oath-mcp@0.1.3
CAUTION· install onlyPublisher claims: "OATH — typed MCP server + verifier-gated evidence receipts for LLM-assisted digital forensics." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry PyPI (MCP server)Publisher gharsallahdev · publishing for 162 daysInstalls 0Last detonated 25 h ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
ANTHROPIC_API_KEYConfiguration, not credentials: OATH_MOUNT_ROOT, PYTHONPATH- Where it talks to
- no vendor host named in the codeAlso githubusercontent.com, microsoft.com, astral.sh, brew.sh — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names githubusercontent.com, microsoft.com, astral.sh, brew.sh as well as its own vendor. The guard injects ANTHROPIC_API_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.
$vet-skills run --net declared -- uvx oath-mcp
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-13 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Pipe-to-shell pattern; Pipe-to-shell pattern; Pipe-to-shell pattern. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
CRITICAL
Pipe-to-shell patternscripts/bootstrap-forensic-tools.sh:16 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06# curl -fsSL https://raw.githubusercontent.com/GharsallahDev/oath-mcp/main/scripts/bootstrap-forensic-tools.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patternscripts/install-on-sift.sh:86 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06curl -fsSL https://raw.githubusercontent.com/teamdfir/protocol-sift/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patternscripts/bootstrap-forensic-tools.sh:202 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST061. curl -LsSf https://astral.sh/uv/install.sh | sh # install uv if missingFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/bootstrap-forensic-tools.sh:124 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$BIN_DIR/_dotnet-wrap.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Remote installer piped to shellscripts/bootstrap-forensic-tools.sh:202 · Remote installer piped to shell
AST071. curl -LsSf https://astral.sh/uv/install.sh | sh # install uv if missingFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Destructive file system command detectedscripts/bootstrap-forensic-tools.sh:59 · Destructive file system command detected
AST05rm -f /tmp/packages-microsoft-prod.debFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/install-on-sift.sh:120 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo apt-get install -y -qq sleuthkit python3-pip python3-venv build-essential pkg-config curl unzipFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandscripts/bootstrap-forensic-tools.sh:142 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$BIN_DIR/$name"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Privileged sudo commandsrc/oath/mcp/evidence_handle.py:125 · Privileged sudo command — agent may execute with elevated privileges
AST05ntfs-3g. sudo is required for ewfmount + mount; on SIFT theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedscripts/dry-run.sh:205 · Python subprocess execution detected
AST05r = subprocess.run(['oath','verify',eid], capture_output=True, text=True, timeout=1800)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.CRITICAL
Pipe-to-shell patternscripts/install-tools.sh:46 · Pipe-to-shell pattern — downloads and immediately executes remote code
AST06curl -fsSL https://raw.githubusercontent.com/teamdfir/protocol-sift/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/bootstrap-forensic-tools.sh:147 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$BIN_DIR/hayabusa"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Remote installer piped to shellscripts/bootstrap-forensic-tools.sh:16 · Remote installer piped to shell
AST07# curl -fsSL https://raw.githubusercontent.com/GharsallahDev/oath-mcp/main/scripts/bootstrap-forensic-tools.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/install-on-sift.sh:245 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$OATH_TOOLS/bin/$name"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Privileged sudo commandscripts/bootstrap-forensic-tools.sh:58 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo dpkg -i /tmp/packages-microsoft-prod.debFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Remote installer piped to shellscripts/install-on-sift.sh:86 · Remote installer piped to shell
AST07curl -fsSL https://raw.githubusercontent.com/teamdfir/protocol-sift/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Privileged sudo commandscripts/install-on-sift.sh:113 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo apt-get update -qqFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Direct script execution from GitHub raw URLscripts/install-on-sift.sh:86 · Direct script execution from GitHub raw URL — unverified code source
AST06curl -fsSL https://raw.githubusercontent.com/teamdfir/protocol-sift/main/install.sh | bashFix: Pin versions and sources; vendor anything fetched at install time.MEDIUM
File permission modification commandscripts/install-tools.sh:135 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$OATH_TOOLS/env.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedsrc/oath/mcp/tools/parse_evtx.py:135 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Direct script execution from GitHub raw URLscripts/install-tools.sh:46 · Direct script execution from GitHub raw URL — unverified code source
