wicked-crew@0.18.14
VERIFIED· startup onlyPublisher claims: "The harness for the coding agents you already use: runs Claude Code, Codex, GitHub Copilot, OpenCode and Pi in sandboxes. By default a different agent reviews the work, and built-in feature, bug-fix, migration, MCP-server and editor-plugin jobs are accept" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher mikeparcewski · publishing for 129 daysInstalls 9,235Last detonated 29 h ago
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
CLIENT_TOKEN_ENVDAEMON_TOKENS_ENVConfiguration, not credentials: VITEST, WICKED_BUS_DATA_DIR, WICKED_BUS_DB, WICKED_BUS_EXEC, WICKED_CAPTURE_INBOX_DIR, WICKED_CHAT_ARTIFACTS_STUB, WICKED_CHROME, WICKED_CORE_STUB, WICKED_CREW_ALLOWED_ORIGINS, WICKED_CREW_BIN, WICKED_CREW_URL, WICKED_INTERACTIVE_CHAT_EVENTS, WICKED_INTERACTIVE_DRAFT_EVENTS, WICKED_INTERACTIVE_EDIT_EVENTS, WICKED_INTERACTIVE_REVIEW_EVENTS, WICKED_INTERACTIVE_SEATS, WICKED_INTERACTIVE_THEME_EVENTS, WICKED_QE_LEDGER_DIR, WICKED_RUN_DOCS_DIR, WICKED_RUN_MIRROR, WICKED_WORKER_HOME, WICKED_WORKING_DOC_CATCHUP_MS- Where it talks to
- no vendor host named in the codeAlso apple.com, astral.sh — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names apple.com, astral.sh as well as its own vendor. The guard injects CLIENT_TOKEN_ENV, DAEMON_TOKENS_ENV only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- npx -y wicked-crew
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-13 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 41 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
20sprocessdependency install exit 0
41sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-IC4wgN/task/home/work/acme-api/.claude/skills/wicked-crew/dist/core/adapter.js' } Node.js v22.23.5
41sprocessscript backend runs setup only
41sprocessno install scripts to re-run
Static findings
MEDIUM
File type combined with upload actiondist/apps/turns.js:474 · File type combined with upload action — agent may exfiltrate local data files
AST07this.log(`[apps] turn ${input.runId} of ${input.app} launched on v${input.base}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File permission modification commanddist/apps/git.d.ts:71 · File permission modification command — agent changes file ownership/permissions
AST05* replaced, never followed). Nothing is ever done THROUGH the existing entry (codex r4: no chmod of it).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commanddist/api/auth.js:154 · File permission modification command — agent changes file ownership/permissions
AST05warn(`[auth] ${path} is group/world-accessible (mode ${(statSync(path).mode & 0o777).toString(8)}) — chmod 600 recommended`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Process kill commanddist/cli/index.js:447 · Process kill command — agent can terminate processes
AST05// engine's in-memory kill handles die with the daemon) and the interactive bridge treesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File type combined with upload actiondist/api/server.js:1519 · File type combined with upload action — agent may exfiltrate local data files
AST07app.log.info('interactive-chat subscription armed (filter wicked.interactive.chat.posted)');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File permission modification commanddist/apps/git.js:236 · File permission modification command — agent changes file ownership/permissions
AST05* replaced, never followed). Nothing is ever done THROUGH the existing entry (codex r4: no chmod of it).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actiondist/api/server.js:487 · File type combined with upload action — agent may exfiltrate local data files
AST07app.log.warn(`[state-home] the post-skills survey failed: ${err instanceof Error ? err.message : String(err)}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/api/mcp.js:401 · File type combined with upload action — agent may exfiltrate local data files
AST07port: body.sql.port ?? (body.sql.driver === 'postgres' ? 5432 : 3306),Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
File type combined with upload actiondist/apps/turns.js:585 · File type combined with upload action — agent may exfiltrate local data files
AST07this.log(`[apps] turn ${input.runId} of ${input.slug} was refused at ${refused.phase}; its run was stopped`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.HIGH
Access to sensitive file pathsdist/mcp/probe.js:60 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05if (config.auth?.env !== undefined && secret !== null)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
File type combined with upload actiondist/apps/turns.js:236 · File type combined with upload action — agent may exfiltrate local data files
AST07… `kind` (`sql` for a postgres, mysql or sqlite source, its text in `queries/<id>.sql`; `graphql` for a graphql source, the document in `queries/<id>.graphql` plus a `rowPath` such as `$.data.items[*]`), `output` [{"name": "<column>", "type…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagedist/api/routes.d.ts:680 · npx invocation of non-well-known package — may execute untrusted code
AST06* spawning a real `npx wicked-interactive serve`. */Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Process kill commanddist/core/exec.js:25 · Process kill command — agent can terminate processes
AST05// silent kill and an OOM.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commanddist/cli/service.js:249 · Process kill command — agent can terminate processes
AST05'Stop it first (a hand-started daemon: its terminal, or `kill <pid>`), then run `wicked-crew serve --install-service` again.');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagedist/cli/service.js:221 · npx invocation of non-well-known package — may execute untrusted code
AST06deps.log('wicked-crew: refusing to install a login service that runs from the npx cache (it is not durable). ' +Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commanddist/skills/tree.js:772 · File permission modification command — agent changes file ownership/permissions
AST05/* not ours to chmod — rmSync below reports what matters */Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File type combined with upload actiondist/cli/service.js:248 · File type combined with upload action — agent may exfiltrate local data files
AST07deps.log(`wicked-crew: 127.0.0.1:${input.port} is already held by ${who}, which is not the login service. ` +Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
npx invocation of non-well-known packagedist/cli/service.js:222 · npx invocation of non-well-known package — may execute untrusted code
AST06'Install crew with `npx wicked-installer`, then run `wicked-crew serve --install-service`.');Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commanddist/skills/tree.js:328 · File permission modification command — agent changes file ownership/permissions
AST05* edit needs a `chmod +w` that moves ctime and mode; a root-forged ctime is the stated gap.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Process kill commanddist/cli/index.js:558 · Process kill command — agent can terminate processes
AST05// Live sweep (crew#340): kill -9 on a bridge mid-run orphans its worker CLI NOW, andFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known packagedist/cli/index.js:285 · npx invocation of non-well-known package — may execute untrusted code
AST06console.error(`[crew] interactive bridge: npx ${interactive.spec} (${interactive.source === 'env' ? `${INTERACTIVE_SPEC_ENV} override` : 'default range'})` +Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/skills/refs.js:92 · npx invocation of non-well-known package — may execute untrusted code
AST06// `$(wicked-garden path <dir>)`, optionally `npx wicked-garden@12 run …`. Masked out of a lineFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packagedist/skills/refs.js:26 · npx invocation of non-well-known package — may execute untrusted code
AST06* bundle (`go test ./...`, `npx @axe-core/cli`, `python3 tests/x.py`) isFix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Instructions loaded
≈100 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for wicked-crew@0.18.14 as of 28 h ago. This is the package itself, not its dependencies.