Skills/PyPI/psamvault-mcp

psamvault-mcp@0.5.5

CAUTION· install only

Publisher claims: "MCP server for psamvault — lets AI agents use stored credentials without seeing them." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher psam-717 · publishing for 188 daysInstalls 131Last detonated 45 min ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
no credential variables read in the code
Where it talks to
no vendor host named in the codeAlso render.com, onrender.com, openrouter.ai, tavily.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
use of the skill by an agent

Connect it under the guard. Nothing executable in the bundle ran; the trace covers the install step only. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.

$vet-skills run --net declared -- uvx psamvault-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-15 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: URL to the cloud instance metadata address; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

CRITICAL
URL to the cloud instance metadata addressmcp_server/tools.py:810 · URL to the cloud instance metadata address — reads the VM's credentials# curl http://169.254.169.254/$KEYFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathsmcp_server/agent_guide.py:394 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesScan a project directory for `.env` files containing exposed API keys,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsSKILL.md:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesdescription: "Use psamvault MCP server: credential vault, browser login, API key injection, .env secret protection. MCP tools keep secrets out of the agent's context window."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/agent_guide.py:305 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| `scan_and_protect` | Scan .env files for exposed secrets | **First** when working in a project with .env files |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/env_scanner.py:82 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif pattern.startswith(".env"):Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/config_targets.py:172 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Only hosts whose .env location is VERIFIED appear here: writing a secret into a guessed path isFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/tools.py:251 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files(stored as ``project_name/.env/KEY_NAME``) are returned.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/env_scanner.py:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_scanner — .env file scanning and API key/secret detection module.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/main.py:166 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Export a vault API key into an agent host's .env file as an environment variable "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/main.py:86 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"- scan_and_protect → scan project .env files for exposed secrets and protect them\n"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsAGENTS.md:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| `how-to-scan-and-protect` | Guide for scanning and protecting `.env` secrets |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsAGENTS.md:95 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files`export_key_to_env_file(key_name="tavily", env_var_name="TAVILY_API_KEY")` → writes `HERMES_HOME/.env`,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/config_targets.py:185 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Resolve the ``.env`` file an agent host reads its tool variables from.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/api_client.py:195 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files``atlas054probe/.env/MY_CUSTOM_KEY`` while the entry is stored asFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdocs/skills/usage.md:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileskey, run a CLI command with a token, inject a secret into a process, protect a project's `.env`, or listFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/agent_guide.py:216 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesWhen working in a project directory that has `.env` files, callFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/tools.py:576 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Scan a project directory for exposed secrets in .env files and protect them.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/env_scanner.py:71 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- Relative paths: ``services/auth/.env``Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/tools.py:269 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Check if this key belongs to a project (format: project/.env/KEY)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsAGENTS.md:79 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| `export_key_to_env_file` | Export a vault API key into an agent's `.env` as an env var (default `HERMES_HOME/.env`) — updates in place, backs up, auto-verifies |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/env_scanner.py:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesDetects exposed secrets in .env files by analysing key names andFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdocs/skills/usage.md:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| `scan_and_protect` | `project_dir, patterns, project_name` | Scan & encrypt .env secrets | ❗ Encrypts into vault |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/api_client.py:187 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesunscoped ``env/.env/KEY`` (the shape ``scan_and_protect`` writes).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdocs/skills/usage.md:40 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- User wants to secure their project's `.env` files (`scan_and_protect`)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill command.github/workflows/ci.yml:14 · Process kill command — agent can terminate processes# That first run found a real bug rather than a slow machine: the timeout kill in cmd_runner signalled theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsmcp_server/compatibility.json:17 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…he 13 tools and their names are unchanged. `scan_and_protect` no longer stores `.env` backup copies (`.env.bak-*`, `.env.old`, `.env.save`, dated `.env.