Skills/npm/storebound

storebound@0.8.77

CAUTION· install only

Publisher claims: "Take a mobile app or game from nothing to Submit for review on Google Play and the App Store: app records, listings in every language, in-app products and subscriptions with regional prices, every store questionnaire (incl. account deletion and App Review" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher crtkafa · publishing for 35 daysInstalls 9,138Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-11 and scored it 72/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Hidden zero-width characters detected; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
File type combined with upload actioncli/health.ts:35 · File type combined with upload action — agent may exfiltrate local data filesconst anrDev = parseMetricRows(await g.json('POST', `${app}/anrRateMetricSet:query`, metricQuery(['userPerceivedAnrRate', 'distinctUsers'], end, 28, ['deviceModel'])));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncli/apps.ts:240 · File type combined with upload action — agent may exfiltrate local data filesif (missing) console.log(`\n${missing} folder(s) not found (moved to another computer or folder?): storebound apps relink --dry finds them by path and app name`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncli/api.ts:162 · File type combined with upload action — agent may exfiltrate local data files…dy) : req.body ? `<${req.body.length} bytes>` : undefined } }); else console.log(`dry run (${decision.why}): nothing sent\n${kind === 'owner' ? `owner only: this ${ownerReason(st, op.id, op.method)}; sending also asks you to type the opera…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagecli/lib/rt.ts:2 · npx invocation of non-well-known package — may execute untrusted code// same code runs on Node 20+ (`npx storebound`, the dist/storebound.mjs bundle) and on Bun (`bunx storebound`, theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandcli/doctor.ts:76 · Privileged sudo command — agent may execute with elevated privileges/** One install command of a tool, run only with --yes; sudo / admin commands are printed, never run. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagecli/index.ts:64 · npx invocation of non-well-known package — may execute untrusted code// npx / bunx run a cached copy: start the newest storebound instead (cli/lib/self-update.ts)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actioncli/health.ts:31 · File type combined with upload action — agent may exfiltrate local data filesconst crash = parseMetricRows(await g.json('POST', `${app}/crashRateMetricSet:query`, metricQuery(CRASH_METRICS, end, days)));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncli/api.ts:31 · File type combined with upload action — agent may exfiltrate local data filesstorebound api apple|play <operationId | METHOD path> [--param k=v ...] [--body file.json] [--upload file]Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncli/health.ts:32 · File type combined with upload action — agent may exfiltrate local data filesconst anr = parseMetricRows(await g.json('POST', `${app}/anrRateMetricSet:query`, metricQuery(ANR_METRICS, end, days)));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Hidden zero-width characters detectedcli/lib/csv.ts:13 · Hidden zero-width characters detected — may conceal contentconst s = text.replace(/^/, '');Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Privileged sudo commandcli/doctor.ts:123 · Privileged sudo command — agent may execute with elevated privilegesconsole.log('\nTo install what is missing (storebound doctor --install <tool> --yes runs the first one; sudo / admin ones you run yourself):');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known package.mcp.json:7 · npx invocation of non-well-known package — may execute untrusted code…i; if command -v storebound >/dev/null 2>&1; then exec storebound mcp; fi; exec npx -y storebound@latest mcp" ] } } } Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagecli/index.ts:65 · npx invocation of non-well-known package — may execute untrusted code// never for mcp / serve: a client waits for the handshake on stdout, and a second npx download can outlast its timeoutFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actioncli/check.ts:165 · File type combined with upload action — agent may exfiltrate local data filesif (ph.length) note(`credentials: ${ph.join(', ')} still hold template placeholders (env or .storebound/credentials.json): treated as missing; put the real value in or leave it empty`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actioncli/health.ts:34 · File type combined with upload action — agent may exfiltrate local data filesconst crashDev = parseMetricRows(await g.json('POST', `${app}/crashRateMetricSet:query`, metricQuery(['userPerceivedCrashRate', 'distinctUsers'], end, 28, ['deviceModel'])));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Image alt text carrying instructionsREADME.md:53 · Image alt text carrying instructionsstorebound desktop, Releases › Send for review: the dry run of the submission with the build picked by number and the confirm stepFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actioncli/api.ts:5 · File type combined with upload action — agent may exfiltrate local data files// storebound api apple|play <operationId | METHOD path> [--param k=v ...] [--body file.json] [--upload file]Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageAGENTS.md:88 · npx invocation of non-well-known package — may execute untrusted code- CLI: `storebound <command>` (`storebound help`; outside the plugin: `npx storebound` on Node 20+ or `bunx storebound` on Bun); config `storebound.config.ts`, credentials in env or `.storebound/`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionAGENTS.md:63 · File type combined with upload action — agent may exfiltrate local data filesfor the App Review demo account (`reviewDemoAccount` in `.storebound/credentials.json`): the owner puts it there.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagecli/install.ts:7 · npx invocation of non-well-known package — may execute untrusted code// node_modules; else, under Bun, this toolchain's bin/storebound by absolute path, under Node (`npx storeboundFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageGEMINI.md:86 · npx invocation of non-well-known package — may execute untrusted code- CLI: `storebound <command>` (`storebound help`; outside the plugin: `npx storebound` on Node 20+ or `bunx storebound` on Bun); config `storebound.config.ts`, credentials in env or `.storebound/`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Collapsed <details> block carrying instructionsREADME.md:55 · Collapsed <details> block carrying instructions<summary>More screens: portfolio, growth charts, prices, checks, TestFlight, console plan</summary> ![Portfolio: every app of every studio with its state on botFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagecli/install.ts:8 · npx invocation of non-well-known package — may execute untrusted code// install`: the toolchain sits in npx's cache, which can be cleared) `npx -y storebound@<this version> mcp`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagecli/check.ts:246 · npx invocation of non-well-known package — may execute untrusted codeif (st.staleness.stale) note(`${store}: ${staleMessage(st.path, st.staleness, st.copied)}. Set build.prebuild (e.g. "npm run build && npx cap sync") so apple build / play build refresh them`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagecli/install.ts:6 · npx invocation of non-well-known package — may execute untrusted code// MCP command: `bunx storebound mcp` (`npx storebound mcp` when run with Node) when the project has storebound inFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionGEMINI.md:61 · File type combined with upload action — agent may exfiltrate local data filesfor the App Review demo account (`reviewDemoAccount` in `.storebound/credentials.json`): the owner puts it there.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandcli/doctor.ts:81 · Privileged sudo command — agent may execute with elevated privilegesreturn { tool, command, runnable: !!command && !/^sudo |\| *(ba)?sh|^Install /.test(command) };Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actioncli/mcp.ts:159 · File type combined with upload action — agent may exfiltrate local data filesconst file = join(mkdtempSync(join(tmpdir(), 'storebound-mcp-')), json ? 'output.json' : 'output.txt');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/types/lib/config.d.ts:906 · npx invocation of non-well-known package — may execute untrusted code/** Shell command run in the project root before the archive / bundle, e.g. "npm run build && npx cap sync" for aFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/config.js:1506 · npx invocation of non-well-known package — may execute untrusted codee.push('build.prebuild: a shell command run in the project root before apple build / play build, e.g. "npm run build && npx cap sync"');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/types-cjs/lib/config.d.ts:906 · npx invocation of non-well-known package — may execute untrusted code/** Shell command run in the project root before the archive / bundle, e.g. "npm run build && npx cap sync" for aFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈7,211 tok
3 files · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for storebound@0.8.77 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

8 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim crtkafa: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim crtkafaPropose a patch to the maintainer