Skills/npm/wicked-crew

wicked-crew@0.18.15

CAUTION· startup only

Publisher claims: "The harness for the coding agents you already use: runs Claude Code, Codex, GitHub Copilot, OpenCode and Pi in sandboxes. By default a different agent reviews the work, and built-in feature, bug-fix, migration, MCP-server and editor-plugin jobs are accept" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher mikeparcewski · publishing for 130 daysInstalls 9,669Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
CLIENT_TOKEN_ENVDAEMON_TOKENS_ENVConfiguration, not credentials: VITEST, WICKED_BUS_DATA_DIR, WICKED_BUS_DB, WICKED_BUS_EXEC, WICKED_CAPTURE_INBOX_DIR, WICKED_CHAT_ARTIFACTS_STUB, WICKED_CHROME, WICKED_CORE_STUB, WICKED_CREW_ALLOWED_ORIGINS, WICKED_CREW_BIN, WICKED_CREW_URL, WICKED_INTERACTIVE_CHAT_EVENTS, WICKED_INTERACTIVE_DRAFT_EVENTS, WICKED_INTERACTIVE_EDIT_EVENTS, WICKED_INTERACTIVE_REVIEW_EVENTS, WICKED_INTERACTIVE_SEATS, WICKED_INTERACTIVE_THEME_EVENTS, WICKED_QE_LEDGER_DIR, WICKED_RUN_DOCS_DIR, WICKED_RUN_MIRROR, WICKED_WORKER_HOME, WICKED_WORKING_DOC_CATCHUP_MS
Where it talks to
no vendor host named in the codeAlso apple.com, astral.sh — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names apple.com, astral.sh as well as its own vendor. The guard injects CLIENT_TOKEN_ENV, DAEMON_TOKENS_ENV only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y wicked-crew

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-15 and scored it 77/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Privileged sudo command; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 45 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
25sprocessdependency install exit 0
45sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-ySo1aA/task/home/work/acme-api/.claude/skills/wicked-crew/dist/core/adapter.js' } Node.js v22.23.5
45sprocessscript backend runs setup only
45sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsdist/mcp/probe.js:61 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (config.auth?.env !== undefined && secret !== null)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actiondist/api/server.js:487 · File type combined with upload action — agent may exfiltrate local data filesapp.log.warn(`[state-home] the post-skills survey failed: ${err instanceof Error ? err.message : String(err)}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commanddist/voice/tts.js:196 · Privileged sudo command — agent may execute with elevated privilegesreturn 'Install Python 3 with its venv module: on Debian or Ubuntu, sudo apt install python3 python3-venv.';Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/api/mcp.js:417 · File type combined with upload action — agent may exfiltrate local data filesport: body.sql.port ?? (body.sql.driver === 'postgres' ? 5432 : 3306),Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commanddist/apps/git.d.ts:71 · File permission modification command — agent changes file ownership/permissions* replaced, never followed). Nothing is ever done THROUGH the existing entry (codex r4: no chmod of it).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsdist/api/mcp.js:200 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst refusal = validateServerEnv(c.env, c.auth?.env ?? null);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commanddist/api/auth.js:154 · File permission modification command — agent changes file ownership/permissionswarn(`[auth] ${path} is group/world-accessible (mode ${(statSync(path).mode & 0o777).toString(8)}) — chmod 600 recommended`);Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actiondist/api/server.js:1519 · File type combined with upload action — agent may exfiltrate local data filesapp.log.info('interactive-chat subscription armed (filter wicked.interactive.chat.posted)');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actiondist/apps/turns.js:236 · File type combined with upload action — agent may exfiltrate local data files… `kind` (`sql` for a postgres, mysql or sqlite source, its text in `queries/<id>.sql`; `graphql` for a graphql source, the document in `queries/<id>.graphql` plus a `rowPath` such as `$.data.items[*]`), `output` [{"name": "<column>", "type…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commanddist/apps/git.js:236 · File permission modification command — agent changes file ownership/permissions* replaced, never followed). Nothing is ever done THROUGH the existing entry (codex r4: no chmod of it).Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actiondist/apps/turns.js:585 · File type combined with upload action — agent may exfiltrate local data filesthis.log(`[apps] turn ${input.runId} of ${input.slug} was refused at ${refused.phase}; its run was stopped`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commanddist/cli/service.js:290 · Process kill command — agent can terminate processes'Stop it first (a hand-started daemon: its terminal, or `kill <pid>`), then run `wicked-crew serve --install-service` again.');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actiondist/apps/turns.js:474 · File type combined with upload action — agent may exfiltrate local data filesthis.log(`[apps] turn ${input.runId} of ${input.app} launched on v${input.base}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commanddist/cli/index.js:558 · Process kill command — agent can terminate processes// Live sweep (crew#340): kill -9 on a bridge mid-run orphans its worker CLI NOW, andFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commanddist/skills/tree.js:328 · File permission modification command — agent changes file ownership/permissions* edit needs a `chmod +w` that moves ctime and mode; a root-forged ctime is the stated gap.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File type combined with upload actiondist/cli/service.js:289 · File type combined with upload action — agent may exfiltrate local data filesdeps.log(`wicked-crew: 127.0.0.1:${input.port} is already held by ${who}, which is not the login service. ` +Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagedist/cli/service.js:262 · npx invocation of non-well-known package — may execute untrusted codedeps.log('wicked-crew: refusing to install a login service that runs from the npx cache (it is not durable). ' +Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli/index.js:285 · npx invocation of non-well-known package — may execute untrusted codeconsole.error(`[crew] interactive bridge: npx ${interactive.spec} (${interactive.source === 'env' ? `${INTERACTIVE_SPEC_ENV} override` : 'default range'})` +Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/voice/tts.js:759 · Process kill command — agent can terminate processes/** Record why, kill the group, and wait for `close` to settle. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/skills/refs.js:26 · npx invocation of non-well-known package — may execute untrusted code* bundle (`go test ./...`, `npx @axe-core/cli`, `python3 tests/x.py`) isFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commanddist/skills/tree.js:772 · File permission modification command — agent changes file ownership/permissions/* not ours to chmod — rmSync below reports what matters */Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Process kill commanddist/core/exec.js:25 · Process kill command — agent can terminate processes// silent kill and an OOM.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/voice/tts.js:745 · Process kill command — agent can terminate processesconst kill = () => {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagedist/skills/refs.js:92 · npx invocation of non-well-known package — may execute untrusted code// `$(wicked-garden path <dir>)`, optionally `npx wicked-garden@12 run …`. Masked out of a lineFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagedist/cli/service.js:263 · npx invocation of non-well-known package — may execute untrusted code'Install crew with `npx wicked-installer`, then run `wicked-crew serve --install-service`.');Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanddist/cli/index.js:447 · Process kill command — agent can terminate processes// engine's in-memory kill handles die with the daemon) and the interactive bridge treesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanddist/voice/tts.js:717 · Process kill command — agent can terminate processes/** Shared by probes, installers and synthesis: kill the group, then await close. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈100 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for wicked-crew@0.18.15 as of 35 min ago. This is the package itself, not its dependencies.

What would make this Verified

3 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim mikeparcewski: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim mikeparcewskiPropose a patch to the maintainer