Skills/npm/thetacog-mcp

thetacog-mcp@2.61.0

CAUTION· install only

Publisher claims: "Write the job down as a spec, and every change your AI agent makes is placed against it on a record the agent did not write: in lane, flagged, or a breach. Anyone can rerun it and get the same answer. Free and open source (MIT); the VS Code extension is T" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher wiber · publishing for 295 daysInstalls 7,702Last detonated 9 h ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
GDD_USE_GEMINI_API_KEYTELEGRAM_BOT_TOKENConfiguration, not credentials: BOARD_REMOTE, CLAUDBRIDGE_URL, CLAUDE_CODE_ENTRYPOINT, CLAUDE_CODE_SESSION_ID, CLAUDE_PID, CLAUDE_SESSION_ID, CLAUDECODE, DEMO_TH_REC, DEVELOPER_DIR, DRIVE_PATH, DRIVER_PATH, KNOCKON_HISTORY, KNOCKON_ORPHANS, KNOCKON_ORPHANS_MAX, KNOCKON_REEF, LENS_SESSION_ID, LIB_144_PATH, LIB_20K_PATH, MEM_SETTLE_LOAD, MEM_SETTLE_SWAPINS, NODE_TEST_CONTEXT, NOTARY_BEARER, OLLAMA_HOST_URL, PMU_ONCHIP_MEMO, PMU_PRIMARY_LENS, PMU_WALK_TAPE, REWRITE_CLOUD_MODEL, REWRITE_CLOUD_TIMEOUT_MS, REWRITE_LOCAL_MODEL, REWRITE_LOCAL_TIMEOUT_MS, REWRITE_PORT, STEER_ASKS_LEDGER, STEER_RUNNER, SYSTEM_PATH, TAPE_GLOSSARY_PATH, TAPE_LOOKAHEAD, TAPE_PORT, TAPE_SESSIONS_DIR
Where it talks to
no vendor host named in the codeAlso thetadriven.com, visualstudio.com, google.com, rustup.rs, ip-api.com, openxmlformats.org, telegram.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
use of the skill by an agent

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names thetadriven.com, visualstudio.com, google.com, rustup.rs, ip-api.com, openxmlformats.org, telegram.org as well as its own vendor. The guard injects GDD_USE_GEMINI_API_KEY, TELEGRAM_BOT_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y thetacog-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-14 and scored it 71/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Image alt text carrying instructions; Image alt text carrying instructions; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.1sprocessexited 1: Node.js v22.23.5
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset
0.3sprocessexited 1: Node.js v22.23.5

Static findings

HIGH
Image alt text carrying instructionsREADME.md:835 · Image alt text carrying instructionsIN_LANE — sealed, placed at sense-axis A, byte-identical every runFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Image alt text carrying instructionsREADME.md:50 · Image alt text carrying instructionsSix seconds: the diff counter climbs to fourteen files in red — Steer it. — /steer typed, the agent line, then the Δ line placed and the Copy Run Summary doorFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Access to sensitive file pathsscripts/rewrite/llm.mjs:142 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// ALSO UNSET THE API KEY (2026-08-12). The Next dev server loads .env.local into process.env,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Telegram Bot API URLscripts/rewrite/cli.mjs:123 · Telegram Bot API URL — data will be sent to Telegramconst r = await fetch(`https://api.telegram.org/bot${token}/sendPhoto`, { method: 'POST', body: form });Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathslib/door-needs.mjs:82 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst merged = { ...readEnvFile(path.join(cwd, '.env.local')), ...env }; // the environment wins, as in every script that reads the fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/gdd-iterate.sh:180 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# (which returns 400 INVALID_ARGUMENT when the key in .env.local isFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathslib/door-needs.mjs:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Where a need is read from: the caller's environment, then <cwd>/.env.local (the file every one of these scripts already reads atFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/rewrite/llm.mjs:147 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// it. The packaged console never saw the bug because nothing there reads .env.local — which isFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathslib/door-needs.mjs:86 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (missEnv.length) return { ok: false, line: `${door}: needs ${list(missEnv)} (in .env.local or the environment) — operator-only` };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/vna/steer.mjs:904 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst mass = env && Array.isArray(env.raw_semantic_mass) ? [...env.raw_semantic_mass].reverse() : [];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagebin/pmu-rust.sh:3 · npx invocation of non-well-known package — may execute untrusted code# Prefers the PREBUILT daemon (ships for macOS Apple Silicon) so `npx thetacog-pmu-rust`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/doctor.mjs:185 · npx invocation of non-well-known package — may execute untrusted code- ${SERVER} — the MCP server (stdio) and every door: \`node ${SERVER} <door>\` (\`npx thetacog-mcp <door>\` is the same).