twombly@0.4.15
VERIFIED· install onlyPublisher claims: "A canvas for your coding agent's design explorations. Each version becomes a live frame; share one link for cursors, comments and huddles." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher github actions · publishing for 414 daysInstalls 4,612Last detonated 4d ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-10 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
MEDIUM
npx invocation of non-well-known packagedist/cli.js:3051 · npx invocation of non-well-known package — may execute untrusted code
AST06return { ok: false, warnings, problems: [{ code: "NO_BROWSER", message: "No browser available to check the frame.", fix: "Install Google Chrome, or run: npx playwright-core install chromium" }] };Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiondist/cli.js:37 · File type combined with upload action — agent may exfiltrate local data files
AST07…and out files. Delete it from the folder." }, { test: /(^|\/)(package(-lock)?\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?|tsconfig\.json|wrangler\.(toml|jsonc?)|dockerfile|docker-compose\.ya?ml)$/i, code: "PROJECT_FILE", what: "a project …Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Access to sensitive file pathsdist/cli.js:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05{ test: /(^|\/)\.env(\.|$)/i, code: "ENV_FILE", what: "an environment file" },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
HTML comment carrying imperative instructions to the agentdist/ui/terms.html:19 · HTML comment carrying imperative instructions to the agent · informational: not an instruction file
AST01For agents and search engines that don't run scripts, and the text the page shows. The app puts it in the website's frame.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
npx invocation of non-well-known packagedist/ui/skill.md:6 · npx invocation of non-well-known package — may execute untrusted code
AST06Run `npx -y twombly@latest guide` and follow it.Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File type combined with upload actiondist/ui/assets/Faces-DuQKXtJb.js:1 · File type combined with upload action — agent may exfiltrate local data files
AST07…rs:{...t?.body?{"content-type":`application/json`}:{},...t?.headers}}),r=await n.json().catch(()=>({}));if(!n.ok)throw Object.assign(Error(r.error||`Failed (${n.status})`),{status:n.status});return r}var o=(e,t={})=>s(`/api/activity`,{even…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Access to sensitive file pathsdist/cli.js:29 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05{ test: /(^|\/)(\.npmrc|\.netrc|\.pypirc|\.htpasswd|credentials(\.json)?|secrets?\.(json|ya?ml|toml)|service[-_]?account.*\.json)$/i, code: "CREDENTIAL_FILE", what: "a credentials file" },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/cli.js:651 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…n- **Environment values:** never include them. Build with none set. Don't copy `.env` files. If the build needs a value to compile, use an obviously fake one. **Nev…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsdist/cli.js:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05var PLACEHOLDER = /^(?:x+|your|example|placeholder|test|mock|demo|fake|dummy|sample|<|\$\{|process\.env|import\.meta)/i;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
HTML comment carrying imperative instructions to the agentdist/ui/privacy.html:19 · HTML comment carrying imperative instructions to the agent · informational: not an instruction file
AST01For agents and search engines that don't run scripts, and the text the page shows. The app puts it in the website's frame.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.MEDIUM
File type combined with upload actiondist/cli.js:651 · File type combined with upload action — agent may exfiltrate local data files
AST07…ses, source maps, server code, `node_modules` and project files such as `package.json`. Pop-ups are off. A design that uses the camera or microphone needs `--devices camera`, `microphone` or both (`camera,microphone`); each viewer turns th…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagedist/cli.js:651 · npx invocation of non-well-known package — may execute untrusted code
AST06…dd, update or move appears for everyone straight away.\n\nRun every command as `npx -y twombly@latest <command>`; this guide shortens that to `twombly <command>`. Out…Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/cli.js:1359 · npx invocation of non-well-known package — may execute untrusted code
AST06return `twombly ${version} is out and this is ${"0.4.15"}. Run every command as npx -y twombly@latest <command>. What changed: https://twombly.app/changes`;Fix: Pin versions and sources; vendor anything fetched at install time.LOW
HTML comment carrying imperative instructions to the agentdist/ui/index.html:34 · HTML comment carrying imperative instructions to the agent · informational: not an instruction file
AST01For agents and search engines that don't run scripts. The app replaces it on its first render.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.Cost to the agent
Instructions loaded
≈150 tok
2 files · 25 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for twombly@0.4.15 as of 4d ago. This is the package itself, not its dependencies.