Skills/npm/tapp

tapp@0.35.5

CAUTION· startup only

Publisher claims: "Let coding agents verify UI changes on real iOS, Android, and web surfaces, then enforce reviewed proof in deterministic CI." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher aarwitz · publishing for 97 daysInstalls 9,443Last detonated 5d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ANTHROPIC_API_KEYOCQA_CREDENTIALS_EXPLICITOCQA_TEST_PASSWORDTAPP_MCP_TOKENTAPP_SUBSCRIPTION_TOKENTAPP_TOKENTEST_PASSWORDConfiguration, not credentials: ANDROID_HOME, ANDROID_SDK_ROOT, APK_PATH, APP_PATH, FLOW_LOG, GITHUB_SHA, GITHUB_STEP_SUMMARY, OCQA_APP_LAUNCH_ARGS_JSON, OCQA_APP_LAUNCH_ENV_JSON, OCQA_INPUT_OVERRIDES_JSON, OCQA_INPUT_RESPONSE_PATH, OCQA_INTERACTIVE_INPUT, OCQA_LOGIN_STEPS_JSON, OCQA_PR_TARGET_JSON, OCQA_RECORDING_STARTED_PATH, OCQA_SESSION_CMD_PATH, OCQA_SESSION_RESULT_PATH, OCQA_TEST_EMAIL, OCQA_VISUAL_READY_PATH, PR_PLAN_PATH, PR_SELECTION_PATH, PR_TARGET_PATH, RECORDING_STARTED_PATH, TAPP_ACCESS_AUD, TAPP_ACCESS_TEAM_DOMAIN, TAPP_ADMIN_EMAILS, TAPP_BROWSER_PROXY_SERVER, TAPP_ENABLE_REMOTE_AI, TAPP_ENFORCE_PUBLIC_EGRESS, TAPP_FINDING_MODEL, TAPP_FLOW_CONTINUE, TAPP_FLOW_EVIDENCE_DIR, TAPP_FLOW_EVIDENCE_DIR_RESOLVED
Where it talks to
runtapp.com (its own)Also example.test, your.domain, slack.com, resend.com, google.com, tapp.invalid — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names example.test, your.domain, slack.com, resend.com, google.com, tapp.invalid as well as its own vendor. The guard injects ANTHROPIC_API_KEY, OCQA_CREDENTIALS_EXPLICIT, OCQA_TEST_PASSWORD, TAPP_MCP_TOKEN, TAPP_SUBSCRIPTION_TOKEN, TAPP_TOKEN, TEST_PASSWORD only into requests to runtapp.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets ANTHROPIC_API_KEY=runtapp.com,OCQA_CREDENTIALS_EXPLICIT=runtapp.com,OCQA_TEST_PASSWORD=runtapp.com,TAPP_MCP_TOKEN=runtapp.com,TAPP_SUBSCRIPTION_TOKEN=runtapp.com,TAPP_TOKEN=runtapp.com,TEST_PASSWORD=runtapp.com -- npx -y @aarwitz/tapp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-09 and scored it 62/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Image alt text carrying instructions; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 28 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
8.1sprocessdependency install exit 0
28sclaimedstartup only: exited (0) before answering · "Drive the login flow and record it as a replayable test" Older verbs (audit, focus, open, tree, flow, task, contract, scenario, pr, map, baseline, workflows, actor, install, shot, build, apps) still work and print their new form. Docs: https://runtapp.com/
28sprocessscript backend runs setup only
28sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packagebin/tapp.js:471 · npx invocation of non-well-known package — may execute untrusted codeconsole.error("Run `npx -y @aarwitz/tapp@latest --help` for the command reference.");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageAGENTS.md:19 · npx invocation of non-well-known package — may execute untrusted codenpx -y @aarwitz/tapp@latest look [target] # launch + screen summary + screenshot saved to a file (≈ tapp_look)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Image alt text carrying instructionsREADME.md:20 · Image alt text carrying instructionsA real Tapp focus run reaches Update Profile from source and an observed routeFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsmcp-server/src/browser-product.js:310 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (record?.credentials?.password) variables.TEST_PASSWORD = record.credentials.password;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageAGENTS.md:15 · npx invocation of non-well-known package — may execute untrusted codenpx -y @aarwitz/tapp@latest explore [target] # autonomous exploration → findings + evidence (observation, not a gate; ≈ tapp_explore)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/tapp.js:1366 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(`\nNext: npx -y @aarwitz/tapp@latest explore ${inst.bundleId}`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsmcp-server/src/index.js:1464 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst proc = spawn("bash", cmdArgs, { cwd: repoRoot, env: { ...process.env, ...simEnv(), ...env } });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Prompting user to enter sensitive credentialsmcp-server/src/browser-product.js:300 · Prompting user to enter sensitive credentials — social engineering// SIGNED OUT and type the credentials. Handing it a saved sessionFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathsmcp-server/src/index.js:2003 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesstoredEmail = record?.credentials?.email || "";Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagebin/tapp.js:951 · npx invocation of non-well-known package — may execute untrusted codeconsole.error("\nℹ️ Tapp located the source but did not drive an unobserved route. Ground the UI Map with `npx -y @aarwitz/tapp@latest init . --explore`.");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsmcp-server/src/index.js:2004 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesstoredPassword = record?.credentials?.password || "";Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp-server/src/project-config.js:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileserrors.push(`actor '${name}'.credentials must be an object