Skills/PyPI/mseep-mcp-zammad

mseep-mcp-zammad@0.1.6

CAUTION· not started

Publisher claims: "Model Context Protocol server for Zammad ticket system integration (unofficial)" Observed in sandbox: calls astral.sh only, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher mseep-support · publishing for 578 daysInstalls 18Last detonated 2d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ZAMMAD_HTTP_TOKENZAMMAD_OAUTH2_TOKENZAMMAD_PASSWORDZAMMAD_TOKENConfiguration, not credentials: ZAMMAD_URL, ZAMMAD_USERNAME
Where it talks to
no vendor host named in the codeAlso astral.sh, zammad.com, githubusercontent.com, gierens.de, schemastore.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · reached only astral.sh
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names astral.sh, zammad.com, githubusercontent.com, gierens.de, schemastore.org as well as its own vendor. The guard injects ZAMMAD_HTTP_TOKEN, ZAMMAD_OAUTH2_TOKEN, ZAMMAD_PASSWORD, ZAMMAD_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mseep-mcp-zammad

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-12 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Hidden zero-width characters detected; Pipe-to-shell pattern; Access to sensitive file paths. Summary: calls astral.sh only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 3 scenarios
t+CategoryObserved action
0.0sprocessexited 127: ./scripts/bootstrap.sh: line 24: sudo: command not found
0.1snetworkCONNECT tcp://astral.sh:443 · not in the allow-list, refused
0.1sprocessexec /usr/bin/curl
0.1sprocessexited 22: curl: (22) The requested URL returned error: 403
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.3sprocessscript backend runs setup only
0.3sprocesssecond launch, clock +45 days, CI unset
0.3sprocessexited 127: ./scripts/bootstrap.sh: line 24: sudo: command not found
0.4snetworkCONNECT tcp://astral.sh:443 · not in the allow-list, refused
0.4sprocessexec /usr/bin/curl
0.4sprocessexited 22: curl: (22) The requested URL returned error: 403

