Skills/PyPI/nyuwaymcpscanner

nyuwaymcpscanner@0.2.0

VERIFIED· not started

Publisher claims: "Enterprise security scanner for Model Context Protocol (MCP) servers" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher nyuway-cybersecurity · publishing for 176 daysInstalls 0Last detonated 25 h ago
$claude mcp add nyuwaymcpscanner -- uvx nyuwaymcpscanner
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
VIRUSTOTAL_API_KEY
Where it talks to
no vendor host named in the codeAlso forms.gle, oasis-open.org, schemastore.org, nyuway.ai, osv.dev, virustotal.com, ollama.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names forms.gle, oasis-open.org, schemastore.org, nyuway.ai, osv.dev, virustotal.com, ollama.com as well as its own vendor. The guard injects VIRUSTOTAL_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx nyuwaymcpscanner

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 86/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

MEDIUM
OS command execution function call detectedtests/test_yara_engine.py:116 · OS command execution function call detected("tool.py", "os.popen(cmd).read()\n"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
AWS access key pattern detectedtests/test_cli.py:489 · AWS access key pattern detected — possible hardcoded or harvested key(tmp_path / "other.py").write_text('AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"\n')Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
AWS access key pattern detectedtests/test_integration_fixtures.py:73 · AWS access key pattern detected — possible hardcoded or harvested key"config.py": 'AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"\n',Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
OS command execution function call detectedtests/test_cli.py:505 · OS command execution function call detectedf.write_text('import os\ndef run(cmd):\n os.system("echo " + cmd)\n')Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtests/test_yara_engine.py:40 · Destructive file system command detected'import os\nos.system("rm -rf /tmp/x")\n',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
OS command execution function call detectedtests/test_integration_fixtures.py:143 · OS command execution function call detected" os.system('curl ' + WEBHOOK)\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
GitHub token pattern detectedtests/test_safety_guards.py:51 · GitHub token pattern detected — possible hardcoded or harvested token'const TOKEN = "ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";\n'Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Destructive command against a filesystem root or devicetests/test_safety_guards.py:79 · Destructive command against a filesystem root or device(project / "bin.exe").write_bytes(b'os.system("rm -rf /")\n')Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_sources.py:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesmalicious_names=["/etc/passwd"],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
OS command execution function call detectedtests/test_integration_fixtures.py:110 · OS command execution function call detected"tool.py": ("import os\ndef run(cmd):\n os.system('echo ' + cmd)\n"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagenyuwaymcpscanner/sources/config.py:74 · npx invocation of non-well-known package — may execute untrusted code# Most npx flags do not take a value; conservative: just drop the flag.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Destructive file system command detectedtests/test_safety_guards.py:29 · Destructive file system command detectedhuge.write_bytes(padding + b'\nos.system("rm -rf /")\n')Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_safety_guards.py:29 · Destructive command against a filesystem root or devicehuge.write_bytes(padding + b'\nos.system("rm -rf /")\n')Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
AWS access key pattern detectedtests/test_cli.py:475 · AWS access key pattern detected — possible hardcoded or harvested keyf.write_text('AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"\n')Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Python subprocess execution detectednyuwaymcpscanner/setup/local_llm.py:57 · Python subprocess execution detectedcompleted = subprocess.run(["ollama", "pull", model], check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_sources.py:106 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileszf.writestr("/etc/passwd", b"bad")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtests/test_yara_engine.py:87 · Destructive file system command detected("tool.rb", 'system("rm -rf /tmp/x")\n'),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
AWS access key pattern detectedtests/test_safety_guards.py:61 · AWS access key pattern detected — possible hardcoded or harvested key(project / "logo.png").write_bytes(b"AKIAIOSFODNN7EXAMPLE\x00\xff\x00")Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
AWS access key pattern detectedtests/test_integration_fixtures.py:137 · AWS access key pattern detected — possible hardcoded or harvested key"config.py": 'AWS_ACCESS_KEY_ID = "AKIAIOSFODNN7EXAMPLE"\n',Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Destructive file system command detectedtests/test_safety_guards.py:79 · Destructive file system command detected(project / "bin.exe").write_bytes(b'os.system("rm -rf /")\n')Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Slack token pattern detectedtests/test_secrets.py:66 · Slack token pattern detected — possible hardcoded or harvested token("slack_token", 'TOKEN = "xoxb-1234567890-abcdefghijk"'),Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
LOW
URL to a private-network addresstests/test_integration_fixtures.py:152 · URL to a private-network address — a LAN or development target"client.py": 'API_BASE = "http://10.0.0.5/internal"\n',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
MEDIUM
AWS access key pattern detectedtests/test_safety_guards.py:40 · AWS access key pattern detected — possible hardcoded or harvested key(git_dir / "config").write_text("AKIAIOSFODNN7EXAMPLE\n")Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
OS command execution function call detectedtests/test_safety_guards.py:79 · OS command execution function call detected(project / "bin.exe").write_bytes(b'os.system("rm -rf /")\n')Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
URL to a private-network addresstests/test_yara_engine.py:48 · URL to a private-network address — a LAN or development target'API = "http://10.0.0.5/internal"\n',Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07

Cost to the agent

Instructions loaded
≈55 tok
1 file · 50 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for nyuwaymcpscanner@0.2.0 as of 25 h ago. This is the package itself, not its dependencies.