of environment bindings`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp-server/src/browser-product.js:309 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (record?.credentials?.email) variables.TEST_EMAIL = record.credentials.email;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp-server/src/actor-store.js:134 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn { actor, hasCredentials: !!record?.credentials, hasSession: !!record?.session, sessionSavedAt: record?.sessionSavedAt || null };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagebin/tapp.js:310 · npx invocation of non-well-known package — may execute untrusted codeconsole.error(`❌ ${what} requires macOS (Xcode + iOS simulator). Web runs anywhere: npx -y @aarwitz/tapp@latest explore https://localhost:3000`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsmcp-server/src/project-config.js:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst binding = configured.credentials?.[key]?.env;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Credential pass-through configurationmcp-server/src/browser-product.js:563 · Credential pass-through configuration — agent relays sensitive credentials…t = 0, launch = false, workspaceRoot, githubProvider, publicOrigin = "", trustedProxyToken = "", directLogin = null, publicEgressOnly = null, publicAccess = false, access…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationmcp-server/src/browser-product.js:778 · Credential pass-through configuration — agent relays sensitive credentialsconst proxyAuthenticated = !!trustedProxyToken && sameSecret(request.headers["x-tapp-proxy-token"], trustedProxyToken);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
HIGH
Credential pass-through configurationmcp-server/src/browser-product.js:564 · Credential pass-through configuration — agent relays sensitive credentialsconst hosted = !!trustedProxyToken || !!directLogin || !!publicAccess;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST02
MEDIUM
npx invocation of non-well-known packageAGENTS.md:18 · npx invocation of non-well-known package — may execute untrusted codenpx -y @aarwitz/tapp@latest explore --read-only https://example.com --pages 5 # never clicks: production or a site you do not ownFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathsmcp-server/src/application-model.js:1402 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (definition.secret && (["email", "password"].includes(name) || configuredActors[actorName]?.credentials?.[name]?.env)) return [];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packageAGENTS.md:17 · npx invocation of non-well-known package — may execute untrusted codenpx -y @aarwitz/tapp@latest explore https://your-app.example --watch # web: visibly follow the same explorationFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageAGENTS.md:16 · npx invocation of non-well-known package — may execute untrusted codenpx -y @aarwitz/tapp@latest explore --goal "SCREEN OR CONTROL" [target] # source-locate + shortest observed route + screenshotFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandmcp-server/src/ci-setup.js:313 · Privileged sudo command — agent may execute with elevated privilegeslines.push(" sudo chmod 666 /dev/kvm");Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsmcp-server/src/browser-product.js:818 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// "new visitors", 383 of which were bots probing for .env files, which is a readingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Slack webhook URLbrowser/app.js:377 · Slack webhook URL — data will be sent to Slack…erts-form" class="signin-row"><input id="alert-webhook" type="url" placeholder="https://hooks.slack.com/services/…" required><button class="primary" type="submit">Save</button></form><…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagebin/tapp.js:1706 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(` plan: ${adopted.path}\n next: npx -y @aarwitz/tapp@latest plan review ${adopted.path} --approve ${adopted.item.id}`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandmcp-server/src/ci-setup.js:313 · File permission modification command — agent changes file ownership/permissionslines.push(" sudo chmod 666 /dev/kvm");Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commandscripts/run-flow.sh:110 · Process kill command — agent can terminate processes[ -n "$RESPONDER_PID" ] && { kill "$RESPONDER_PID" 2>/dev/null; wait "$RESPONDER_PID" 2>/dev/null; }Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagemcp-server/src/browser-product.js:1431 · npx invocation of non-well-known package — may execute untrusted codemessage: `A folder on your machine is not visible from the cloud. Open it with the Studio there: npx -y @aarwitz/tapp@latest app ${prompt.value}` });Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/ci-setup.js:244 · npx invocation of non-well-known package — may execute untrusted code…push(`Gradle wrapper is missing from ${androidProject}; commit gradlew or rerun npx -y @aarwitz/tapp@latest init from the Gradle repository root`); inputs["androi…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/application-model.js:599 · npx invocation of non-well-known package — may execute untrusted code…und credential requirements: ${missingBindings.join(", ")}.