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandbin/install-hooks.sh:54 · Process kill command — agent can terminate processesecho " (driftPct > kill vs your README-as-spec) it counts ONE event, sensemakes the drift"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagebin/install-hooks.sh:35 · npx invocation of non-well-known package — may execute untrusted codeecho " It NEVER blocks the push. Recompute any time: npx thetacog-mcp spec-drift"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/verify-license.mjs:18 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog verify-license --tape tape.json --authority <pubkey_hex> # pin the signerFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/doctor.mjs:13 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp doctor [--json] [--print] [--no-llm] [--out <file>] [--skills-only] [--fix [--hosts claude-code,cursor,gemini]]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/doctor.mjs:2 · npx invocation of non-well-known package — may execute untrusted code// packages/thetacog-mcp/bin/doctor.mjs — `npx thetacog-mcp doctor`: does everything this install needs actually run HERE?Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/doctor.mjs:101 · npx invocation of non-well-known package — may execute untrusted code…r.stdout || '').trim().split('\n').slice(-3).join(' | ').slice(0, 300)}`, 'run `npx thetacog-mcp attest-demo` by hand and read its last lines'); break; } } if (digests.length =…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/install-hooks.sh:3 · npx invocation of non-well-known package — may execute untrusted code# the `npx thetacog-mcp init-hooks` entrypoint) — the README-as-spec ADVISORY governor pre-push.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/install-hooks.sh:57 · npx invocation of non-well-known package — may execute untrusted codeecho " Recompute: npx thetacog-mcp intervene · close the loop: npx thetacog-mcp intervene --verify"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandbin/doctor.mjs:91 · Process kill command — agent can terminate processes…ignal}` : ''}): ${String(r.stderr || '').slice(0, 200)}`, ok ? '' : 'a deadline kill (SIGKILL) means a wedged pipe; anything else, read stderr above'); } } catch (…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagebin/verify-license.mjs:16 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog verify-license --tape tape.jsonFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandbin/install-hooks.sh:23 · File permission modification command — agent changes file ownership/permissionscp "$src" "$dest"; chmod +x "$dest"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagebin/verify-license.mjs:17 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog verify-license --tape tape.json --license lic_ab12…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/entry-point.mjs:62 · npx invocation of non-well-known package — may execute untrusted coded(' Feed it first: npx thetacog-mcp map-crawl [network]'),Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/install-skills.mjs:45 · npx invocation of non-well-known package — may execute untrusted code// C2312: /doctor — `npx thetacog-mcp doctor`, every command an npx door, the same check the extension's 🩺 button runsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/install-skills.mjs:42 · npx invocation of non-well-known package — may execute untrusted code// C2305: /licence-admin — the OPERATOR side (grant · issue-key · revoke-key · keyring · claim-links · the funnels), every command an npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/install-skills.mjs:40 · npx invocation of non-well-known package — may execute untrusted code// C2305: /licence — connect, buy, paste, status, sign and countersign, every command an npx door (the vsix's 🔑 pills, in the CLI)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/entry-point.mjs:48 · npx invocation of non-well-known package — may execute untrusted codeb(' 1 npx thetacog-mcp attest-demo'),Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/entry-point.mjs:54 · npx invocation of non-well-known package — may execute untrusted codeb(' 2 npx thetacog-mcp my-pixel'),Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/door-needs.mjs:1 · npx invocation of non-well-known package — may execute untrusted code// packages/thetacog-mcp/lib/door-needs.mjs — C2305: THE OPERATOR DOORS' PREFLIGHT (`npx thetacog-mcp grant|issue-key|…`).