Skills/PyPI/iflow-mcp-enkryptai-secure-mcp-gateway

iflow-mcp-enkryptai-secure-mcp-gateway@2.1.6

BLOCKED

Publisher claims: "Enkrypt Secure MCP Gateway" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher enkryptai · joined 0 days agoInstalls 17Last detonated 12 h ago
What would fix thisWatchDispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-02 and scored it 48/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: OS command execution function call detected; Prompt injection attempt; Destructive command against a filesystem root or device. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.1sprocessexited 1: ModuleNotFoundError: No module named 'setuptools'
0.3sprocessdependency install exit 1
0.3sprocessexec /usr/bin/timeout
0.3sprocessexec .venv/bin/secure-mcp-gateway
0.3sprocessexited 127: timeout: failed to run command '.venv/bin/secure-mcp-gateway': No such file or directory
0.3sclaimedno tools/list reply (exit 127)
0.4sprocessscript backend runs setup only

Static findings

CRITICAL
OS command execution function call detectedsrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:207 · OS command execution function call detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Prompt injection attemptREADME.md:2742 · Prompt injection attempt — 'ignore previous instructions'Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Destructive command against a filesystem root or devicesrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:34 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
OS command execution function call detectedsrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:141 · OS command execution function call detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
HTML comment carrying imperative instructions to the agentsrc/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:191 · HTML comment carrying imperative instructions to the agentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Destructive command against a filesystem root or devicesrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:35 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternsrc/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:326 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
HTML comment carrying imperative instructions to the agentREADME.md:40 · HTML comment carrying imperative instructions to the agentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
Destructive command against a filesystem root or devicesrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:107 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
HTML comment carrying imperative instructions to the agentREADME.md:52 · HTML comment carrying imperative instructions to the agentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
OS command execution function call detectedsrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:411 · OS command execution function call detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternsrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:38 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
document.cookie accesssrc/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:200 · document.cookie access — can steal session cookiesFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:420 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
HTML comment carrying imperative instructions to the agentsrc/secure_mcp_gateway/bad_mcps/prompt_injection_mcp.py:62 · HTML comment carrying imperative instructions to the agentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
CRITICAL
OS command execution function call detectedsrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:198 · OS command execution function call detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Outbound HTTP to raw IP addresssrc/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:418 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addresssrc/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:419 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
CRITICAL
Pipe-to-shell patternsrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:113 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:285 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:284 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe-to-shell patternsrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:63 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
OS command execution function call detectedsrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:281 · OS command execution function call detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or devicesrc/secure_mcp_gateway/bad_mcps/prompt_injection_mcp.py:133 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe-to-shell patternsrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:414 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
CRITICAL
Pipe-to-shell patternsrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:73 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Destructive file system command detectedsrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:34 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
OS command execution function call detectedsrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:122 · OS command execution function call detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Pipe to network utilitysrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:40 · Pipe to network utility — potential reverse shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
Pipe-to-shell patternsrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:206 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
AWS access key pattern detectedsrc/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py:36 · AWS access key pattern detected — possible hardcoded or harvested keyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedsrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:107 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py:111 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/path_traversal_mcp.py:26 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
GitHub token pattern detectedsrc/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py:41 · GitHub token pattern detected — possible hardcoded or harvested tokenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Stripe-like API key pattern detectedsrc/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py:225 · Stripe-like API key pattern detected — possible hardcoded or harvested keyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Destructive file system command detectedsrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:35 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Stripe-like API key pattern detectedsrc/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py:39 · Stripe-like API key pattern detected — possible hardcoded or harvested keyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py:106 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Stripe-like API key pattern detectedsrc/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py:147 · Stripe-like API key pattern detected — possible hardcoded or harvested keyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Stripe-like API key pattern detectedsrc/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py:226 · Stripe-like API key pattern detected — possible hardcoded or harvested keyFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Slack webhook URLsrc/secure_mcp_gateway/bad_mcps/credential_theft_mcp.py:114 · Slack webhook URL — data will be sent to SlackFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:108 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:59 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
