Skills/PyPI/itu-mcp

itu-mcp@1.5.0

CAUTION· not started

Publisher claims: "MCP server for İTÜ Ninova, OBS, Portal, campus services and library: courses, grades, schedules, planning and more." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher yatuk · publishing for 134 daysInstalls 544Last detonated 28 min ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
NINOVA_HEALTHZ_AUTH_CACHE_SECONDSNINOVA_MAIL_PASSWORDNINOVA_PASSWORD or --check-auth / --forget-passwordConfiguration, not credentials: NINOVA_BASE_URL, NINOVA_COURSE_CACHE_TTL_SECONDS, NINOVA_DISABLE_PLAYWRIGHT_FALLBACK, NINOVA_ENV_FILE, NINOVA_HOCAMETRE_CACHE_TTL_SECONDS, NINOVA_ITU_PUBLIC_CACHE_TTL_SECONDS, NINOVA_MAIL_HOST, NINOVA_MAIL_PORT, NINOVA_MAIL_SENT_MAILBOX, NINOVA_MAIL_TIMEOUT_SECONDS, NINOVA_MAIL_USERNAME, NINOVA_MOODLE_CACHE_TTL_SECONDS, NINOVA_OBS_BASE_URL, NINOVA_OBS_JWT_TTL_SECONDS, NINOVA_POOL_CACHE_TTL_SECONDS, NINOVA_PUBLIC_BASE_URL, NINOVA_REMOTE_HOST, NINOVA_REMOTE_MCP_PATH, NINOVA_REMOTE_PORT, NINOVA_REQUEST_DELAY_MS, NINOVA_SESSION_MAX_AGE_SECONDS, NINOVA_SESSION_PERSIST, NINOVA_STATE_DIR, NINOVA_TRACKING_MAX_AGE_SECONDS, NINOVA_USERNAME
Where it talks to
no vendor host named in the codeAlso itu.edu.tr, notkutusu.com, claude.ai, claude.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names itu.edu.tr, notkutusu.com, claude.ai, claude.com as well as its own vendor. The guard injects NINOVA_HEALTHZ_AUTH_CACHE_SECONDS, NINOVA_MAIL_PASSWORD, NINOVA_PASSWORD only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx itu-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-15 and scored it 71/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathssrc/ninova_mcp/app_core.py:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import credentials_availableFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/cli_messages.py:86 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"or a .env file. The server uses those first, not the keychain.",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/app_base.py:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreplace names on it: ``load_ninova_env`` so no ``.env`` file is read, aFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/app_planning.py:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import credentials_availableFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Prompting user to enter sensitive credentialssrc/ninova_mcp/client.py:347 · Prompting user to enter sensitive credentials — social engineering# Never type the password into a page on any other host.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Access to sensitive file pathssrc/ninova_mcp/cli_messages.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"source_env_file": (".env dosyası", ".env file"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/cli_messages.py:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Dikkat: NINOVA_USERNAME / NINOVA_PASSWORD şu anda ortamda veya bir .env "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectionREADME.md:260 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileAyazağa'dan sonraki mekik 13:30.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/ninova_mcp/env.py:80 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Switches an auto-discovered ``.env`` may move in the stricter directionFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/env.py:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* An auto-discovered file: ``.env`` in the current working directory itself.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/toolsets.py:295 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesLoads ``.env`` first so the variables work from the same file as theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/remote.py:22 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .env import ignored_env_keys, load_ninova_envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectionREADME.md:292 · Prompt injection — known jailbreak technique reference · informational: not an instruction file- "Danışmanım kim, staj durumum ne?"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssrc/ninova_mcp/credentials.py:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .env import keys_loaded_from_fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/env.py:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Load ``NINOVA_*`` settings from a ``.env`` file.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/diagnostics.py:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import PASSWORD_ENV, USERNAME_ENV, credential_source, keychain_statusFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/server.py:46 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .env import load_ninova_envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/cli_setup.py:18 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import (Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandsrc/ninova_mcp/diagnostics.py:143 · File permission modification command — agent changes file ownership/permissionsf"chmod 700 {path}",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/env.py:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Keys an auto-discovered ``.env`` may set. None of them changes a host, aFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/toolsets.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .env import load_ninova_envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hidden zero-width characters detectedsrc/ninova_mcp/table_export.py:21 · Hidden zero-width characters detected — may conceal contentBOM = ""Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Access to sensitive file pathssrc/ninova_mcp/client.py:14 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import MISSING_CREDENTIALS_MESSAGE, resolve_credentialsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/cli_setup.py:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .env import load_ninova_envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/client.py:15 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .env import load_ninova_envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/diagnostics.py:236 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# An unreadable .env shows up as "no credentials" below.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/diagnostics.py:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .env import ignored_env_keys, load_ninova_envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandsrc/ninova_mcp/tracking.py:100 · Process kill command — agent can terminate processes# A write killed mid-flight (crash, kill -9) can leave a truncatedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/cli_messages.py:263 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Çalışma klasöründeki .env: yok sayılan anahtar yok",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/remote.py:412 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""A remote setting skipped in an auto-discovered .env must not pass silently."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/env.py:91 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Keys an auto-discovered ``.env`` may never set. Any ``NINOVA_*`` key that isFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/mail_client.py:483 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesfrom .credentials import resolve_credentialsFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/remote.py:420 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"These remote settings were found in the .env of the working directory "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/ninova_mcp/credentials.py:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files2. a ``.env`` file, which ``env.load_ninova_env`` has already copied into theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈63 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

9 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Prompting user to enter sensitive credentials≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim yatuk: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim yatukPropose a patch to the maintainer