zero-slop@2.12.38
VERIFIED· startup onlyPublisher claims: "An editing skill, offline writing checks, and a CLI for the hosted Zero Slop MCP pipeline. Find stock AI phrasing, rewrite, and check source details." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Startup only; authenticated tool behavior not tested.- Tested
- server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
- Not tested
- the tool list (the server exited before answering) · what the tools do when called with real credentials
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-12 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 20 s · 2 scenarios · 0 deviationsStatic findings
https://github.com/manavmishra/ZeroSlop/releases/latest/download/zero-slop.zipFix: Pin versions and sources; vendor anything fetched at install time.npx zero-slop score <file|-> [-- <slopscore flags>]Fix: Pin versions and sources; vendor anything fetched at install time.npx zero-slop install [--harness <name>] [--dir <path>] [--force]Fix: Pin versions and sources; vendor anything fetched at install time.npx zero-slop deslop <file|-> [--genre <name>] [--audience <reader>] [--json]Fix: Pin versions and sources; vendor anything fetched at install time.return "npx skills add manavmishra/ZeroSlop --global # re-run to update"Fix: Pin versions and sources; vendor anything fetched at install time.// `npx zero-slop` did nothing and every real install went through the `skills`Fix: Pin versions and sources; vendor anything fetched at install time.npx zero-slop clean-text <file|-> [--inspect] [--json]Fix: Pin versions and sources; vendor anything fetched at install time.Cost to the agent
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
No advisories in OSV for zero-slop@2.12.38 as of 2d ago. This is the package itself, not its dependencies.