AWS access key pattern detectedsrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:99 · AWS access key pattern detected — possible hardcoded or harvested keyFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
HIGH
Destructive file system command detectedsrc/secure_mcp_gateway/bad_mcps/prompt_injection_mcp.py:133 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
document.cookie accesssrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:87 · document.cookie access — can steal session cookiesFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/path_traversal_mcp.py:207 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:186 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:47 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Stripe-like API key pattern detectedsrc/secure_mcp_gateway/bad_mcps/session_management_mcp.py:138 · Stripe-like API key pattern detected — possible hardcoded or harvested keyFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:189 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hex-encoded URLsrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:64 · Hex-encoded URL — attempt to bypass URL filteringFix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/path_traversal_mcp.py:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/path_traversal_mcp.py:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/path_traversal_mcp.py:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
AWS access key pattern detectedsrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:422 · AWS access key pattern detected — possible hardcoded or harvested keyFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Outbound HTTP to raw IP addresssrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:50 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addresssrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:37 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addresssrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:49 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addresssrc/secure_mcp_gateway/openapi.json:14 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/plugins/guardrails/enkrypt_provider.py:704 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/secure_mcp_gateway/plugins/auth/local_apikey_provider.py:51 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Stripe-like API key pattern detectedsrc/secure_mcp_gateway/bad_mcps/unauthenticated_access_mcp.py:43 · Stripe-like API key pattern detected — possible hardcoded or harvested keyFix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
HIGH
Outbound HTTP to raw IP addresssrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:82 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Auto-update or dynamic fetch configurationsrc/secure_mcp_gateway/plugins/auth/enkrypt_provider.py:51 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Outbound HTTP to raw IP addresssrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:62 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/bad_mcps/unauthenticated_access_mcp.py:241 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/secure_mcp_gateway/plugins/auth/local_apikey_provider.py:46 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationsrc/secure_mcp_gateway/plugins/auth/enkrypt_provider.py:46 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:106 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/secure_mcp_gateway/utils.py:202 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
URL using raw IP addresssrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:62 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Remote installer piped to shellsrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:38 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Remote installer piped to shellsrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:113 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Outbound HTTP to raw IP addresssrc/secure_mcp_gateway/services/oauth/models.py:257 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addresssrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:49 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Remote installer piped to shellsrc/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:326 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Access to sensitive file pathssrc/secure_mcp_gateway/plugins/guardrails/enkrypt_provider.py:761 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:74 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:327 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
URL using raw IP addresssrc/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:418 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addresssrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:37 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Remote installer piped to shellsrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:206 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Python subprocess execution detectedsrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:140 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using raw IP addresssrc/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:419 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Remote installer piped to shellsrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:414 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Auto-update or dynamic fetch configurationsrc/secure_mcp_gateway/plugins/plugin_loader.py:148 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/secure_mcp_gateway/bad_mcps/bad_output_mcp.py:328 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
URL using raw IP addresssrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:50 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedsrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:222 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/secure_mcp_gateway/bad_mcps/command_injection_mcp.py:39 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellsrc/secure_mcp_gateway/bad_mcps/rce_mcp.py:63 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
URL using raw IP addresssrc/secure_mcp_gateway/bad_mcps/ssrf_mcp.py:82 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
URL using raw IP addresssrc/secure_mcp_gateway/openapi.json:14 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
npx invocation of non-well-known packagesrc/secure_mcp_gateway/services/oauth/integration.py:186 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/secure_mcp_gateway/cli.py:3646 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/secure_mcp_gateway/services/oauth/integration.py:156 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
URL using raw IP addresssrc/secure_mcp_gateway/services/oauth/models.py:257 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

What would make this Verified

32 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Text that tells the agent to ignore its instructions≈ +9 on the totalDelete phrases like "ignore previous instructions", "override", "bypass" from SKILL.md and tool descriptions. Describe what the skill does; do not instruct the agent about other rules.
  2. OS command execution function call detected≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  5. Pipe to network utility≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. Unclaimed publisher≈ +8 on the totalClaim enkryptai: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim enkryptai