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagepackage.json:4 · npx invocation of non-well-known package — may execute untrusted code…r. Free and open source (MIT); the VS Code extension is ThetaCog Steer. Try it: npx -y thetacog-mcp@latest (lists the Claude Code skills it installs, /steer first) or…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/verify-license.mjs:19 · npx invocation of non-well-known package — may execute untrusted code// cat tape.json | npx thetacog verify-licenseFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/entry-point.mjs:58 · npx invocation of non-well-known package — may execute untrusted codeb(' 3 npx thetacog-mcp index'),Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionpackage.json:107 · File type combined with upload action — agent may exfiltrate local data files"overview": "node -e \"import('./overview.js').then(m => console.log(JSON.stringify(m.computeOverview(), null, 2)))\"",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagelib/install-skills.mjs:37 · npx invocation of non-well-known package — may execute untrusted code// C2173: the STRANGER-SAFE /rewrite (every command the `npx thetacog-mcp rewrite` door, cloud tracks by default, dry-run); the homeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/entry-point.mjs:3 · npx invocation of non-well-known package — may execute untrusted code// WHY THIS EXISTS: a stranger who typed the package's own name — `npx thetacog-mcp` — got aFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionpackage.json:108 · File type combined with upload action — agent may exfiltrate local data files"show-overview": "node -e \"import('./overview.js').then(m => console.log(JSON.stringify(m.computeOverview({ repoRoot: process.cwd() + '/../..' }), null, 2)))\"",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagelib/install-skills.mjs:22 · npx invocation of non-well-known package — may execute untrusted code// ships — every command a door (`npx thetacog-mcp <door>`), never a path on one machine (operator 2026-10-22: "yes, npm ships the strangerFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/bundle-pmu.mjs:55 · npx invocation of non-well-known package — may execute untrusted code// THE AI GREEKS (operator 2026-08-13: "the npx install does not have it with the greeks"). TheFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/ops/mem.mjs:603 · File type combined with upload action — agent may exfiltrate local data filesif (sf && sf.folded) console.log(`${new Date().toISOString()} mem: stages fold put ${sf.folded} run/cell receipts (${Math.round(sf.bytes / 1e6)} MB) on tapes · ${sf.eligible - sf.folded} left`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandscripts/ops/mem.mjs:346 · Process kill command — agent can terminate processes// operator 2026-10-19: "can you use /mem to kill all tabs safari too when they exceed 80% of cpu? or what is a reasonableFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionscripts/ops/board.mjs:22 · File type combined with upload action — agent may exfiltrate local data files// --csv <dir> also write each tab as <dir>/<tab>.csv (Drive converts a CSV upload into a native Google Sheet,Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/ops/board.mjs:562 · File type combined with upload action — agent may exfiltrate local data files…out, `${REMOTE}:${DRIVE_PATH}.xlsx`, '--drive-import-formats', 'xlsx']); console.log(r.ok ? `drive: uploaded → ${REMOTE}:${DRIVE_PATH} (converted to a Google Sheet)` : `drive: upload failed — ${r.why}`); } } console.log(`board → ${out.repl…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/bundle-pmu.mjs:67 · npx invocation of non-well-known package — may execute untrusted code'spec-drift-check.mjs', // README-as-spec advisory governor (npx thetacog-mcp spec-drift)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/bundle-pmu.mjs:49 · npx invocation of non-well-known package — may execute untrusted code// the PROMPT altitude — the lens receipt (σ + placement + reef-named coordinate) so npx ships theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/ops/mailbox.mjs:226 · File type combined with upload action — agent may exfiltrate local data files// the walk's rides per row (data/vna/horizon-walk.json, written by horizon-walk.mjs; read, never recomputed here)Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/pmu/attest.mjs:396 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`🔍 Verifying ${a.receipt} — recomputed on this machine, trusting nothing:\n`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandscripts/ops/wip.mjs:24 · Process kill command — agent can terminate processes// kill -0 succeeding on a recycled pid is not liveness, so the process's command line mustFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/ops/mem.mjs:214 · Process kill command — agent can terminate processes// XCODE, BY DEFAULT (operator 2026-10-10: "kill xcode by default with it"). Measured that day: the IDE openFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/bundle-pmu.mjs:13 · npx invocation of non-well-known package — may execute untrusted code// • the prebuilt Rust daemon if present (same-arch convenience; else `npx thetacog-pmu-rust` builds it)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/bundle-pmu.mjs:64 · npx invocation of non-well-known package — may execute untrusted code// the PROJECT altitude — the whole-repo insurability rollup (npx thetacog-mcp portfolio). Reads theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/ops/mem.mjs:21 · Process kill command — agent can terminate processes// · Every kill is one row in .thetacog/mem-reaps.ndjson (AXIOM 1: a kill is a displacement).