<digits>`) a…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/main.py:167 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"(default: HERMES_HOME/.env for agent='hermes'; unknown hosts need env_path). "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdocs/skills/usage.md:74 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…path, dry_run, verify_url, skip_verify` | Export a vault API key into an agent `.env` as an environment variable (default `HERMES_HOME/.env`) — updates in place, ba…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsCLAUDE.md:90 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files3. Replacements are `psamvault:KEY_NAME` placeholders in the `.env`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/main.py:88 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"- export_key_to_env_file → export a vault key into an agent .env as an env var (never returns the key)\n"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsdocs/skills/usage.md:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…he credential value. - **`scan_and_protect`** — Scans a project directory for `.env` files, detects secrets using pattern matching, encrypts them into the psamvaul…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/main.py:153 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Scan a project directory for exposed secrets in .env files and protect them. "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/api_client.py:196 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files``atlas054probe/.env/my_custom_key``.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/tools.py:270 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesparts = name.split("/.env/")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/env_scanner.py:72 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files- Pattern parts: ``.env`` in a path componentFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/config_targets.py:171 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# ── Agent-host .env targets ───────────────────────────────────────────────────Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/agent_guide.py:275 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesadd `.env` to their `.gitignore`.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/tools.py:256 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files``project/.env/KEY`` — pass the project name hereFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/api_client.py:186 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files* a **full stored name** — what ``list_api_keys`` returns, e.g. ``project/.env/KEY`` or theFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/config_targets.py:198 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn Path(home) / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsAGENTS.md:77 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| `scan_and_protect` | Encrypt project `.env` secrets into psamvault |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsmcp_server/config_targets.py:202 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn base / "hermes" / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsCLAUDE.md:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files### 5. Protecting `.env` filesFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commanddocs/skills/upgrade.md:111 · Process kill command — agent can terminate processesone moments after you kill it. Killing processes without quitting the app looks like it "did nothing".Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsCLAUDE.md:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files| `scan_and_protect(project_dir, patterns, project_name)` | Scan a project for `.env` secrets, encrypt them into psamvault |Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandtests/test_cmd_runner.py:136 · Process kill command — agent can terminate processes"""A genuine timeout must kill the process (tree) and hand back what was captured — notFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/selfcheck.py:229 · Python subprocess execution detectedreturn subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/install_env.py:143 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/upgrade_safety.py:35 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/cmd_runner.py:201 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/sync-skill-docs.py:146 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandmcp_server/cmd_runner.py:260 · Process kill command — agent can terminate processes# command, or a test runner), so killpg here would kill the caller instead of theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/test_docs_touch_check.py:78 · Python subprocess execution detectedsubprocess.run(["git", "init", "-q", str(root)], check=True, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/upgrade_safety.py:207 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/docs-touch-check.py:111 · Python subprocess execution detectedproc = subprocess.run(["git", "-C", str(repo), *args], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_cmd_runner.py:30 · Python subprocess execution detectedout = subprocess.run(["tasklist", "/FI", f"PID eq {pid}", "/NH"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/install_env.py:291 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandmcp_server/doctor.py:339 · Process kill command — agent can terminate processesand which respawns one the moment you kill it.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandmcp_server/cmd_runner.py:210 · Process kill command — agent can terminate processes# timeout kill can target the command's tree without touching the caller's group. WithoutFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_config_targets.py:289 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/compat.py:407 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/install_env.py:68 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandmcp_server/tools.py:173 · Process kill command — agent can terminate processes"""Close the browser if it exists but don't kill the Playwright context.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/sync-skill-docs.py:200 · Python subprocess execution detectedproc = subprocess.run(["git", "-C", str(repo), "rev-parse", "--short", "HEAD"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/selfcheck.py:133 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/docs-touch-check.py:201 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/doctor.py:160 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/compat.py:524 · Python subprocess execution detectedproc = subprocess.run(["git", "-C", str(clone_path()), "rev-parse", "--abbrev-ref", "HEAD"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_config_targets.py:235 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Where does an agent host read its .env? Explicit path wins; known hosts have defaults."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_docs_touch_check.py:64 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_docs_touch_check.py:63 · Python subprocess execution detectedsubprocess.run(["git", "-C", str(self.root), "add", "-A"], check=True, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_cmd_runner.py:157 · Process kill command — agent can terminate processes# ── The timeout kill must never signal the CALLER's process group ────────────────────────────────Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/compat.py:466 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/sync-skill-docs.py:173 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_cmd_runner.py:198 · Process kill command — agent can terminate processes"""Defence in depth: even sharing a group must not let the kill reach the caller."