local-delegate-mcp@0.45.1
CAUTIONPublisher claims: "Delegate mechanical text tasks to a local OpenAI-compatible LLM endpoint to conserve Claude subscription quota." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher zahirinatzuke · joined 5 days agoInstalls 1,639Last detonated 5d ago
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-29 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Instructs the agent to modify its persistent memory or instruction files; Instructs the agent to modify its persistent memory or instruction files. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
Static findings
HIGH
Destructive file system command detectedsrc/local_delegate/web/metrics.py:2247 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Instructs the agent to modify its persistent memory or instruction filessrc/local_delegate/install.py:3334 · Instructs the agent to modify its persistent memory or instruction filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Instructs the agent to modify its persistent memory or instruction filessrc/local_delegate/install.py:2943 · Instructs the agent to modify its persistent memory or instruction filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
URL with embedded credentialssrc/local_delegate/web/metrics.py:1319 · URL with embedded credentials — may be phishing or credential leakingFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07HIGH
Outbound HTTP to raw IP addresssrc/local_delegate/install.py:1726 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
Hidden zero-width characters detectedsrc/local_delegate/install.py:296 · Hidden zero-width characters detected — may conceal contentFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07CRITICAL
Prompt injectionREADME.md:120 · Prompt injection — known jailbreak technique referenceFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01HIGH
Instructs the agent to modify its persistent memory or instruction filessrc/local_delegate/install.py:3336 · Instructs the agent to modify its persistent memory or instruction filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01HIGH
Destructive file system command detectedsrc/local_delegate/web/metrics.py:2696 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Outbound HTTP to raw IP addresssrc/local_delegate/config.py:80 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07HIGH
Instructs the agent to modify its persistent memory or instruction filessrc/local_delegate/install.py:2945 · Instructs the agent to modify its persistent memory or instruction filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01MEDIUM
Python subprocess execution detectedsrc/local_delegate/benchmark.py:226 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05HIGH
Destructive file system command detectedsrc/local_delegate/web/metrics.py:3009 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Destructive file system command detectedsrc/local_delegate/web/metrics.py:2778 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05HIGH
Instructs the agent to modify its persistent memory or instruction filessrc/local_delegate/install.py:2950 · Instructs the agent to modify its persistent memory or instruction filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01MEDIUM
URL using raw IP addresssrc/local_delegate/config.py:80 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07MEDIUM
Python subprocess execution detectedsrc/local_delegate/autostart.py:117 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/local_delegate/claude_plugin.py:63 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05HIGH
Access to sensitive file pathssrc/local_delegate/install.py:1660 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
URL using raw IP addresssrc/local_delegate/install.py:1726 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07MEDIUM
Python subprocess execution detectedsrc/local_delegate/keychain.py:67 · Python subprocess execution detectedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05MEDIUM
Python subprocess execution detectedsrc/local_delegate/install.py:3206 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/local_delegate/server.py:6643 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/local_delegate/update.py:1024 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/local_delegate/web/sysinfo.py:116 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/local_delegate/install.py:3065 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
File type combined with upload actionsrc/local_delegate/resources/i18n/en/cli.json:508 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
Python subprocess execution detectedsrc/local_delegate/update.py:97 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/local_delegate/web/sysinfo.py:354 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/local_delegate/web/sysinfo.py:81 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/local_delegate/web/sysinfo.py:207 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
File type combined with upload actionsrc/local_delegate/resources/i18n/en/cli.json:149 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07MEDIUM
Python subprocess execution detectedsrc/local_delegate/install.py:3071 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/local_delegate/probes.py:74 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/local_delegate/shell_profiles.py:206 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
Python subprocess execution detectedsrc/local_delegate/install.py:3526 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05MEDIUM
npx invocation of non-well-known packagesrc/local_delegate/desktop_bridge.py:5 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
Python subprocess execution detectedsrc/local_delegate/web/sysinfo.py:321 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim zahirinatzuke: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- URL with embedded credentials≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Outbound HTTP to raw IP address≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
- Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim zahirinatzuke