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionscripts/ops/mem.mjs:602 · File type combined with upload action — agent may exfiltrate local data filesif (cf && cf.folded) console.log(`${new Date().toISOString()} mem: cache fold put ${cf.folded} per-run files (${Math.round(cf.bytes / 1e6)} MB) on tapes · ${cf.eligible - cf.folded} left`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/ops/board.mjs:561 · File type combined with upload action — agent may exfiltrate local data filesif (!ready.ok) console.log(`drive: not uploaded — ${ready.why}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandscripts/ops/mem.mjs:341 · Process kill command — agent can terminate processes// operator 2026-10-12: "kill finder" — Finder relaunches with its windows; killall is the documented reset.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/pmu/claim.mjs:2 · npx invocation of non-well-known package — may execute untrusted code// scripts/pmu/claim.mjs — C1158, THE HOLDER'S SIDE OF A CLAIM: `npx thetacog-mcp claim <commit-ref> [--out file.json]`.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/pmu/knock-on.mjs:455 · Process kill command — agent can terminate processes…uit (?:breaks|breaker)\b|\bdead[- ]?man'?s switch\b/i, corrected: 'brake: a kill switch / emergency brake is never ours. Tape, not brake, not engine: the tape is…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/pmu/hooper.mjs:20 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp hooper --json # machine-readableFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/my-pixel.mjs:8 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp my-pixel [--file README.md --file docs/x.md ...]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/hooper.mjs:96 · npx invocation of non-well-known package — may execute untrusted code'The available precaution: `npx thetacog`. Not a future product — installed and running now.',Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/lens-e0.mjs:3 · npx invocation of non-well-known package — may execute untrusted code// Registered as `npx thetacog-mcp e0` (server.js command registry) — the harness-law door.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/lens-run.mjs:2 · npx invocation of non-well-known package — may execute untrusted code// scripts/pmu/lens-run.mjs — `npx thetacog-mcp lens-run "<prompt>" [--ideal <domain>]`: run ONE promptFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/lens-e0.mjs:14 · npx invocation of non-well-known package — may execute untrusted code// Run: node scripts/pmu/lens-e0.mjs · npx thetacog-mcp e0Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/pmu/knock-on.mjs:574 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`knock-on revert: amputated "${r.child_name}" · reef ${r.reef_sha_before} → ${r.reef_sha_after}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/pmu/claim.mjs:101 · npx invocation of non-well-known package — may execute untrusted codeconsole.error('usage: npx thetacog-mcp claim <commit-ref> [--out file.json] [--repo <path>]');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/prove.mjs:4 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp prove # the fast chain (~15s): calibration · same-bytes · your-repoFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/hooper.mjs:213 · npx invocation of non-well-known package — may execute untrusted codeReproduce it yourself: <code>npx thetacog-mcp hooper</code> · <code>npx thetacog-mcp prove-rice</code> · <code>npx thetacog-mcp attest verify …</code><br>Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/my-pixel.mjs:56 · npx invocation of non-well-known package — may execute untrusted coderecompute: 'npx thetacog-mcp my-pixel' + used.map((f) => ' --file ' + f).join(''),Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/hooper.mjs:18 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp hooper # run the ledger, print PASS/FAILFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/pmu/my-pixel.mjs:70 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(' Nobody granted this; nobody can revoke it. They can only recompute it: ' + entry.recompute);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/pmu/hooper.mjs:19 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp hooper --report r.html # also write a self-contained HTML reportFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/prove.mjs:41 · npx invocation of non-well-known package — may execute untrusted codeline('══════════════ npx thetacog-mcp prove — the first-run self-proof ══════════════');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/sense.mjs:160 · npx invocation of non-well-known package — may execute untrusted codelive('deeper: npx thetacog-mcp attest-demo (the 7-pillar walkthrough) · pmu-verify (the sealed self-audit) · thetadriven.com/pixel');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/prove.mjs:5 