`, remediation: `Run npx -y @aarwitz/tapp@latest actor set ${actor.name} --credential <name>=<ENV_NAME> for…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/browser-product.js:804 · npx invocation of non-well-known package — may execute untrusted codejson(response, 401, { error: "That part of the Studio runs on your own machine: npx -y @aarwitz/tapp@latest app" });Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/ci-report.js:438 · npx invocation of non-well-known package — may execute untrusted code…lines.push(` - Reviewable coverage proposal ready; never auto-applied. Next: \`npx -y @aarwitz/tapp@latest pr adopt <pr-plan.json> --item ${target.id} --project-dir …Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/index.js:1828 · npx invocation of non-well-known package — may execute untrusted codenext.push("replay a committed journey with `npx -y @aarwitz/tapp@latest run <file>`");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/web-explorer.js:323 · npx invocation of non-well-known package — may execute untrusted code// npx installs Tapp into its own cache, so a plain import("playwright") only resolvesFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/tapp/SKILL.md:26 · npx invocation of non-well-known package — may execute untrusted codescreenshots inline. Otherwise run `npx -y @aarwitz/tapp@latest` from the app repository. Do not require MCP,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebrowser/app.js:237 · npx invocation of non-well-known package — may execute untrusted code…a site. iOS, Android and folders on your own machine run the same Studio there: npx -y @aarwitz/tapp@latest app"; $("#actors-panel")?.classList.toggle("hidden", !si…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/quick-capture.sh:352 · Process kill command — agent can terminate processeswhile kill -0 "$HARNESS_PID" 2>/dev/null; doFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/quick-capture.sh:359 · Process kill command — agent can terminate processesif [[ -z "$RECORD_PID" ]] || ! kill -0 "$RECORD_PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/quick-capture.sh:320 · Process kill command — agent can terminate processesif ! kill -0 "$PREFLIGHT_PID" 2>/dev/null; then PREFLIGHT_CRASH=1; fiFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagemcp-server/src/browser-product.js:1087 · npx invocation of non-well-known package — may execute untrusted codejson(response, 400, { error: `This Studio cannot reach ${target.hostname} — it only opens public addresses. Run tapp where that app is: npx -y @aarwitz/tapp@latest app` });Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/tapp/SKILL.md:33 · npx invocation of non-well-known package — may execute untrusted code1. If `.tapp/application-model.json` exists, run `npx -y @aarwitz/tapp@latest explore`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/pr-selection.js:413 · npx invocation of non-well-known package — may execute untrusted codeif (!fs.existsSync(targetPath)) throw new Error(`Release plan not found: ${targetPath}; run npx -y @aarwitz/tapp@latest init first`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/application-model.js:591 · npx invocation of non-well-known package — may execute untrusted code…at ${summary.expectedPath || summary.path}.` : "Build/launch the target and run npx -y @aarwitz/tapp@latest init --explore so real exploration evidence is merged into…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/pr-selection.js:431 · npx invocation of non-well-known package — may execute untrusted code…s !== "proposed"); const refreshAdvice = "refresh the persistent UI Map with `npx -y @aarwitz/tapp@latest init --explore --refresh`, rerun `npx -y @aarwitz/tapp@lat…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/application-model.js:581 · npx invocation of non-well-known package — may execute untrusted code…emediation: "Add a deterministic start/static target or start the app and rerun npx -y @aarwitz/tapp@latest init with --url http://127.0.0.1:<port>." }); if (targ…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/tapp/SKILL.md:40 · npx invocation of non-well-known package — may execute untrusted code`npx -y @aarwitz/tapp@latest doctor`, apply only the stated remediation that is in scope, andFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/tapp/SKILL.md:54 · npx invocation of non-well-known package — may execute untrusted code1. In a source repository, run `npx -y @aarwitz/tapp@latest explore --goal "<exact request>" [target]`;Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/quick-capture.sh:288 · Process kill command — agent can terminate processeskill -INT $RECORD_PID 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagemcp-server/src/browser-product.js:1444 · npx invocation of non-well-known package — may execute untrusted codejson(response, 200, { kind: "self-host", target: prompt.value, command: "npx -y @aarwitz/tapp@latest app",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/browser-product.js:1430 · npx invocation of non-well-known package — may execute untrusted codejson(response, 200, { kind: "self-host", target: prompt.value, command: `npx -y @aarwitz/tapp@latest app ${prompt.value}`,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/application-model.js:579 · npx invocation of non-well-known package — may execute untrusted code…message: `Confirm a shared build scheme for ${target.name}.