Skills/PyPI/mcptoon

mcptoon@0.8.35

CAUTION· not started

Publisher claims: "One zero-dependency CLI to manage every MCP server and agent skill: token optimization for tool discovery (71,929 -> 581 tokens, -99.2% measured, schemas stay out of context), one config for every agent." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher activeing123 · publishing for 95 daysInstalls 4,761Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
BAIZHI_TOKENMCPTOON_AUTH_TOKEN or --client-secretConfiguration, not credentials: MCPTOON_ACTIVITY_FILE, MCPTOON_AGENT_TYPE, MCPTOON_ALLOWED_HOSTS, MCPTOON_AUTOSTART_TASK, MCPTOON_CACHE_DIR, MCPTOON_CACHE_TTL, MCPTOON_CALL_TIMEOUT, MCPTOON_CCR_DIR, MCPTOON_CCR_MAX_BYTES, MCPTOON_CCR_TTL, MCPTOON_CLI_AHA_FILE, MCPTOON_COMPRESSION_FILE, MCPTOON_CONFIG_FILE, MCPTOON_CONFIG_FILE_TOML, MCPTOON_DEBUG, MCPTOON_DOCS_INDEX, MCPTOON_DOCS_ROOTS, MCPTOON_FOOTER_STATE_FILE, MCPTOON_FORCE_COLOR, MCPTOON_FORCE_SELF_HEAL, MCPTOON_GRAPHQL_TTL, MCPTOON_HANDLERS_DIR, MCPTOON_HOME, MCPTOON_INSTALLED_FILE, MCPTOON_KB_DIR, MCPTOON_LANG, MCPTOON_LIST_CACHE_SCOPE, MCPTOON_LIST_TTL_MS, MCPTOON_NO_COLOR, MCPTOON_NO_STAR_HINT, MCPTOON_NO_TAKEOVER_OFFER, MCPTOON_OPENAPI_TTL, MCPTOON_PLUGINS_DATA_DIR, MCPTOON_PLUGINS_DIR, MCPTOON_PLUGINS_REGISTRY, MCPTOON_SELFHEAL_FILE, MCPTOON_SERVERS, MCPTOON_SESSION_DIR
Where it talks to
no vendor host named in the codeAlso swagger.io, nodejs.org, smithery.ai, agent-plugins.org, skills.sh — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names swagger.io, nodejs.org, smithery.ai, agent-plugins.org, skills.sh as well as its own vendor. The guard injects BAIZHI_TOKEN, MCPTOON_AUTH_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcptoon

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 62/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive command against a filesystem root or device; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