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp prove --full # also chains the complete attest-demo walkthroughFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/walk.mjs:139 · npx invocation of non-well-known package — may execute untrusted codeL.push(` then \`npx thetacog-mcp walk\` again — the reading turns WITHIN or OUTSIDE(guard C1) on the next commit that touches those paths`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/replay.mjs:20 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp replay --since <ref> [--to <ref>] [--spec <file>] [--repo <path>] [--rows-at <ref>] [--no-guards] [--json]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu-demo.mjs:14 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp pmu-demo --file path/to/doc # read from fileFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu-demo.mjs:13 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp pmu-demo --text "..." # inline textFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/sense.mjs:16 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp sense --runs 3 # K gate runs for the decidability assertion (default 3)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/replay.mjs:2 · npx invocation of non-well-known package — may execute untrusted code// scripts/pmu/replay.mjs — C99d THE REPLAY IS A DOOR, NOT A DEFENCE: `npx thetacog-mcp replay --since <ref>` (2026-09-19).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu-demo.mjs:8 · npx invocation of non-well-known package — may execute untrusted code// axis-library-v1.json into the npm package so `npx thetacog-mcp pmu-demo`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu-demo.mjs:12 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp pmu-demo # built-in sample textFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/walk.mjs:23 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp walk [--since <ref>] [--spec <file>] [--repo <path>] [--no-guards] [--json]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/sense.mjs:15 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp sense # the whole machine, ~30-90s, terminal-onlyFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/walk.mjs:99 · npx invocation of non-well-known package — may execute untrusted codeconst why = absent ? `binary absent — no pmu-onchip at ${binAbs} (the prebuilt ships for macOS arm64; \`npx thetacog-pmu-rust --help\` builds it from the bundled source)`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/walk.mjs:2 · npx invocation of non-well-known package — may execute untrusted code// scripts/pmu/walk.mjs — C92d THE ONE-MINUTE DOOR: `npx thetacog-mcp walk` on the buyer's HEAD (2026-09-19).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/sense.mjs:17 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp sense --json # machine-readable trail of every live numberFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu/prove.mjs:33 · npx invocation of non-well-known package — may execute untrusted code// C1391 — THE RECEIPT COMPARE. The README's "run it twice, the same bytes" (the `npx thetacog-mcp prove` line and theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu-report.mjs:12 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp pmu-report --no-open # don't auto-openFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/pmu-demo.mjs:536 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` ${yellow(`curl -X POST -H 'content-type: application/json' \\`)}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/tape/cli.mjs:296 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(C.dim('\n This is a decidable WHERE, computed with no model in the path. Off-lane is scope\n breadth, not defect — it says where the tape went, not whether going there was wrong.\n'));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/vna/backup.mjs:403 · File type combined with upload action — agent may exfiltrate local data files// (<sha>.upload.json, written by uploadBackup) — its existence beside the archive IS the content-addressed check: the sameFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/pmu-demo.mjs:518 · File type combined with upload action — agent may exfiltrate local data filesif (!args.json) console.log(dim(` POSTing to: ${endpoint}`));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/pmu-demo.mjs:15 · npx invocation of non-well-known package — may execute untrusted code// echo "..." | npx thetacog-mcp pmu-demo --stdin # read from stdinFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/vna/backup.mjs:504 · File type combined with upload action — agent may exfiltrate local data files…'--verify') + 1]; const v = await verifyBackup(sha); if (asJson) console.log(JSON.stringify(v)); else console.log(v.ok ? `backup ${sha.slice(0, 12)} · archive recomputes to its sha · ${v.files.length} entries verify · ${chainWord(v.manifes…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/smoke-accept.sh:4 · npx invocation of non-well-known