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/sync-skill-docs.py:412 · Python subprocess execution detectedsubprocess.run(["git", "-C", str(repo), "checkout", "-q", "-b", branch], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_cmd_runner.py:28 · Process kill command — agent can terminate processesnon-console signal to TerminateProcess, so a "probe" would kill the process it checks."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_config_targets.py:240 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesassert path.name == ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_cmd_runner.py:43 · Python subprocess execution detectedsubprocess.run(["taskkill", "/F", "/T", "/PID", str(pid)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/upgrade_safety.py:157 · Python subprocess execution detectedresult = subprocess.run(["pipx", "list", "--json"], capture_output=True, text=True, timeout=60)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/selfcheck.py:222 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/compat.py:487 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True, timeout=900)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/install_env.py:305 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_config_targets.py:265 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_config_targets.py:276 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/cmd_runner.py:254 · Python subprocess execution detectedsubprocess.run(["taskkill", "/F", "/T", "/PID", str(pid)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_cmd_runner.py:190 · Process kill command — agent can terminate processesf"({own_group}); the timeout kill would have signalled the caller"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/psamvault-compat-check.py:29 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_cmd_runner.py:64 · Python subprocess execution detectedchild = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(30)"])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_docs_touch_check.py:80 · Python subprocess execution detectedsubprocess.run(["git", "-C", str(root), "config", key, value], check=True, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/doctor.py:84 · Python subprocess execution detectedproc = subprocess.run(["pipx", "list", "--json"], capture_output=True, text=True, timeout=120)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/upgrade_safety.py:260 · Python subprocess execution detectedproc = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/sync-skill-docs.py:390 · Python subprocess execution detectedproc = subprocess.run(["git", "-C", str(repo), "status", "--porcelain", "--", "docs/skills"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/doctor.py:130 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp_server/selfcheck.py:213 · Python subprocess execution detectedproc = subprocess.run([python, "-c", code], capture_output=True, text=True, timeout=30, env=_child_env())Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_docs_touch_check.py:67 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_upgrade_safety.py:32 · Python subprocess execution detectedproc = subprocess.run(["git", *args], cwd=str(cwd), capture_output=True, text=True, env=GIT_ENV)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Refusal suppressionPLAN_version_lockstep.md:79 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction file3. Consult the index **as advice only** (its JSON API lags an upload, so it must never refuse on its own) — a contract entry is created when a release is merged,Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedtests/test_sync_skill_docs.py:206 · Python subprocess execution detectedhead = subprocess.run(["git", "-C", str(repo), "rev-parse", "--abbrev-ref", "HEAD"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_version_check.py:69 · MCP server using network transport (SSE/HTTP) — data sent over networkmonkeypatch.setattr("mcp_server.version_check.httpx.get", boom)Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Access to sensitive file pathstests/test_tools.py:147 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{"name": "twitter-bot/.env/GROK_API_KEY", "service_hint": "xAI", "created_at": "2026-06-17T06:00:00Z"},Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedtests/test_sync_skill_docs.py:29 · Python subprocess execution detectedsubprocess.run(["git", "-C", str(repo), "-c", "[email protected]", "-c", "user.name=t",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/test_sync_skill_docs.py:203 · Python subprocess execution detectedbranches = subprocess.run(["git", "-C", str(repo), "branch", "--list", "sync/skill-docs-*"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_tools.py:98 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{"name": "twitter-bot/.env/GROK_API_KEY", "service_hint": "xAI", "notes": None,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_version_check.py:74 · MCP server using network transport (SSE/HTTP) — data sent over network"mcp_server.version_check.httpx.get",Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Access to sensitive file pathstests/test_tools.py:35 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files``scan_and_protect`` stores ``project/.env/KEY``, so a leaf has to be resolved to the storedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_tools.py:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{"name": "twitter-bot/.env/GROK_API_KEY", "service_hint": "xAI", "created_at": "2026-06-17T06:00:00Z"},Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tests/test_version_check.py:60 · MCP server using network transport (SSE/HTTP) — data sent over network"mcp_server.version_check.httpx.get",Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedtests/test_sync_skill_docs.py:24 · Python subprocess execution detectedsubprocess.run(["git", "-C", str(repo), *args], check=True, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandtests/test_doctor.py:416 · Process kill command — agent can terminate processesapp spawns a new one the moment you kill it."""Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_tools.py:148 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{"name": "twitter-bot/.env/TWITTER_TOKEN", "service_hint": "Twitter", "created_at": "2026-06-17T07:00:00Z"},Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈5,087 tok
3 files · 80 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for psamvault-mcp@0.5.5 as of 22 min ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. URL to the cloud instance metadata address≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  2. Unclaimed publisher≈ +8 on the totalClaim psam-717: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. MCP server using network transport (SSE/HTTP)≈ +2 on the totalNamespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim psam-717Propose a patch to the maintainer