
0.4sprocessexec /usr/local/sbin/which
0.4sprocessexec /usr/local/bin/which
0.4sprocessexec /usr/sbin/which
0.4sprocessexec /usr/bin/which
20sfilesystemread ~/.site-prompt/id outside project
20sfilesystemwrote ~/.site-prompt/id
20snetworkCONNECT tcp://site-prompt-stats.orevbajohnt.workers.dev:443 · not in the allow-list, refused
20sclaimed6 tools: site_read, site_prompt, site_pick, site_match, site_component, site_compare
20stools05098af16ed9a9e7
20stools7de9fdc2a05934c5
20stools435950b6bf2816ba
20stoolsb855e1ed40f4c21d
20stools4048ef59a4233865
20stoolsf685e74dd57811e7
20sprocessscript backend runs setup only
21sprocesssecond launch, clock +45 days, CI unset
21sfilesystemread ~/.site-prompt/app · ~/.site-prompt/app/.claude-plugin · ~/.site-prompt/app/commands · ~/.site-prompt/app/server · ~/.site-prompt/app/skills · ~/.site-prompt/app/skills/site-prompt outside project
21sfilesystemwrote ~/.site-prompt/app.new/skills/site-prompt/SKILL.md · ~/.site-prompt/app.new/.claude-plugin/plugin.json · ~/.site-prompt/app.new/server/component.mjs · ~/.site-prompt/app.new/server/read.mjs · ~/.site-prompt/app.new/server/kit.mjs · ~/.site-prompt/app.new/server/chrome.mjs
21sprocessexec /app/apps/web/node_modules/.bin/which
21sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/which
21sprocessexec /app/node_modules/.bin/which
21sprocessexec /pnpm/which
21sprocessexec /usr/local/sbin/which
21sprocessexec /usr/local/bin/which
21sprocessexec /usr/sbin/which
21sprocessexec /usr/bin/which
21sfilesystemread ~/.site-prompt/app · ~/.site-prompt/app/.claude-plugin · ~/.site-prompt/app/commands · ~/.site-prompt/app/server · ~/.site-prompt/app/skills · ~/.site-prompt/app/skills/site-prompt outside project
21sfilesystemwrote ~/.site-prompt/app.new/skills/site-prompt/SKILL.md · ~/.site-prompt/app.new/.claude-plugin/plugin.json · ~/.site-prompt/app.new/server/component.mjs · ~/.site-prompt/app.new/server/read.mjs · ~/.site-prompt/app.new/server/kit.mjs · ~/.site-prompt/app.new/server/chrome.mjs
21sprocessexec /usr/bin/dirname
21sprocessexec /app/apps/web/node_modules/.bin/which
21sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/which
21sprocessexec /app/node_modules/.bin/which
21sprocessexec /pnpm/which
21sprocessexec /usr/local/sbin/which
21sprocessexec /usr/local/bin/which
21sprocessexec /usr/sbin/which
21sprocessexec /usr/bin/which

Static findings

MEDIUM
npx invocation of non-well-known packagebin/site-prompt.mjs:15 · npx invocation of non-well-known package — may execute untrusted code…e-prompt: point at any part of a website, get the prompt that rebuilds it.\n\n npx site-prompt install add it to every coding agent on this machine\n npx site-prompt uni…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageinstall.mjs:80 · npx invocation of non-well-known package — may execute untrusted codeconst NPX = (() => { try { const p = execFileSync(WIN ? 'where' : 'which', ['npx'], { encoding: 'utf8' }).split(/\r?\n/)[0].trim(); if (p) return p; } catch {} return 'npx'; })();Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageinstall.mjs:78 · npx invocation of non-well-known package — may execute untrusted code// how agents start it: from npm (`npx site-prompt install`: always the latest version), or the copy made aboveFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/site-prompt.mjs:5 · npx invocation of non-well-known package — may execute untrusted code// npx site-prompt uninstall take it out againFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageinstall.mjs:81 · npx invocation of non-well-known package — may execute untrusted codeconst CMD = VIA_NPX ? NPX : NODE;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/site-prompt.mjs:3 · npx invocation of non-well-known package — may execute untrusted code// npx site-prompt the MCP server (what agents run)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/site-prompt.mjs:4 · npx invocation of non-well-known package — may execute untrusted code// npx site-prompt install add it to every coding agent on this machine (--only, --dry-run as in install.mjs)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationplugin/server/place.mjs:145 · Auto-update or dynamic fetch configuration — agent may load new code at runtime…usHandler|ErrorBoundary.*|RedirectBoundary.*|NotFoundBoundary.*|LoadingBoundary|HotReload|AppRouter|ServerRoot|OuterLayoutRouter|Root)$/.test(n) && !source.components.includes(n)) source.components.push(n); } if (source.components.length >…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈2,053 tok
1 file · 32 in bundle
Tool list per prompt
≈1,435 tok
6 tools · 239 per tool
Handshake
292 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 506

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for site-prompt@0.2.1 as of 2 h ago. This is the package itself, not its dependencies.

What would make this Verified

26 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Contacts a host you did not declare≈ +23 on the totalList every host you talk to in SKILL.md frontmatter (`network: [api.example.com]`), or stop contacting the ones you cannot justify.
  2. Unclaimed publisher≈ +8 on the totalClaim johntony1: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  4. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  5. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim johntony1Propose a patch to the maintainer