package — may execute untrusted code# 2.58.3 and 2.59.0 shipped with `npx -y thetacog-mcp@latest attest-demo` throwing ENOENT on line 73,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/pmu-report.mjs:51 · File type combined with upload action — agent may exfiltrate local data files…') args.open = false; else if (a === '--help' || a === '-h') { console.log(`\nthetacog pmu-report — full end-to-end HTML report\n\nUSAGE:\n npx thetacog-mcp pmu-report # built-in sample\n npx thetacog-mcp pmu-report --file path/to/doc # re…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/pmu-report.mjs:165 · File type combined with upload action — agent may exfiltrate local data files…totalLeaves2} cells BLANK — map-of-maps gaps · the bundled <code>axis-library-v1.json</code> only carries depth-1; depth-2 snippets are generated per cohort/domain by <code>extractConcepts(input, opts)</code> + <code>expandCell(input, opts…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/pmu-report.mjs:51 · npx invocation of non-well-known package — may execute untrusted code… console.log(`\nthetacog pmu-report — full end-to-end HTML report\n\nUSAGE:\n npx thetacog-mcp pmu-report # built-in sample\n npx thetacog-mcp pmu-repo…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/pmu-report.mjs:11 · npx invocation of non-well-known package — may execute untrusted code// echo "..." | npx thetacog-mcp pmu-report --stdin # read from stdinFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/tape/git-bin.mjs:15 · npx invocation of non-well-known package — may execute untrusted code// npm/npx builds PATH by PREPENDING each node_modules/.bin to whatever PATH it inherits. Inherit anFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/vna/backup.mjs:518 · File type combined with upload action — agent may exfiltrate local data files…udes('--tapes') }); if (asJson) console.log(JSON.stringify(m)); else console.log(`backup ${m.sha.slice(0, 12)} · ${(m.bytes / 1048576).toFixed(1)} MB · ${m.files.length} files · ${m.source ? `source ${m.source.log} (${m.source.actor || 'un…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/pmu-report.mjs:9 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp pmu-report # built-in sampleFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/pmu-demo.mjs:422 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(dim(` ${bold('THROUGHPUT')} · three rates, three altitudes`));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/vna/anatomy.mjs:267 · File type combined with upload action — agent may exfiltrate local data files… walked before the store's first row)`); const o = share.original; console.log(`SETUP · ${o.MATCH}/${o.rows} walked rows recompute MATCH (${o.match_share ?? '—'}%) · ${o.MISMATCH} MISMATCH · ${o.UNMEASURED} UN…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/vna/backup.mjs:511 · File type combined with upload action — agent may exfiltrate local data files…('--tapes') }); if (asJson) console.log(JSON.stringify(r)); else console.log(r.skipped ? `backup ${r.manifest.sha.slice(0, 12)} unchanged — already posted · ${r.url}` : r.ok ? `backup ${r.manifest.sha.slice(0, 12)} posted · ${r.url}` : `ba…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/pmu-report.mjs:10 · npx invocation of non-well-known package — may execute untrusted code// npx thetacog-mcp pmu-report --file path/to/doc # read from fileFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/vna/spend.mjs:87 · File type combined with upload action — agent may exfiltrate local data files…ocess.exit(2); } const s = spendOf(tp); if (argv.includes('--json')) console.log(JSON.stringify(s)); else { const tot = s.turns.reduce((a, t) => { a.calls += t.calls; for (const k of FIELDS) a[k] += t[k]; return a; }, zero()); console.log(…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/vna/cog.mjs:189 · File type combined with upload action — agent may exfiltrate local data files…{ const p = appendPrediction({ label: l, tree: T, rowText: textOf(l) }); console.log(`${l} · ${p.status === 'predicted' ? `predicted ${p.predicted} (${p.band}) · ${JSON.stringify(p.inputs)}${p.appended ? '' : ' · already on record'}` : `UN…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/vna/steer.mjs:390 · npx invocation of non-well-known package — may execute untrusted codeexport const NO_SPEC_LINE = 'no spec yet at docs/specs/vna/SPEC-VNA-COCKPIT.md — `npx thetacog-mcp steer "<your ask>"` declares the first row';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/vna/mesh.mjs:32 · npx invocation of non-well-known package — may execute untrusted codeconst REPO = process.env.VNA_REPO || resolve(dirname(fileURLToPath(import.meta.url)), '../..'); // C94b: the repo being read — the caller's, when `npx thetacog-mcp <door>` runs elsewhereFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/vna/cog.mjs:193 · File type combined with upload action — agent may exfiltrate local data files…such commit: ${sha}`); process.exit(2); } if (argv.includes('--json')) console.log(JSON.stringify(row)); else