Static findings

HIGH
Hidden zero-width characters detected.coderabbit.yaml:34 · Hidden zero-width characters detected — may conceal content- label: "👨‍🚀 crew-backend"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
CRITICAL
Pipe-to-shell patternscripts/setup.sh:11 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file pathsmcp_zammad/server.py:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Load environment variables from .env filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths.claude/hooks/pre_tool_use.py:77 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif ".env" in file_path and not file_path.endswith(".env.sample"):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsCLAUDE.md:201 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesThe server automatically loads environment variables from the `.env` file in the project directory using `python-dotenv`.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe-to-shell patternscripts/uv/dev-setup.py:189 · Pipe-to-shell pattern — downloads and immediately executes remote codecmd = "curl -LsSf https://astral.sh/uv/install.sh | sh"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
HIGH
Access to sensitive file paths.claude/hooks/pre_tool_use.py:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files1. Prevent dangerous operations (rm -rf, .env access)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths.claude/hooks/pre_tool_use.py:71 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesCheck if any tool is trying to access .env files containing sensitive data.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_zammad/server.py:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescwd_env = Path.cwd() / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file paths.claude/hooks/pre_tool_use.py:80 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Check bash commands for .env file accessFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_zammad/server.py:79 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Then, try to load from .envrc if it exists and convert to .env formatFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_zammad/server.py:84 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Found .envrc but environment variables not loaded. Consider using direnv or creating a .env file"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationrenovate.json:81 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"description": "Auto-update GitHub Actions digests",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Destructive file system command detectedscripts/bootstrap.sh:34 · Destructive file system command detected[ -f "/etc/apt/keyrings/gierens.gpg" ] && sudo rm -f /etc/apt/keyrings/gierens.gpgFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/uv/dev-setup.py:364 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandDockerfile:50 · File permission modification command — agent changes file ownership/permissionsRUN chown -R appuser:appuser /appFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Remote installer piped to shellscripts/uv/dev-setup.py:189 · Remote installer piped to shellcmd = "curl -LsSf https://astral.sh/uv/install.sh | sh"Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
HIGH
Access to sensitive file pathsscripts/setup.sh:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif [ ! -f .env ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/bootstrap.sh:31 · Privileged sudo command — agent may execute with elevated privilegessudo mkdir -p /etc/apt/keyringsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/uv/dev-setup.py:271 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Check for existing .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/setup.sh:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp .env.example .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/uv/validate-env.py:96 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdefault_env = Path(".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/setup.sh:34 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesecho "Creating .env file from template..."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/uv/test-zammad.py:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesself.env_file = env_file or Path(".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/uv/dev-setup.py:205 · Python subprocess execution detectedsubprocess.run(cmd, shell=True, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/uv/validate-env.py:251 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileshelp="Path to environment file (default: .env)",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/uv/dev-setup.py:268 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Configure .env file interactively."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/uv/validate-env.py:23 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files./validate-env.py # Interactive mode with .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/uv/test-zammad.py:544 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"--env-file", type=click.Path(exists=False, path_type=Path), help="Path to environment file (default: .env)"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/bootstrap.sh:108 · File permission modification command — agent changes file ownership/permissionssudo chmod 644 /etc/apt/keyrings/gierens.gpg /etc/apt/sources.list.d/gierens.listFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathsscripts/uv/dev-setup.py:55 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesself.env_example = self.project_root / ".env.example"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandDockerfile:86 · File permission modification command — agent changes file ownership/permissionschown -R appuser:appuser /appFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commandscripts/bootstrap.sh:25 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get install -y $missing_toolsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/uv/validate-env.py:276 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_source = str(env_file) if env_file else ".env or system environment"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/bootstrap.sh:24 · Privileged sudo command — agent may execute with elevated privilegessudo apt-get updateFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file paths.github/copilot-instructions.md:106 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- Set Zammad credentials in `.env` fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/uv/dev-setup.py:190 · Python subprocess execution detectedsubprocess.run(cmd, shell=True, check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandscripts/bootstrap.sh:106 · Privileged sudo command — agent may execute with elevated privilegessudo gpg --dearmor < "$tmp_key" -o /etc/apt/keyrings/gierens.gpgFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/uv/dev-setup.py:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- Interactive .env configurationFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/uv/validate-env.py:95 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Try to load .env from current directoryFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/setup.sh:32 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Copy .env.example if .env doesn't existFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Remote installer piped to shellscripts/setup.sh:11 · Remote installer piped to shellcurl -LsSf https://astral.sh/uv/install.sh | shFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST07
MEDIUM
Python subprocess execution detectedscripts/uv/dev-setup.py:249 · Python subprocess execution detectedsubprocess.run(["uv", "venv"], check=True, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/uv/dev-setup.py:154 · Python subprocess execution detectedresult = subprocess.run(["uv", "--version"], capture_output=True, text=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsscripts/uv/dev-setup.py:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesself.env_file = self.project_root / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandscripts/bootstrap.sh:34 · Privileged sudo command — agent may execute with elevated privileges[ -f "/etc/apt/keyrings/gierens.gpg" ] && sudo rm -f /etc/apt/keyrings/gierens.gpgFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/uv/security-scan.py:274 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesdocs/ai-docs/cc_slash_commands.md:21 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file| `/memory` | Edit CLAUDE.md memory files |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesdocs/ai-docs/cc_common_workflows.md:373 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file* @ file references add CLAUDE.md in the file's directory and parent directories to contextFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Access to sensitive file pathstests/test_server.py:1090 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswith tempfile.NamedTemporaryFile(mode="w", suffix=".env", delete=False) as f:Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresstests/test_client.py:100 · URL to a private-network address — a LAN or development targetwith patch.dict(os.environ, {"ZAMMAD_URL": "http://192.168.1.100", "ZAMMAD_HTTP_TOKEN": "token"}, clear=True):Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Python subprocess execution detectedscripts/uv/security-scan.py:233 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_server.py:1089 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Create a temp .env fileFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/uv/security-scan.py:154 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_server.py:1144 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Found .envrc but environment variables not loaded. Consider using direnv or creating a .env file"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_server.py:1086 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Test initialize with .env file."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction files.github/copilot-instructions.md:64 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file1. Update CLAUDE.md for AI-specific guidanceFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈4,078 tok
3 files · 76 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mseep-mcp-zammad@0.1.6 as of 2d ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim mseep-support: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim mseep-supportPropose a patch to the maintainer