Skills/PyPI/bulwark-mcp

bulwark-mcp@0.4.2

CAUTION

Publisher claims: "Open-source firewall for MCP servers — catches indirect prompt injection before it reaches your AI agent" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher churik5 · joined 6 days agoInstalls 20Last detonated 6d ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-10-28 and scored it 53/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Prompt injection attempt; Prompt injection attempt; Prompt injection attempt. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1
0.1sprocessexec /usr/bin/timeout
0.1sprocessexec .venv/bin/bulwark
0.1sprocessexited 127: timeout: failed to run command '.venv/bin/bulwark': No such file or directory
0.1sclaimedno tools/list reply (exit 127)
0.1sprocessscript backend runs setup only

Static findings

CRITICAL
Prompt injection attemptdocs/RUNBOOK.md:199 · Prompt injection attempt — 'ignore previous instructions'Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injection attemptREADME.md:111 · Prompt injection attempt — 'ignore previous instructions'Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injection attemptdocs/THREATS.md:19 · Prompt injection attempt — 'ignore previous instructions'Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injectiondocs/RELEASE-v0.2.0.md:113 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
URL using raw IP addresssrc/bulwark_mcp/cli.py:114 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagesrc/bulwark_mcp/cli.py:49 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Prompt injectiondocs/THREATS.md:30 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
npx invocation of non-well-known packagetests/integration/test_github.py:8 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Persistent behavior change attemptdocs/THREATS.md:32 · Persistent behavior change attemptFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
CRITICAL
HTML comment carrying imperative instructions to the agentsrc/bulwark_mcp/rules/builtin/html_injection.yaml:7 · HTML comment carrying imperative instructions to the agentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/bulwark_mcp/rules/builtin/exfiltration.yaml:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Bidirectional text override characters detectedsrc/bulwark_mcp/detectors/rules.py:43 · Bidirectional text override characters detected — may hide content directionFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
File permission modification commandsrc/bulwark_mcp/telemetry.py:261 · File permission modification command — agent changes file ownership/permissionsFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_detectors_rules.py:282 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtests/test_detectors_rules.py:161 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
References a credential file in the home directorytests/test_detectors_rules.py:239 · References a credential file in the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Persistent behavior change attemptsrc/bulwark_mcp/rules/builtin/role_hijack.yaml:55 · Persistent behavior change attemptFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Hidden zero-width characters detectedsrc/bulwark_mcp/rules/builtin/unicode_tricks.yaml:10 · Hidden zero-width characters detected — may conceal contentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Destructive command against a filesystem root or devicetests/test_detectors_rules.py:163 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Hidden zero-width characters detectedsrc/bulwark_mcp/detectors/rules.py:36 · Hidden zero-width characters detected — may conceal contentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Destructive command against a filesystem root or devicetests/test_detectors_rules.py:161 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shelltests/test_detectors_rules.py:266 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Reads credential paths from the home directorytests/test_detectors_rules.py:239 · Reads credential paths from the home directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
Zero-width characters (hidden text)tests/test_detectors_rules.py:258 · Zero-width characters (hidden text)Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injectionsrc/bulwark_mcp/rules/builtin/role_hijack.yaml:42 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Prompt injectionsrc/bulwark_mcp/rules/builtin/role_hijack.yaml:41 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Destructive command against a filesystem root or devicetests/test_detectors_rules.py:283 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
HTML comment carrying imperative instructions to the agenttests/test_detectors_rules.py:289 · HTML comment carrying imperative instructions to the agentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Hidden zero-width characters detectedsrc/bulwark_mcp/detectors/rules.py:41 · Hidden zero-width characters detected — may conceal contentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Leet speak prompt injectiondocs/THREATS.md:91 · Leet speak prompt injection — obfuscated 'ignore previous'Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST01
HIGH
Outbound HTTP to raw IP addresssrc/bulwark_mcp/cli.py:114 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Bidirectional text override characters detectedsrc/bulwark_mcp/rules/builtin/unicode_tricks.yaml:24 · Bidirectional text override characters detected — may hide content directionFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Zero-width characters (hidden text)tests/test_detectors_rules.py:325 · Zero-width characters (hidden text)Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Bidirectional text override characters detectedsrc/bulwark_mcp/rules/builtin/unicode_tricks.yaml:31 · Bidirectional text override characters detected — may hide content directionFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Hidden zero-width characters detectedsrc/bulwark_mcp/detectors/rules.py:42 · Hidden zero-width characters detected — may conceal contentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Zero-width characters (hidden text)src/bulwark_mcp/rules/builtin/unicode_tricks.yaml:10 · Zero-width characters (hidden text)Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Bidirectional text override characters detectedsrc/bulwark_mcp/detectors/rules.py:45 · Bidirectional text override characters detected — may hide content directionFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Process kill commandsrc/bulwark_mcp/proxy.py:206 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Hidden zero-width characters detectedsrc/bulwark_mcp/detectors/rules.py:46 · Hidden zero-width characters detected — may conceal contentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
URL using raw IP addresstests/test_health.py:144 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Destructive file system command detectedtests/test_policy.py:199 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Hidden zero-width characters detectedtests/test_detectors_rules.py:317 · Hidden zero-width characters detected — may conceal contentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Outbound HTTP to raw IP addresstests/test_health.py:90 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Destructive file system command detectedtests/test_detectors_rules.py:163 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtests/test_detectors_rules.py:283 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_detectors_rules.py:239 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Outbound HTTP to raw IP addresstests/test_health.py:72 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Outbound HTTP to raw IP addresstests/test_health.py:144 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addresstests/test_health.py:90 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addresstests/test_health.py:104 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addresstests/test_health.py:72 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Destructive file system command detectedtests/test_detectors_rules.py:282 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Remote installer piped to shelltests/test_inspector.py:61 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Hidden zero-width characters detectedtests/test_detectors_rules.py:258 · Hidden zero-width characters detected — may conceal contentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
Outbound HTTP to raw IP addresstests/test_health.py:104 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Destructive file system command detectedtests/test_inspector.py:131 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Pipe-to-shell patterntests/test_inspector.py:61 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Pipe-to-shell patterntests/test_policy.py:187 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
Remote installer piped to shelltests/test_policy.py:187 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
HTML comment carrying imperative instructions to the agenttests/test_perf.py:95 · HTML comment carrying imperative instructions to the agentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Pipe-to-shell patterntests/test_detectors_rules.py:266 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06

What would make this Verified

27 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Text that tells the agent to ignore its instructions≈ +9 on the totalDelete phrases like "ignore previous instructions", "override", "bypass" from SKILL.md and tool descriptions. Describe what the skill does; do not instruct the agent about other rules.
  2. Unclaimed publisher≈ +8 on the totalClaim churik5: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Bidirectional text override characters detected≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  6. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim churik5