console.log(`${row.sha.slice(0, 10)} · cog ${row.cog} ${row.minted ? `· band ${row.band}` : `· not minted — ${row.why}`}\n inputs…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/vna/cockpit.mjs:45 · npx invocation of non-well-known package — may execute untrusted codeconst REPO = targetRepo(); // the repo being read — the caller's, when `npx thetacog-mcp <door>` runs elsewhereFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/vna/workers.mjs:237 · Process kill command — agent can terminate processesexport function endModelClients(tags, { clients = () => ollamaClients(), kill = (pid) => process.kill(pid, 'SIGTERM') } = {}) {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/vna/workers.mjs:121 · Process kill command — agent can terminate processes// ── C250 THE ENGINES PILL AND ITS END-ALL (operator 2026-09-24, on the 💬 Steer chat, verbatim: *"add a kill all running ollama andFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/vna/steer.mjs:386 · npx invocation of non-well-known package — may execute untrusted code// C1016a THE FIRST /steer IN A REPO WITH NO SPEC (measured 2026-10-19 in a linux/amd64 node:20 container, the Replit shape: `npx thetacog-mcpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/vna/cockpit.mjs:107 · npx invocation of non-well-known package — may execute untrusted code// `npx thetacog-mcp steer-ui` → "not run — steer-ui: TypeError"). The walk still runs: HEAD's message isFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/vna/workers.mjs:20 · Process kill command — agent can terminate processes// `all` resolves against the fresh list, never against a pid the caller typed, so this door cannot kill anything else on the machine.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/vna/story.mjs:37 · npx invocation of non-well-known package — may execute untrusted codeconst REPO = process.env.VNA_REPO || resolve(dirname(fileURLToPath(import.meta.url)), '../..'); // C94b: the repo being read — the caller's, when `npx thetacog-mcp <door>` runs elsewhereFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/vna/workers.mjs:236 · Process kill command — agent can terminate processes/** SIGTERM every client of the server; one row each. Injected: clients, kill */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionscripts/vna/labour.mjs:125 · File type combined with upload action — agent may exfiltrate local data files… ? ', rates are the operator\'s estimate' : ''})`); for (const b of t) console.log(` ${b.band} n ${b.n} · peg ${f(b.peg_tokens_per_cog, ' tok/cog')} (${b.peg_route || '—'}) · h/cog chair ${f(b.chair_h_per_cog)} runner ${f(b.runner_h_per_co…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Collapsed <details> block carrying instructionsscripts/rewrite/ui.html:151 · Collapsed <details> block carrying instructions · informational: not an instruction file<summary>direction override — when rewriting cannot fix it</summary> <div class="row"> <input id="dir" class="mono" style="flex:1;background:#05070a;border:1px Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagesrc/lib/agent-hosts.mjs:104 · npx invocation of non-well-known package — may execute untrusted codereturn { id: 'mcp:claude-code', status: 'FAIL', detail: 'no thetacog MCP server in .mcp.json or ~/.claude.json for this repo', fix: 'claude mcp add thetacog -- npx -y thetacog-mcp' };Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/lib/agent-hosts.mjs:91 · npx invocation of non-well-known package — may execute untrusted code…f.map((s) => `${s.path} ${s.state}`).join(' · '), fix: [fixable.length ? `npx thetacog-mcp doctor --fix${h.required ? '' : ` --hosts ${h.id}`} writes ${fixable.map((s) =>…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/vna/workers.mjs:332 · Process kill command — agent can terminate processesexport async function endAllLocal({ ps = psText, kill = (pid, sig) => process.kill(pid, sig), alive = alivePid, fetchFn = globalThis.fetch, host = OLLAMA_HOST(),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Fake instruction boundary tagREADME.md:1286 · Fake instruction boundary tag · informational: not an instruction filenpx thetacog-mcp lens-run "<prompt>" --ideal <domain> # run one prompt through the lens from the CLI — prints the readout, the retrieved rules, the template, and the domain matchFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packagesrc/lib/marketplace.mjs:18 · npx invocation of non-well-known package — may execute untrusted codeexport const ATTEST_CMD = 'npx -y thetacog-mcp@latest attest-demo';Fix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈100 tok
1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for thetacog-mcp@2.61.0 as of 3 h ago. This is the package itself, not its dependencies.

What would make this Verified

9 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim wiber: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Telegram Bot API URL≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim wiberPropose a patch to the maintainer