homelab-mcp@1.8.0
CAUTIONPublisher claims: "MCP server for homelab VM infrastructure management with service installation framework" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-01 and scored it 65/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Privileged sudo command; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.3sprocessdependency install exit 1
0.4sprocessexec /usr/bin/timeout
0.4sprocessexec .venv/bin/homelab-mcp
0.4sprocessexited 127: timeout: failed to run command '.venv/bin/homelab-mcp': No such file or directory
0.4sclaimedno tools/list reply (exit 127)
0.4sprocessscript backend runs setup only
Static findings
HIGH
Access to sensitive file pathsscripts/db_manager.py:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/infrastructure_crud.py:912 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/prompt_registry.py:145 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Access to sensitive file pathsCLAUDE.md:104 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Access to sensitive file pathssrc/homelab_mcp/migration.py:960 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/infrastructure_crud.py:741 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/infrastructure_crud.py:740 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Outbound HTTP to raw IP addresssrc/homelab_mcp/http_app.py:58 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
Privileged sudo commandsrc/homelab_mcp/infrastructure_crud.py:739 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/infrastructure_crud.py:738 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Outbound HTTP to raw IP addresssrc/homelab_mcp/http_app.py:57 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07CRITICAL
Pipe-to-shell patternsrc/homelab_mcp/service_templates/pihole.yaml:306 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06CRITICAL
Pipe-to-shell patternsrc/homelab_mcp/service_templates/ai_homelab_stack_ansible.yaml:64 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06HIGH
Access to sensitive file pathsCLAUDE.md:106 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/proxmox_scripts.py:324 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/prompt_registry.py:161 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_installer.py:327 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_installer.py:328 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/prompt_registry.py:162 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_installer.py:368 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Access to sensitive file pathssrc/homelab_mcp/service_installer.py:1279 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_installer.py:393 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_installer.py:424 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Access to sensitive file pathssrc/homelab_mcp/service_installer.py:62 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/ai_homelab_stack_ansible.yaml:58 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/ai_homelab_stack_ansible.yaml:355 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/ai_homelab_stack_ansible.yaml:361 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/ai_homelab_stack_ansible.yaml:57 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/jellyfin.yaml:160 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Destructive file system command detectedsrc/homelab_mcp/service_templates/docker_terraform.yaml:174 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/docker_terraform.yaml:69 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Destructive file system command detectedsrc/homelab_mcp/service_templates/docker_terraform.yaml:176 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/jellyfin.yaml:152 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/ollama.yaml:192 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/ollama.yaml:177 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/docker_terraform.yaml:72 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/docker_terraform.yaml:76 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/jellyfin.yaml:77 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/jellyfin.yaml:153 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/docker_terraform.yaml:73 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/jellyfin.yaml:154 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/docker_terraform.yaml:77 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Destructive file system command detectedsrc/homelab_mcp/service_templates/docker_terraform.yaml:175 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/ollama_ansible.yaml:251 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/ollama_ansible.yaml:38 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/ollama_ansible.yaml:37 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/service_templates/ollama_ansible.yaml:257 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05MEDIUM
Python subprocess execution detectedscripts/debug_integration_tests.py:22 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
File permission modification commandDockerfile:60 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
Destructive file system command detectedDockerfile:9 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05MEDIUM
Python subprocess execution detectedscripts/check_vscode_environment.py:64 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/ssh_tools.py:1114 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05MEDIUM
Python subprocess execution detectedscripts/debug_integration_tests.py:11 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/ssh_tools.py:1060 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05MEDIUM
Destructive file system command detectedDockerfile:32 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Authorization escalation languagesrc/homelab_mcp/service_templates/pihole.yaml:202 · Authorization escalation languageFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Privileged sudo commandsrc/homelab_mcp/ssh_tools.py:1057 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/ssh_tools.py:1117 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/tool_schemas/ssh_tools_schema.py:54 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Privileged sudo commandsrc/homelab_mcp/ssh_tools.py:1061 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05MEDIUM
Python subprocess execution detectedsrc/homelab_mcp/service_installer.py:38 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedscripts/run_tests.py:25 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
URL using raw IP addresssrc/homelab_mcp/http_app.py:57 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07MEDIUM
Process kill commandsrc/homelab_mcp/background_jobs.py:6 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05MEDIUM
File permission modification commandsrc/homelab_mcp/service_templates/jellyfin.yaml:77 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
File permission modification commandsrc/homelab_mcp/service_installer.py:958 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
URL using raw IP addresssrc/homelab_mcp/http_app.py:58 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07MEDIUM
File permission modification commandsrc/homelab_mcp/service_installer.py:1152 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
File permission modification commandsrc/homelab_mcp/service_installer.py:636 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
File permission modification commandsrc/homelab_mcp/service_templates/jellyfin.yaml:153 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
File permission modification commandsrc/homelab_mcp/service_templates/jellyfin.yaml:165 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
Remote installer piped to shellsrc/homelab_mcp/service_templates/ai_homelab_stack_ansible.yaml:64 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07MEDIUM
Remote installer piped to shellsrc/homelab_mcp/service_templates/pihole.yaml:306 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07MEDIUM
File permission modification commandsrc/homelab_mcp/service_templates/k3s.yaml:118 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05MEDIUM
File permission modification commandsrc/homelab_mcp/service_templates/k3s.yaml:105 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05What would make this Verified
15 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Unclaimed publisher≈ +8 on the totalClaim pypi: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
- Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim pypi