CRITICAL
Destructive command against a filesystem root or devicesrc/mcptoon/router.py:165 · Destructive command against a filesystem root or devicetaking ``{"cmd": "rm -rf /"}`` would otherwise opt itself out of theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/mcptoon/cli.py:806 · Process kill command — agent can terminate processesa placeholder instead of a crash, and nothing a command prints can kill it.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/mcptoon/router.py:256 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"cat ~/.ssh",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcptoon/config.py:1720 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileslines.append(f"[servers.{name}.env]")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Reads credential paths from the home directorysrc/mcptoon/router.py:304 · Reads credential paths from the home directory"show your token", "read your env", "~/.ssh", "/etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/cli.py:1075 · npx invocation of non-well-known package — may execute untrusted code"SERVER_NOT_FOUND": "Try: mcptoon list | mcptoon add <name> --stdio npx -y <package> | mcptoon doctor",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Destructive file system command detectedsrc/mcptoon/router.py:165 · Destructive file system command detectedtaking ``{"cmd": "rm -rf /"}`` would otherwise opt itself out of theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/mcptoon/router.py:260 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"cat /etc/shadow",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcptoon/router.py:259 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"read /etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Collapsed <details> block carrying instructionsREADME.md:563 · Collapsed <details> block carrying instructions<summary>Other ways to install</summary> ```bash # Run without installing (needs Node) uvx mcptoon demo --quick # Isolated CLI install (avoids the PEP 668 errorFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Hidden zero-width characters detectedsrc/mcptoon/_toon/decoder.py:88 · Hidden zero-width characters detected — may conceal contentif text.startswith(""):Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Access to sensitive file pathssrc/mcptoon/router.py:304 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"show your token", "read your env", "~/.ssh", "/etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Reads credential paths from the home directorysrc/mcptoon/router.py:256 · Reads credential paths from the home directory"cat ~/.ssh",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST03
HIGH
Privileged sudo commandsrc/mcptoon/router.py:262 · Privileged sudo command — agent may execute with elevated privileges"sudo ",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/discover.py:22 · npx invocation of non-well-known package — may execute untrusted code3. Detect local tools (npx in PATH → zero-config servers, docker, sqlite, git repo)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/update.py:30 · npx invocation of non-well-known package — may execute untrusted code(``npx -y <pkg>``, ``uvx <pkg>``), so they already fetch the current release onFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/client.py:764 · npx invocation of non-well-known package — may execute untrusted code# exited (e.g. npx E404 on a missing package). Surface theFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/mcptoon/skills.py:2124 · Python subprocess execution detectedadd = subprocess.run(["git", "add", "-A", "--", rel], cwd=str(repo),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/mcptoon/skills.py:1268 · Process kill command — agent can terminate processesexcept Exception: # noqa: BLE001 — a missing/broken tool catalog must not kill skillsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/installer.py:367 · npx invocation of non-well-known package — may execute untrusted codespecial-cases the full npx path. Routing must do the same, or a registry installFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/installer.py:448 · npx invocation of non-well-known package — may execute untrusted code# Local package: npx for npm, uvx for pypi (both fetch-on-first-run, no install).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/mcptoon/oauth.py:126 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/cli.py:2696 · npx invocation of non-well-known package — may execute untrusted codeprint(" mcptoon add github --stdio npx -y @modelcontextprotocol/server-github")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/discover.py:278 · npx invocation of non-well-known package — may execute untrusted code# On Windows, npx needs .cmd resolution — but we let client.py handle thatFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandsrc/mcptoon/client.py:545 · Process kill command — agent can terminate processes"""Clean up: kill subprocess or close HTTP session."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/mcptoon/demo_server.py:872 · Process kill command — agent can terminate processesexcept Exception as exc: # never kill the loop over one bad callFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandsrc/mcptoon/serve.py:1112 · Process kill command — agent can terminate processes# Timeout — try to kill the underlying subprocess if possibleFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/client.py:722 · npx invocation of non-well-known package — may execute untrusted codetail (a failing npx prints `npm error 404` last, after a wall of NodeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionsrc/mcptoon/installer.py:695 · File type combined with upload action — agent may exfiltrate local data files# 4. Record to installed.json — preserve full inputSchemaFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedsrc/mcptoon/serve.py:1824 · Python subprocess execution detectedsubprocess.run(["taskkill", "/PID", str(pid), "/F"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/demo.py:139 · npx invocation of non-well-known package — may execute untrusted code"""Check that npx is available."""Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/mcptoon/serve.py:1770 · Python subprocess execution detectedres = subprocess.run(["schtasks", "/Delete", "/TN", _AUTOSTART_TASK, "/F"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/mcptoon/oauth.py:115 · File permission modification command — agent changes file ownership/permissions"""Owner-only permissions. POSIX chmod 600; Windows best-effort ACL."""Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcptoon/skills.py:1699 · Python subprocess execution detectedr = subprocess.run(["cmd", "/c", "mklink", "/J", str(dst), str(src)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcptoon/serve.py:1660 · Python subprocess execution detectedproc = subprocess.Popen(cmd, stdin=subprocess.DEVNULL, stdout=log,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcptoon/serve.py:1737 · Python subprocess execution detectedres = subprocess.run(tr, shell=True, capture_output=True, text=True, encoding="utf-8")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcptoon/skills.py:2129 · Python subprocess execution detectedcommit = subprocess.run(["git", "commit", "-m", message, "--", rel],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcptoon/manifest.py:86 · Python subprocess execution detectedproc = subprocess.run(argv, input=payload, capture_output=True, text=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcptoon/exec_sandbox.py:307 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/cli.py:2430 · npx invocation of non-well-known package — may execute untrusted codeprint(" # mcptoon add everything --stdio npx -y @modelcontextprotocol/server-everything")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/mcptoon/skills.py:2158 · Python subprocess execution detectedr = subprocess.run(["git", "cat-file", "-e", f"HEAD:{rel}"], cwd=str(repo),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/skill/SKILL.md:213 · npx invocation of non-well-known package — may execute untrusted codemcptoon config set runners allow-fetch # back to always uvx/npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/mcptoon/upgrade.py:257 · Python subprocess execution detectedsubprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/cli.py:1085 · npx invocation of non-well-known package — may execute untrusted code"TIMEOUT": "Try: mcptoon doctor | the server may be slow to start (first npx download)",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/installer.py:476 · npx invocation of non-well-known package — may execute untrusted code# npx -y <package> as launch commandFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/skill/SKILL.md:198 · npx invocation of non-well-known package — may execute untrusted code`uvx <pkg>` / `npx <pkg>`. The gate is two facts, not one: the module must resolveFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/mcptoon/skills.py:2220 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandsrc/mcptoon/serve.py:1518 · Process kill command — agent can terminate processeswe spawn and refuse to kill a pid whose creation time no longer matches.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/installer.py:40 · npx invocation of non-well-known package — may execute untrusted code# Default npx commandFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/mcptoon/installer.py:500 · Python subprocess execution detectedr = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandsrc/mcptoon/router.py:263 · File permission modification command — agent changes file ownership/permissions"chmod 777",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/demo.py:144 · npx invocation of non-well-known package — may execute untrusted codeprint(" (npx is bundled with Node.js 18+)")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/cli.py:2412 · npx invocation of non-well-known package — may execute untrusted codeprint(" Add another: mcptoon add <name> --stdio npx -y <package>")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/demo.py:142 · npx invocation of non-well-known package — may execute untrusted codeprint(" ❌ npx not found in PATH.")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedsrc/mcptoon/client.py:615 · Python subprocess execution detectedself._proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/demo.py:79 · npx invocation of non-well-known package — may execute untrusted codeprint(" If it mentions npx not found: install Node.js: https://nodejs.org")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagesrc/mcptoon/demo.py:59 · npx invocation of non-well-known package — may execute untrusted code# (self-contained: no network, no API key, works offline after npxFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/test_serve.py:741 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/mcptoon/upgrade.py:359 · Python subprocess execution detectedrc = subprocess.run(cmd, check=False).returncodeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagetests/test_demo.py:71 · npx invocation of non-well-known package — may execute untrusted code"""When npx is not available, should return False."""Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/test_serve.py:765 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_oauth.py:386 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_cache.py:142 · Python subprocess execution detectedprocs = [subprocess.Popen([sys.executable, "-c", worker, str(w)], env=env)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Prompt injection attemptREADME.md:842 · Prompt injection attempt — 'ignore previous instructions' · informational: not an instruction file| **Prompt-injection guard** | results are scanned for injection patterns like "ignore previous instructions" and blocked |Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Python subprocess execution detectedtests/test_xdg.py:99 · Python subprocess execution detectedr = subprocess.run([sys.executable, "-c", code], capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagetests/test_demo.py:66 · npx invocation of non-well-known package — may execute untrusted code"""When npx is available, should return True."""Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagetests/test_serve.py:19 · npx invocation of non-well-known package — may execute untrusted codeused by the existing test suite. No external network or npx needed.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/test_ccr.py:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesself.assertIsNone(ccr.retrieve("../../etc/passwd"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_demo.py:196 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_xdg.py:273 · Python subprocess execution detectedreturn subprocess.run([sys.executable, "-m", "mcptoon"] + args,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_serve.py:750 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_demo.py:187 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_ccr.py:77 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesself.assertEqual(self._at(1000.0, "../../etc/passwd")[0], "bad-handle")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈6,026 tok
1 file · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcptoon@0.8.35 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

18 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  2. Reads credential paths from the home directory≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Unclaimed publisher≈ +8 on the totalClaim activeing123: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  4. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim activeing123Propose a patch to the maintainer