race-mcp@0.3.0
BLOCKED· static onlyPublisher claims: "Local-first remote access, control, and exchange through CLI and MCP" Observed in sandbox: static analysis only — behavior not yet observed.
Registry PyPI (MCP server)Publisher bluewhitep · publishing for 125 daysInstalls 42Last detonated 13 min ago
Coverage
Static only; nothing was run yet.The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- no vendor host named in the codeAlso openssh.com, mcp.example — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- nothing has run yet
- What we could not test
- everything: the server has not run yet
Do not connect it. The honeypot or a critical finding blocked this version; the evidence is below.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-15 and scored it 45/100 (Blocked). Do not install it: the sandbox observed behaviour consistent with credential theft, exfiltration or persistence. Notable findings: Privileged sudo command; Privileged sudo command; Reads credential paths from the home directory. Summary: static analysis only — behavior not yet observed.
Behavior trace
Queued for honeypot run · static analysis onlyt+CategoryObserved action
This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.
Static findings
HIGH
Privileged sudo commandsrc/race_mcp/core/constants.py:70 · Privileged sudo command — agent may execute with elevated privileges
AST05BLOCK_REASON_SUDO_DISABLED = "sudo disabled"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/race_mcp/core/policy_engine.py:415 · Privileged sudo command — agent may execute with elevated privileges
AST05# Usage: _execution_permission_block(device, "L6", "command_policy:sudo disabled", {})Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.CRITICAL
Reads credential paths from the home directorysrc/race_mcp/runtime/device_sources.py:254 · Reads credential paths from the home directory
AST03# Usage: _identity_file_readiness("gpu", "gpu.example", ["~/.ssh/id_ed25519"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/race_mcp/runtime/multi_device.py:786 · Privileged sudo command — agent may execute with elevated privileges
AST05"method": "signed broker execution of sudo -n true and sudo -n id -u",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/race_mcp/runtime/runner_broker.py:322 · Privileged sudo command — agent may execute with elevated privileges
AST05# Function Description: Upload Host-scoped runner/broker setup scripts and render sudo next steps.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandsrc/race_mcp/runtime/background_tmux.py:141 · File permission modification command — agent changes file ownership/permissions
AST05"chmod 700 \"$MANAGER_SCRIPT\"",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.HIGH
Privileged sudo commandsrc/race_mcp/runtime/runner_broker.py:412 · Privileged sudo command — agent may execute with elevated privileges
AST05"title": "SSH into target and run sudo setup scripts",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/race_mcp/runtime/transport.py:310 · Privileged sudo command — agent may execute with elevated privileges
AST05" sudo -n apt-get update >/dev/null",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/race_mcp/runtime/multi_device.py:748 · Privileged sudo command — agent may execute with elevated privileges
AST05f"printf 'remote-workspace broker sudo smoke {broker_sudo_token}\\n' && "Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/race_mcp/runtime/execution_grant.py:779 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo = shutil.which("sudo")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/race_mcp/runtime/runner_broker.py:731 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05" shell_path=\"$(awk -F: -v u=\"$user\" '$1 == u {print $7; exit}' /etc/passwd || true)\"",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/race_mcp/runtime/transport.py:317 · Privileged sudo command — agent may execute with elevated privileges
AST05" sudo -n zypper --non-interactive install rsync",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/race_mcp/runtime/transport.py:315 · Privileged sudo command — agent may execute with elevated privileges
AST05" sudo -n yum install -y rsync",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/race_mcp/runtime/runner_broker.py:730 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05" if [ -z \"$shell_path\" ] && [ -r /etc/passwd ]; then",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
References a credential file in the home directorysrc/race_mcp/runtime/device_sources.py:235 · References a credential file in the home directory
AST03# Usage: _identity_file_path_from_token("gpu", "gpu.example", "~/.ssh/id_ed25519")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/config_models.py:1083 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/mcp_server/cli.py:83 · Python subprocess execution detected
AST05proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Privileged sudo commandsrc/race_mcp/runtime/multi_device.py:747 · Privileged sudo command — agent may execute with elevated privileges
AST05"sudo -n true && "Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/race_mcp/runtime/runner_broker.py:392 · Privileged sudo command — agent may execute with elevated privileges
AST05f"sudo {shlex.quote(REMOTE_INSTALL_SCRIPT_PATH)}",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/config_models.py:1225 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Privileged sudo commandsrc/race_mcp/runtime/multi_device.py:767 · Privileged sudo command — agent may execute with elevated privileges
AST05sudo_token_seen = f"remote-workspace broker sudo smoke {broker_sudo_token}" in broker_sudo_stdout_linesFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
References a credential file in the home directorysrc/race_mcp/runtime/device_sources.py:254 · References a credential file in the home directory
AST03# Usage: _identity_file_readiness("gpu", "gpu.example", ["~/.ssh/id_ed25519"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/race_mcp/runtime/background_probe.py:111 · Privileged sudo command — agent may execute with elevated privileges
