Skills/PyPI/a360-mcp

a360-mcp@0.1.1

CAUTION

Publisher claims: "MCP server for Automation Anywhere Automation 360 (A360) Control Room — bot logic analysis and execution failure diagnostics" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher jshsakura · joined 0 days agoInstalls 71Last detonated 1 h ago
Dispute verdict

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1
0.1sprocessexec /usr/bin/timeout
0.1sprocessexec .venv/bin/a360-mcp
0.1sprocessexited 127: timeout: failed to run command '.venv/bin/a360-mcp': No such file or directory
0.1sclaimedno tools/list reply (exit 127)
0.1sprocessscript backend runs setup only

Static findings

CRITICAL
Destructive file system command detectedPKG-INFO:441 · Destructive file system command detected
AST05
HIGH
Process kill commandtests/test_auth_manager.py:257 · Process kill command — agent can terminate processes
AST05
CRITICAL
Pipe-to-shell patternPKG-INFO:219 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06
HIGH
Process kill commandsrc/a360_mcp/browser/window.py:214 · Process kill command — agent can terminate processes
AST05
MEDIUM
URL using raw IP addresssrc/a360_mcp/browser/window.py:304 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
Refusal suppressionCLAUDE.md:119 · Refusal suppression — attempting to prevent safety responses
AST01
HIGH
Access to sensitive file pathstests/test_snapshot_store.py:129 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
MEDIUM
Remote installer piped to shellPKG-INFO:219 · Remote installer piped to shell
AST07
CRITICAL
Pipe-to-shell patternREADME.md:55 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06
CRITICAL
Destructive file system command detectedREADME.md:277 · Destructive file system command detected
AST05
HIGH
Python subprocess execution detectedsrc/a360_mcp/browser/window.py:340 · Python subprocess execution detected
AST05
HIGH
Outbound HTTP to raw IP addresssrc/a360_mcp/browser/window.py:304 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07
MEDIUM
URL using raw IP addresssrc/a360_mcp/browser/inspect.py:125 · URL using raw IP address — may bypass domain-based filtering
AST07
HIGH
Refusal suppressionREADME.md:250 · Refusal suppression — attempting to prevent safety responses
AST01
HIGH
Python subprocess execution detectedsrc/a360_mcp/browser/window.py:185 · Python subprocess execution detected
AST05
HIGH
Process kill commandsrc/a360_mcp/cli.py:20 · Process kill command — agent can terminate processes
AST05
MEDIUM
Remote installer piped to shellREADME.md:55 · Remote installer piped to shell
AST07
HIGH
Outbound HTTP to raw IP addresssrc/a360_mcp/browser/inspect.py:125 · Outbound HTTP to raw IP address — may bypass domain-based monitoring
AST07