mcp-standards@0.1.0a2
CAUTION· static onlyPublisher claims: "Self-learning AI standards system - learns from corrections and auto-updates CLAUDE.md" Observed in sandbox: static analysis only — behavior not yet observed.
Registry PyPI (MCP server)Publisher airmcp-com · publishing for 395 daysInstalls 25Last detonated 5d ago
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Before you give it your token
- It will ask for
GEMINI_API_KEYConfiguration, not credentials: COST_OPTIMIZATION, DEFAULT_MODEL, FALLBACK_MODEL- Where it talks to
- no vendor host named in the codeAlso airmcp.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- nothing has run yet
- What we could not test
- everything: the server has not run yet
Run it before you trust it. Nothing has run yet: the code was read, the server was not. `vet-skills try` runs this exact version in the honeypot in about a minute.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-09 and scored it 53/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Access to sensitive file paths; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyt+CategoryObserved action
This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
MEDIUM
npx invocation of non-well-known package.claude/helpers/github-setup.sh:27 · npx invocation of non-well-known package — may execute untrusted code
AST06echo " - npx claude-flow pr enhance"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.claude/commands/hooks/setup.md:21 · npx invocation of non-well-known package — may execute untrusted code
AST06npx claude-flow hook session-end --summaryFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Destructive file system command detected.claude/settings.json:34 · Destructive file system command detected
AST05"Bash(rm -rf /)"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
npx invocation of non-well-known package.claude/helpers/github-setup.sh:26 · npx invocation of non-well-known package — may execute untrusted code
AST06echo " - npx claude-flow repo analyze"Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file paths.claude/commands/hooks/setup.md:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"file": ".env.production",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known package.claude/helpers/quick-start.sh:14 · npx invocation of non-well-known package — may execute untrusted code
AST06echo " npx claude-flow task orchestrate --task "Build REST API""Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.claude/helpers/quick-start.sh:8 · npx invocation of non-well-known package — may execute untrusted code
AST06echo " npx claude-flow swarm init --topology hierarchical"Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathssrc/mcp_standards/hooks/significance_scorer.py:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05".env": 0.7,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known package.claude/settings.json:12 · npx invocation of non-well-known package — may execute untrusted code
AST06"Bash(npx claude-flow:*)",Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.claude/commands/hooks/setup.md:7 · npx invocation of non-well-known package — may execute untrusted code
AST06npx claude-flow init --hooksFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.claude/helpers/github-setup.sh:28 · npx invocation of non-well-known package — may execute untrusted code
AST06echo " - npx claude-flow issue triage"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.claude/helpers/quick-start.sh:17 · npx invocation of non-well-known package — may execute untrusted code
AST06echo " npx claude-flow swarm monitor"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.claude/helpers/github-setup.sh:25 · npx invocation of non-well-known package — may execute untrusted code
AST06echo " - npx claude-flow github swarm"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.claude/commands/hooks/setup.md:36 · npx invocation of non-well-known package — may execute untrusted code
AST06"command": "npx claude-flow hook pre-write --file '${tool.params.file_path}'"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.claude/helpers/quick-start.sh:11 · npx invocation of non-well-known package — may execute untrusted code
AST06echo " npx claude-flow agent spawn --type coder --name "API Developer""Fix: Pin versions and sources; vendor anything fetched at install time.HIGH
Access to sensitive file pathssrc/mcp_standards/autolog.py:37 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05".env": 0.7,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
npx invocation of non-well-known package.claude/helpers/setup-mcp.sh:15 · npx invocation of non-well-known package — may execute untrusted code
AST06claude mcp add claude-flow npx claude-flow mcp startFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.claude/commands/hooks/setup.md:18 · npx invocation of non-well-known package — may execute untrusted code
AST06npx claude-flow hook pre-edit --file test.jsFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.claude/settings.json:44 · npx invocation of non-well-known package — may execute untrusted code
AST06"command": "cat | jq -r '.tool_input.command // empty' | tr '\\n' '\\0' | xargs -0 -I {} npx claude-flow@alpha hooks pre-command --command '{}' --validate-safety true --prepare-resources true"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.claude/commands/hooks/setup.md:75 · npx invocation of non-well-known package — may execute untrusted code
AST06npx claude-flow hook pre-edit --file app.js --debugFix: Pin versions and sources; vendor anything fetched at install time.LOW
Instructs the agent to modify its persistent memory or instruction filesdocs/INTEGRATION_GUIDE.md:122 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST014. **Auto-update triggered**: `./CLAUDE.md` updated automaticallyFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filessrc/mcp_standards/server.py:228 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01description="Update CLAUDE.md file with learned preferences (creates backup first)",Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filesdocs/INTEGRATION_GUIDE.md:52 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01✅ **Auto-Update CLAUDE.md**: Config files updated intelligentlyFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:340 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST014. **Update CLAUDE.md** when confidence scores are high (0.7+)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filesPKG-INFO:364 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST014. **Update CLAUDE.md** when confidence scores are high (0.7+)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filesdocs/guides/QUICKSTART.md:57 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01// → CLAUDE.md will updateFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Destructive file system command detectedtests/conftest.py:123 · Destructive file system command detected