AST06curl -fsSL https://raw.githubusercontent.com/teamdfir/protocol-sift/main/install.sh | bashFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Privileged sudo commandscripts/install-on-sift.sh:135 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo apt-get install -y -qq dotnet-sdk-9.0 || sudo apt-get install -y -qq dotnet-sdk-8.0Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/bootstrap-forensic-tools.sh:70 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo apt-get install -y -qq powershell || {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/oath/mcp/evidence_handle.py:40 · Python subprocess execution detected
AST05proc = subprocess.run(cmd, capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Destructive file system command detectedscripts/install-tools.sh:95 · Destructive file system command detected
AST05rm -f /tmp/hayabusa.zipFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Remote installer piped to shellscripts/install-tools.sh:46 · Remote installer piped to shell
AST07curl -fsSL https://raw.githubusercontent.com/teamdfir/protocol-sift/main/install.sh | bashFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/oath/mcp/tools/find_strings_on_image.py:116 · Python subprocess execution detected
AST05return subprocess.run(argv, capture_output=True, check=True, timeout=600).stdoutFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandscripts/install-on-sift.sh:250 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$OATH_TOOLS/bin/hayabusa"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Direct script execution from GitHub raw URLscripts/bootstrap-forensic-tools.sh:16 · Direct script execution from GitHub raw URL — unverified code source
AST06# curl -fsSL https://raw.githubusercontent.com/GharsallahDev/oath-mcp/main/scripts/bootstrap-forensic-tools.sh | bashFix: Pin versions and sources; vendor anything fetched at install time.HIGH
Destructive file system command detectedscripts/install-on-sift.sh:133 · Destructive file system command detected
AST05rm -f /tmp/packages-microsoft-prod.debFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/oath/mcp/evidence_handle.py:133 · Privileged sudo command — agent may execute with elevated privileges
AST05# mmls needs sudo too — ewfmount's FUSE export is root-owned by defaultFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandscripts/install-tools.sh:175 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$OATH_TOOLS/bin/$name"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandscripts/install-tools.sh:157 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$OATH_TOOLS/bin/_dotnet-wrap.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedsrc/oath/mcp/tools/find_strings_on_image.py:112 · Python subprocess execution detected
AST05return subprocess.run(argv, capture_output=True, check=True, timeout=600).stdoutFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Destructive file system command detectedscripts/bootstrap-forensic-tools.sh:99 · Destructive file system command detected
AST05rm -f /tmp/hayabusa.zipFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandscripts/install-on-sift.sh:206 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$OATH_TOOLS/env.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandscripts/install-tools.sh:93 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$OATH_TOOLS/hayabusa/hayabusa-${HAYABUSA_VER}-mac-aarch64"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandscripts/install-on-sift.sh:227 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$OATH_TOOLS/bin/_dotnet-wrap.sh"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Destructive file system command detectedscripts/install-on-sift.sh:177 · Destructive file system command detected
AST05rm -f /tmp/hayabusa.zipFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/bootstrap-forensic-tools.sh:60 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo apt-get update -qqFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandscripts/install-on-sift.sh:176 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$HAYABUSA_BIN"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandscripts/install-tools.sh:179 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$OATH_TOOLS/bin/hayabusa"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
File permission modification commandscripts/bootstrap-forensic-tools.sh:98 · File permission modification command — agent changes file ownership/permissions
AST05chmod +x "$HAYABUSA_BIN"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Privileged sudo commandscripts/install-on-sift.sh:132 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo dpkg -i /tmp/packages-microsoft-prod.debFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/bootstrap-forensic-tools.sh:61 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo apt-get install -y -qq dotnet-sdk-9.0 || sudo apt-get install -y -qq dotnet-sdk-8.0Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/install-on-sift.sh:134 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo apt-get update -qqFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/oath/mcp/evidence_handle.py:216 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈58 tok
1 file · 81 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for oath-mcp@0.1.3 as of 25 h ago. This is the package itself, not its dependencies.
What would make this Verified
12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
- Unclaimed publisher≈ +8 on the totalClaim gharsallahdev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Direct script execution from GitHub raw URL≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
- File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim gharsallahdevPropose a patch to the maintainer