`, remediation: `Run npx -y @aarwitz/tapp@latest build ${target.sourcePath} or provide the scheme during in…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/index.js:516 · npx invocation of non-well-known package — may execute untrusted codeif (!fs.existsSync(modelPath)) return { error:"No application model found — run `npx -y @aarwitz/tapp@latest init . --explore --platform android` first." };Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/ci-setup.js:285 · npx invocation of non-well-known package — may execute untrusted codeif (model?.kind !== "tapp-application-model" || !Array.isArray(model.targets) || !model.targets.length) throw new Error("Application model has no targets; run npx -y @aarwitz/tapp@latest init first");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/tapp/SKILL.md:34 · npx invocation of non-well-known package — may execute untrusted code2. Otherwise run `npx -y @aarwitz/tapp@latest init . --explore` or call `tapp_init` withFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/platforms.js:88 · npx invocation of non-well-known package — may execute untrusted codeexport const SELF_HOST_COMMAND = "npx -y @aarwitz/tapp@latest app";Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/index.js:1826 · npx invocation of non-well-known package — may execute untrusted codeif (report?.findings?.length) next.push("inspect the evidence with `npx -y @aarwitz/tapp@latest report latest`");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebrowser/app.js:236 · npx invocation of non-well-known package — may execute untrusted code… again. iOS, Android and folders on your own machine run the same Studio there: npx -y @aarwitz/tapp@latest app" : "Websites are audited read-only in the cloud; n…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/quick-capture.sh:283 · Process kill command — agent can terminate processesif ! kill -0 "$RECORD_PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionbin/tapp.js:2358 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Listening on ${product.origin} — put a TLS terminator or tunnel in front of it.`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagemcp-server/src/web-explorer.js:14 · npx invocation of non-well-known package — may execute untrusted code// Playwright is deliberately NOT a required dependency of Tapp (it would bloat every npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/index.js:623 · npx invocation of non-well-known package — may execute untrusted codechoices: apps.map((app) => ({ platform: "ios", name: app.name, bundleId: app.bundleId, selector: app.bundleId, command: `npx -y @aarwitz/tapp@latest tree ${app.bundleId}` })),Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/application-model.js:582 · npx invocation of non-well-known package — may execute untrusted code…kage-manager lockfile so Tapp can install dependencies reproducibly, then rerun npx -y @aarwitz/tapp@latest init." }); } const incompleteMaps = uiMaps.filter((rec…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/ci-setup.js:20 · npx invocation of non-well-known package — may execute untrusted codethrow new Error("Expected a Tapp application model; run npx -y @aarwitz/tapp@latest init first");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/ci-report.js:441 · npx invocation of non-well-known package — may execute untrusted codelines.push(` - Optional explicit evidence reconciliation: \`npx -y @aarwitz/tapp@latest pr adopt <pr-plan.json> --item ${target.id} --project-dir .\``);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionbin/tapp.js:1375 · File type combined with upload action — agent may exfiltrate local data files…usage: tapp validate <task.yml> [--platform ios|android|web] [--map .tapp/ui-map.json]\n tapp validate <task.yml> --compile --platform PLATFORM [--inputs '{\"name\":\"value\"}'] [--out compiled.json]\n tapp run <task.yml> --platform PLATFO…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagemcp-server/src/index.js:583 · npx invocation of non-well-known package — may execute untrusted codeelse return { error: "tree inspects an installed app. Pass its bundle id, or run npx -y @aarwitz/tapp@latest build explicitly before inspecting it." };Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionbin/tapp.js:1402 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` inputs: ${Object.keys(task.inputs || {}).join(", ") || "none"} · outputs: ${Object.keys(task.outputs || {}).join(", ") || "none"}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagemcp-server/src/web-explorer.js:343 · npx invocation of non-well-known package — may execute untrusted code"then `npx playwright install chromium`."Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagemcp-server/src/ci-setup.js:218 · npx invocation of non-well-known package — may execute untrusted code…tor credential binding '${name}' is not a safe environment-variable name; rerun npx -y @aarwitz/tapp@latest init from valid .tapp/project.json`); const inputs = {};…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈6,544 tok
2 files · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @aarwitz/tapp@0.35.5 as of 5d ago. This is the package itself, not its dependencies.

What would make this Verified

18 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim aarwitz: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Credential pass-through configuration≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim aarwitzPropose a patch to the maintainer