trailhead@0.18.1
VERIFIED· install onlyPublisher claims: "Start and drive large projects as a map of tickets on GitHub Issues. Map-based onboarding + a discuss→plan→execute→verify engine, all on the Issues. Installs the trailhead skill, commands, and hooks into your agent's config dir." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher marcomigozzi · publishing for 88 daysInstalls 1,254Last detonated 4d ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
MEDIUM
File type combined with upload actionbin/lib/codex-projection.js:138 · File type combined with upload action — agent may exfiltrate local data files
AST07…ground form) and the helper's one JSON line sent to a file (\`… run --output out.txt -- codex exec … "<prompt>" > run.json &\`), then poll/collect when it finishes, so several reviewers run in parallel instead of serially eating the wall-c…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actionbin/lib/codex-projection.js:132 · File type combined with upload action — agent may exfiltrate local data files
AST07…degraded prose. The installer registers them in \`\${CODEX_HOME:-~/.codex}/hooks.json\`: commit-guard, secret-guard, install-guard, body-guard, labels-guard and test-guard as \`PreToolUse\` (matcher \`Bash\`) hooks that can veto the comman…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagebin/trailhead.js:7 · npx invocation of non-well-known package — may execute untrusted code
AST06// npx @marcomigozzi/trailhead --claude force install for Claude Code (~/.claude or $CLAUDE_CONFIG_DIR)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/trailhead.js:9 · npx invocation of non-well-known package — may execute untrusted code
AST06// npx @marcomigozzi/trailhead --symlink dev install (symlink to the package, live edits; Claude only)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/trailhead.js:8 · npx invocation of non-well-known package — may execute untrusted code
AST06// npx @marcomigozzi/trailhead --codex force install for Codex ($CODEX_HOME or ~/.codex)Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagebin/trailhead.js:6 · npx invocation of non-well-known package — may execute untrusted code
AST06// npx @marcomigozzi/trailhead install (auto-detects the CLI on your PATH; asks if it can't tell)Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathsbin/lib/codex-projection.js:132 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…d-guard as a \`PreToolUse\` (matcher \`Read|Bash\`) hook that denies reads of \`.env\`/\`.env.*\`/\`.secrets\`, the injection-scanner as a \`PostToolUse\` (matcher …Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File permission modification commandbin/trailhead.js:290 · File permission modification command — agent changes file ownership/permissions
AST05// (+chmod so the exec bit is set regardless of the source mode); a --symlink devFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Destructive file system command detectedbin/trailhead.test.js:998 · Destructive file system command detected
AST05// #325: fix non ha chiave propria, porta lo stesso pin di execute (la config delFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandbin/trailhead.test.js:1501 · File permission modification command — agent changes file ownership/permissions
AST05// the commit-msg-sync script instead of the old manual copy/chmod steps -------Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actionbin/trailhead.test.js:928 · File type combined with upload action — agent may exfiltrate local data files
AST07… 'skills', 'trailhead', 'hooks', 'trailhead-bash-guards.js'))); ok('codex: hooks.json registers injection-scanner under PostToolUse', (codexHooksJson.hooks.PostToolUse || []).some((g) => (g.hooks || []).some((h) => h.command.includes('trai…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagebin/trailhead.js:10 · npx invocation of non-well-known package — may execute untrusted code
AST06// npx @marcomigozzi/trailhead --uninstallFix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈85 tok
1 file · 81 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for @marcomigozzi/trailhead@0.18.1 as of 4d ago. This is the package itself, not its dependencies.