AST05f"sudo yum install -y {quoted_tool}",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Host or command assembled from base64 fragmentssrc/race_mcp/runtime/background_tmux.py:48 · Host or command assembled from base64 fragments
AST07"USER_CMD=$(base64 -d < \"$JOB_DIR/cmd.b64\")",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.HIGH
Privileged sudo commandsrc/race_mcp/runtime/transport.py:313 · Privileged sudo command — agent may execute with elevated privileges
AST05" sudo -n dnf install -y rsync",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/config_models.py:1058 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Access to sensitive file pathssrc/race_mcp/operator_cli/cli.py:1456 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05help="Optional SSH config file path for --ssh-config; defaults to ~/.ssh/config",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/race_mcp/operator_cli/cli.py:1031 · Privileged sudo command — agent may execute with elevated privileges
AST05help="Optional ACL target override; defaults to the SSH login user's home when the sudo install script runs",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/race_mcp/operator_cli/cli.py:1024 · Privileged sudo command — agent may execute with elevated privileges
AST05help="Upload runner/broker setup scripts to target /tmp and print sudo next steps",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/config_models.py:1089 · Python subprocess execution detected
AST05completed_file = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.HIGH
Privileged sudo commandsrc/race_mcp/runtime/dispatcher.py:2818 · Privileged sudo command — agent may execute with elevated privileges
AST05"It executes a signed broker sudo no-op probe and records used execution_ids on the target.",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/race_mcp/runtime/runner_broker.py:393 · Privileged sudo command — agent may execute with elevated privileges
AST05f"sudo {shlex.quote(REMOTE_KEYS_SCRIPT_PATH)}",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/race_mcp/runtime/dispatcher.py:2953 · Privileged sudo command — agent may execute with elevated privileges
AST05"The probe does not execute sudo or high-risk privileged actions.",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/race_mcp/runtime/device_sources.py:254 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Usage: _identity_file_readiness("gpu", "gpu.example", ["~/.ssh/id_ed25519"])Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/race_mcp/runtime/runner_broker.py:1111 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05awk -F: -v user="$lookup_user" '$1 == user {{print $6; exit}}' /etc/passwdFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/race_mcp/runtime/background_probe.py:109 · Privileged sudo command — agent may execute with elevated privileges
AST05f"sudo apt-get update && sudo apt-get install -y {quoted_tool}",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/race_mcp/runtime/background_probe.py:112 · Privileged sudo command — agent may execute with elevated privileges
AST05f"sudo pacman -Sy --noconfirm {quoted_tool}",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/race_mcp/runtime/transport.py:311 · Privileged sudo command — agent may execute with elevated privileges
AST05" sudo -n apt-get install -y rsync",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Host or command assembled from base64 fragmentssrc/race_mcp/runtime/workspace.py:938 · Host or command assembled from base64 fragments
AST07"USER_CMD=$(printf '%s' \"$CMD_B64\" | base64 -d)",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.HIGH
Access to sensitive file pathssrc/race_mcp/runtime/device_sources.py:235 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05# Usage: _identity_file_path_from_token("gpu", "gpu.example", "~/.ssh/id_ed25519")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathssrc/race_mcp/runtime/runner_broker.py:1110 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05elif [ -r /etc/passwd ]; thenFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/race_mcp/runtime/runner_broker.py:408 · Privileged sudo command — agent may execute with elevated privileges
AST05else "SSH login user's home, resolved on the target from the sudo user"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandsrc/race_mcp/runtime/dispatcher.py:2921 · Privileged sudo command — agent may execute with elevated privileges
AST05"Execution mode uses non-interactive package-manager commands and never receives or forwards sudo passwords.",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
MCP server using network transport (SSE/HTTP)src/race_mcp/operator_cli/cli.py:802 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04setup_mcp_parser.add_argument("--mcp-server", action="store_true", help="Include Streamable HTTP MCP server configuration")Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.HIGH
Privileged sudo commandsrc/race_mcp/runtime/background_probe.py:110 · Privileged sudo command — agent may execute with elevated privileges
AST05f"sudo dnf install -y {quoted_tool}",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Access to sensitive file pathssrc/race_mcp/runtime/runner_broker.py:1039 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05broker_sudoers_file=/etc/sudoers.d/remote-workspace-broker-root-helperFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Privileged sudo commandsrc/race_mcp/runtime/multi_device.py:749 · Privileged sudo command — agent may execute with elevated privileges
AST05"sudo -n id -u"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/runner_broker.py:644 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/transport.py:498 · Python subprocess execution detected
AST05process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
MCP server using network transport (SSE/HTTP)src/race_mcp/runtime/dispatcher.py:2200 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04"mcp_server_mode": "stdio discovers project config from cwd and falls back to global config; Streamable HTTP requires an explicit fixed scope",Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
