Skills/npm/storyshot

storyshot@0.10.0

CAUTION· startup only

Publisher claims: "Ask your coding agent for a video of your web app: promo clips, narrated tutorials, lessons and docs GIFs from a YAML storyboard." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher boheling · publishing for 34 daysInstalls 2,467Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-10 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 32 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
12sprocessdependency install exit 0
32sclaimedstartup only: exited (0) before answering · <out>.draft.mp4; when it looks right, run `compose` without --draft (reuses the recording) --viewport 1600x900 (inspect, init) --insecure (inspect, init) accept a self-signed HTTPS certificate (internal sites); storyboards use `ignoreHTTPSErrors: true`
32sprocessscript backend runs setup only
32sprocessno install scripts to re-run

Static findings

HIGH
Privileged sudo commandsrc/doctor.mjs:19 · Privileged sudo command — agent may execute with elevated privilegesif (has('dnf')) return 'sudo dnf install -y ffmpeg';Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsskills/storyshot/SKILL.md:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesAlso check (without printing it) whether `.env` has `ELEVENLABS_API_KEY`.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsskills/storyshot/SKILL.md:79 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesElevenLabs, best quality, key found in .env)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/check.mjs:250 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (!process.env[env]) errors.push(`voice provider ${cfg.voice.provider} needs ${env} (environment or a .env file next to the storyboard) — or render with draft mode to use the free local voice`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/config.mjs:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Load API keys (ELEVENLABS_API_KEY, OPENAI_API_KEY) from .env next to the storyboardFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/doctor.mjs:91 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslines.push(process.env.ELEVENLABS_API_KEY ? '✔ ELEVENLABS_API_KEY set' : '· ELEVENLABS_API_KEY not set — optional, for the best voice (put it in .env)');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandsrc/doctor.mjs:20 · Privileged sudo command — agent may execute with elevated privilegesif (has('pacman')) return 'sudo pacman -S --noconfirm ffmpeg';Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
URL with embedded credentialssrc/compose.mjs:321 · URL with embedded credentials — may be phishing or credential leakingconst head = `<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=${encodeURIComponent(font)}:wght@400;500;600;700&display=block">`;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathssrc/config.mjs:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst f = path.join(d, '.env');Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandsrc/doctor.mjs:18 · Privileged sudo command — agent may execute with elevated privilegesif (has('apt-get')) return 'sudo apt-get install -y ffmpeg';Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packageskills/storyshot/SKILL.md:25 · npx invocation of non-well-known package — may execute untrusted code`npx storyshot <cmd>`, or `node <checkout>/bin/storyshot.mjs <cmd>`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandsrc/kokoro-zh.mjs:86 · Privileged sudo command — agent may execute with elevated privileges'Ubuntu/Debian: sudo apt install python3.12 python3.12-venv · any OS: uv python install 3.12 — or set STORYSHOT_PYTHON to one. ' +Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
URL with embedded credentialssrc/outputs.mjs:147 · URL with embedded credentials — may be phishing or credential leakingconst head = cjk ? '' : `<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=${encodeURIComponent(fontName)}:wght@400;700&display=block">`;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
npx invocation of non-well-known packagesrc/doctor.mjs:73 · npx invocation of non-well-known package — may execute untrusted codetodo.push(process.platform === 'linux' ? 'npx playwright install --with-deps chromium' : 'npx playwright install chromium');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandsrc/mcp.mjs:3 · Process kill command — agent can terminate processes// so no client-side tool timeout can kill them.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagebin/storyshot.mjs:155 · npx invocation of non-well-known package — may execute untrusted codeif (/Executable doesn't exist/.test(e.message)) console.error(' run: npx playwright install chromium');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandsrc/kokoro-zh.mjs:105 · Privileged sudo command — agent may execute with elevated privileges(what.includes('venv') && process.platform === 'linux' ? '\n (Debian/Ubuntu: sudo apt install python3-venv, or the python3.X-venv package for your version)' : ''));Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/setup.mjs:11 · npx invocation of non-well-known package — may execute untrusted code// Installed from npm → `npx -y storyshot mcp`; running from a checkout → node <abs path>.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
URL to a private-network addresssrc/config.mjs:81 · URL to a private-network address — a LAN or development target// (http://10.1.2.3:8080 → 10-1-2-3-8080, http://localhost:3000 → localhost-3000)Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈13,075 tok
1 file · 30 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for storyshot@0.10.0 as of 4d ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim boheling: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim bohelingPropose a patch to the maintainer