AST05"command_injection": "; rm -rf /",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.LOW
Instructs the agent to modify its persistent memory or instruction filesPKG-INFO:382 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01User Correction → Pattern Extraction → Frequency Tracking → Confidence Scoring → Preference Promotion → CLAUDE.md UpdateFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Pipe-to-shell pattern.github/workflows/ci.yml:26 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:328 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST016. Run `suggest_claudemd_update()` → Get suggestion to add to CLAUDE.mdFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known package.claude/settings.json:53 · npx invocation of non-well-known package — may execute untrusted code
AST06…input.file_path // .tool_input.path // empty' | tr '\\n' '\\0' | xargs -0 -I {} npx claude-flow@alpha hooks pre-edit --file '{}' --auto-assign-agents true --load-context true" …Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known packageCLAUDE.md:61 · npx invocation of non-well-known package — may execute untrusted code
AST06- `npx claude-flow sparc batch <modes> "<task>"` - Parallel executionFix: Pin versions and sources; vendor anything fetched at install time.LOW
Instructs the agent to modify its persistent memory or instruction filessrc/mcp_standards/intelligence/claudemd_manager.py:238 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01Update CLAUDE.md file with learned preferencesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filesdocs/SELF-LEARNING-PRD.md:270 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01├─ Update CLAUDE.mdFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packageCLAUDE.md:55 · npx invocation of non-well-known package — may execute untrusted code
AST06- `npx claude-flow sparc modes` - List available modesFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
npx invocation of non-well-known package.claude/settings.json:64 · npx invocation of non-well-known package — may execute untrusted code
AST06"command": "cat | jq -r '.tool_input.command // empty' | tr '\\n' '\\0' | xargs -0 -I {} npx claude-flow@alpha hooks post-command --command '{}' --track-metrics true --store-results true"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Remote installer piped to shell.github/workflows/ci.yml:87 · Remote installer piped to shell
AST07curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
npx invocation of non-well-known packageCLAUDE.md:56 · npx invocation of non-well-known package — may execute untrusted code
AST06- `npx claude-flow sparc run <mode> "<task>"` - Execute specific modeFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Remote installer piped to shell.github/workflows/ci.yml:26 · Remote installer piped to shell
AST07curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
Instructs the agent to modify its persistent memory or instruction filessrc/mcp_standards/server.py:602 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01"""Update CLAUDE.md file with learned preferences"""Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filesPKG-INFO:352 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST016. Run `suggest_claudemd_update()` → Get suggestion to add to CLAUDE.mdFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Access to sensitive file pathstests/conftest.py:120 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"path_traversal": "../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
Instructs the agent to modify its persistent memory or instruction filesdocs/SELF-LEARNING-PRD.md:256 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01If pattern repeats 3+: Update CLAUDE.mdFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packageCLAUDE.md:57 · npx invocation of non-well-known package — may execute untrusted code
AST06- `npx claude-flow sparc tdd "<feature>"` - Run complete TDD workflowFix: Pin versions and sources; vendor anything fetched at install time.LOW
Instructs the agent to modify its persistent memory or instruction filesREADME.md:358 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01User Correction → Pattern Extraction → Frequency Tracking → Confidence Scoring → Preference Promotion → CLAUDE.md UpdateFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filessrc/mcp_standards/server.py:594 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01"message": f"Found {len(suggestions)} suggestion(s) for CLAUDE.md update"Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filessrc/mcp_standards/hooks/capture_hook.py:8 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST013. Update CLAUDE.md filesFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Pipe-to-shell pattern.github/workflows/ci.yml:87 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06curl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
Instructs the agent to modify its persistent memory or instruction filesdocs/CONFIG_STANDARDS.md:372 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01- Primary updates: Always update CLAUDE.mdFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known packageCLAUDE.md:58 · npx invocation of non-well-known package — may execute untrusted code
AST06- `npx claude-flow sparc info <mode>` - Get mode detailsFix: Pin versions and sources; vendor anything fetched at install time.LOW
Instructs the agent to modify its persistent memory or instruction filesdocs/INTEGRATION_GUIDE.md:549 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01**Before**: Manually edit CLAUDE.md after correctionsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
npx invocation of non-well-known package.claude/settings.json:73 · npx invocation of non-well-known package — may execute untrusted code
AST06"command": "cat | jq -r '.tool_input.file_path // .tool_input.path // empty' | tr '\\n' '\\0' | xargs -0 -I {} npx claude-flow@alpha hooks post-edit --file '{}' --format true --update-memory true"Fix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
Destructive command against a filesystem root or devicetests/conftest.py:123 · Destructive command against a filesystem root or device
AST05"command_injection": "; rm -rf /",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Instructions loaded
≈3,327 tok
2 files · 81 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for mcp-standards@0.1.0a2 as of 5d ago. This is the package itself, not its dependencies.
What would make this Verified
27 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Unclaimed publisher≈ +8 on the totalClaim airmcp-com: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
- Pipe-to-shell pattern≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Remote installer piped to shell≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim airmcp-comPropose a patch to the maintainer