File permission modification commandsrc/race_mcp/runtime/runner_broker.py:486 · File permission modification command — agent changes file ownership/permissions
AST05("workspace acl helper mode", 'chmod 750 "$workspace_acl_helper"'),Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Process kill commandsrc/race_mcp/runtime/workspace.py:1116 · Process kill command — agent can terminate processes
AST05" if kill -TERM \"$PID\" 2>/dev/null; then TERM_SENT=true; fi",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandsrc/race_mcp/runtime/runner_broker.py:484 · File permission modification command — agent changes file ownership/permissions
AST05("broker wrapper mode", 'chmod 755 "$broker_wrapper"'),Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/transport.py:294 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/race_mcp/runtime/workspace.py:1118 · Process kill command — agent can terminate processes
AST05" while [ \"$WAIT_COUNT\" -lt \"$GRACE_SEC\" ] && kill -0 \"$PID\" 2>/dev/null; do",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/execution_grant.py:739 · Python subprocess execution detected
AST05completed = subprocess.run(["id", user], text=True, capture_output=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/runner_broker.py:594 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/transport.py:101 · Python subprocess execution detected
AST05completed = subprocess.run(list(argv), capture_output=True, text=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandsrc/race_mcp/runtime/runner_broker.py:540 · File permission modification command — agent changes file ownership/permissions
AST05("authorized_keys mode", "chmod 600 \"$auth\""),Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/transfer.py:215 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/race_mcp/runtime/workspace.py:1122 · Process kill command — agent can terminate processes
AST05" if kill -0 \"$PID\" 2>/dev/null; then",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
File permission modification commandsrc/race_mcp/runtime/runner_broker.py:485 · File permission modification command — agent changes file ownership/permissions
AST05("broker root helper mode", 'chmod 750 "$broker_root_helper"'),Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/runner_broker.py:930 · Python subprocess execution detected
AST05completed = subprocess.run(argv, check=False, text=True, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/device_sources.py:52 · Python subprocess execution detected
AST05# Usage: subprocess.run(argv, **_non_interactive_ssh_run_kwargs())Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/device_sources.py:429 · Python subprocess execution detected
AST05probe = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/transport.py:326 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Process kill commandsrc/race_mcp/runtime/workspace.py:1004 · Process kill command — agent can terminate processes
AST05" if kill -0 \"$PID\" 2>/dev/null; then",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
MCP server using network transport (SSE/HTTP)src/race_mcp/runtime/dispatcher.py:2386 · MCP server using network transport (SSE/HTTP) — data sent over network
AST04"Aliases --mcp-tool and --mcp-server select the same stdio and Streamable HTTP surfaces.",Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/execution_grant.py:516 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/config_models.py:1304 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/device_sources.py:395 · Python subprocess execution detected
AST05ssh_g = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/execution_grant.py:770 · Python subprocess execution detected
AST05completed = subprocess.run(argv, text=True, capture_output=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/server_manager.py:590 · Python subprocess execution detected
AST05completed = subprocess.run(command, check=False, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/transfer.py:196 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/execution_grant.py:580 · Python subprocess execution detected
AST05completed = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File permission modification commandsrc/race_mcp/runtime/runner_broker.py:539 · File permission modification command — agent changes file ownership/permissions
AST05("authorized_keys ownership", 'chown "$user:$user" "$auth"'),Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.MEDIUM
Process kill commandsrc/race_mcp/runtime/workspace.py:1109 · Process kill command — agent can terminate processes
AST05"if [ -n \"$PID\" ] && kill -0 \"$PID\" 2>/dev/null; then PID_ALIVE=true; fi",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/execution_grant.py:650 · Python subprocess execution detected
AST05completed = subprocess.run(grant["exact_command"], shell=True, text=True, capture_output=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/race_mcp/runtime/server_manager.py:673 · Python subprocess execution detected
AST05proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.Cost to the agent
Instructions loaded
≈51 tok
1 file · 81 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Not checked against OSV yet; the weekly check has not reached this version.
What would make this Verified
35 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%- Reads credential paths from the home directory≈ +9 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- Unclaimed publisher≈ +8 on the totalClaim bluewhitep: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
- Obfuscated code≈ +5 on the totalRemove base64-assembled strings, eval of decoded text and minified blobs. Reviewers and scanners both treat unreadable code as hostile.
- Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
- Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
- References a credential file in the home directory≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim bluewhitepPropose a patch to the maintainer