Is ninja-mcp@1.8.2 safe to install?

ninja-mcp@1.8.2

CAUTION

Publisher claims: "Multi-module MCP server: Coder, Researcher, Secretary" Observed in sandbox: calls astral.sh only, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher ninja-mcp-contributors · joined 4 days agoInstalls 2,127Last detonated 2 h ago

What would fix this Watch Dispute verdict

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-05 and scored it 65/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Privileged sudo command; Destructive file system command detected; Destructive command against a filesystem root or device. Summary: calls astral.sh only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios

t+CategoryObserved action

0.1snetworkCONNECT https://astral.sh · undeclared

0.1sprocessexec /usr/bin/dirname

0.1sprocessexec /usr/bin/cut

0.1sprocessexec /usr/bin/curl

0.1sprocessexited 22: curl: (22) The requested URL returned error: 403

0.1sprocessscript backend runs setup only

Static findings

HIGH

Privileged sudo commandscripts/packaging/build-deb.sh:176 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Destructive file system command detectedscripts/packaging/build-deb.sh:98 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

CRITICAL

Destructive command against a filesystem root or devicesrc/ninja_agent/runner.py:83 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

CRITICAL

Pipe-to-shell patternscripts/install.sh:69 · Pipe-to-shell pattern — downloads and immediately executes remote codeFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST06

HIGH

Privileged sudo commandscripts/packaging/build-deb.sh:175 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

CRITICAL

Destructive command against a filesystem root or devicesrc/ninja_agent/runner.py:82 · Destructive command against a filesystem root or deviceFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Privileged sudo commandscripts/packaging/build-deb.sh:185 · Privileged sudo command — agent may execute with elevated privilegesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/daemon.py:179 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/safety.py:150 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/worktree.py:755 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

File permission modification commandscripts/fix_config.sh:130 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/safety.py:63 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/worktree.py:644 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/e2e_live.py:36 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

Access to sensitive file pathsscripts/smoke_test.sh:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Destructive file system command detectedsrc/ninja_agent/runner.py:83 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Outbound HTTP to raw IP addressscripts/stdio_proxy.py:25 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

HIGH

Access to sensitive file pathssrc/ninja_config/modern_tui.py:1140 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Outbound HTTP to raw IP addresssrc/ninja_common/daemon.py:993 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Process kill commandsrc/ninja_coder/driver.py:2108 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedscripts/e2e_live.py:42 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/worktree.py:660 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/driver.py:2816 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/benchmark_prompts.py:24 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/safety.py:201 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

Access to sensitive file pathsscripts/release.sh:241 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Outbound HTTP to raw IP addresssrc/ninja_common/daemon.py:655 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

HIGH

Access to sensitive file pathsscripts/run_server_stdio.sh:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Remote installer piped to shellscripts/install.sh:69 · Remote installer piped to shellFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST07

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/driver.py:2819 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

File permission modification commandscripts/install.sh:112 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

HIGH

Outbound HTTP to raw IP addresssrc/ninja_common/daemon.py:665 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

File permission modification commandscripts/packaging/build-deb.sh:103 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

MEDIUM

Python subprocess execution detectedscripts/e2e_live.py:37 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

Destructive file system command detectedsrc/ninja_agent/runner.py:82 · Destructive file system command detectedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

File permission modification commandscripts/packaging/build-deb.sh:87 · File permission modification command — agent changes file ownership/permissionsFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.

AST05

HIGH

Outbound HTTP to raw IP addresssrc/ninja_common/daemon.py:30 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

HIGH

Auto-update or dynamic fetch configurationsrc/ninja_common/config_cli.py:596 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/driver.py:2818 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

Access to sensitive file pathsscripts/release.sh:242 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Process kill commandscripts/restart_mcp.sh:40 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedscripts/e2e_live.py:40 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/worktree.py:281 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/driver.py:1257 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/safety.py:127 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/worktree.py:636 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

HIGH

Access to sensitive file pathsscripts/release.sh:244 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/release.sh:21 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Process kill commandsrc/ninja_coder/driver.py:1440 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_agent/runner.py:821 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedscripts/e2e_live.py:41 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Process kill commandscripts/restart_mcp.sh:97 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

URL using raw IP addressscripts/stdio_proxy.py:25 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedsrc/ninja_coder/safety.py:55 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/hooks_base.py:82 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/daemon.py:405 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/hooks_base.py:156 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/config_cli.py:659 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/config_cli.py:332 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/config_cli.py:652 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_config/ui/base.py:101 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using raw IP addresssrc/ninja_common/daemon.py:30 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Process kill commandsrc/ninja_common/daemon.py:624 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_config/ui/settings.py:255 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using raw IP addresssrc/ninja_common/daemon.py:655 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedsrc/ninja_config/ui/settings.py:248 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_common/daemon.py:419 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_config/credentials.py:227 · Python subprocess execution detectedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_config/modern_tui.py:1357 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

Process kill commandsrc/ninja_common/daemon.py:145 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Process kill commandsrc/ninja_common/daemon.py:445 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Process kill commandsrc/ninja_common/daemon.py:458 · Process kill command — agent can terminate processesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Python subprocess execution detectedsrc/ninja_config/modern_tui.py:1449 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

MEDIUM

URL using raw IP addresssrc/ninja_common/daemon.py:665 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

URL using raw IP addresssrc/ninja_common/daemon.py:993 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.

AST07

MEDIUM

Python subprocess execution detectedsrc/ninja_common/hooks_base.py:133 · Python subprocess execution detectedFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.

AST05

Cost to the agent

Instructions loaded

≈48 tok

1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Not checked against OSV yet; the weekly check has not reached this version.

What would make this Verified

15 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Unclaimed publisher≈ +8 on the totalClaim ninja-mcp-contributors: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim ninja-mcp-contributors