Skills/PyPI/tares

tares@1.56.0

CAUTION· not started

Publisher claims: "Open-source platform for always-on AI agents: a software factory for Claude Code that takes your projects from tickets to merged pull requests, or an AI SRE that watches your systems." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server) · listed in the official MCP RegistryPublisher glassflow · publishing for 187 daysInstalls 5,476Last detonated 4d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ROOT_TOKENTARES_AUTH_TOKENTARES_METRICS_TOKENTARES_STATE_DSNTARES_WEBHOOK_ALLOW_PRIVATEConfiguration, not credentials: ANTHROPIC_BASE_URL, CLAUDE_BIN, CLAUDE_PLUGIN_ROOT, FACTORY_CREW_HOME, TARES_AGENT_MODEL, TARES_ANTHROPIC_BASE, TARES_CATALOG, TARES_CATALOG_SYNC, TARES_CLOUD_URL, TARES_DB, TARES_DEGRADED_PCT, TARES_DUCKDB_MEMORY_LIMIT, TARES_DUCKDB_THREADS, TARES_EDITION, TARES_ENTITY_CARDINALITY_CAP, TARES_FACTORY_URL, TARES_GITHUB_CONNECT_URL, TARES_HOME, TARES_HOST, TARES_INGEST_PAUSE_PCT, TARES_INSTANCE_NAME, TARES_KEYRING, TARES_LINEAR_CONNECT_URL, TARES_LOGIN_URL, TARES_LOGOUT_URL, TARES_MAX_DB_SIZE, TARES_MCP_HOST, TARES_MCP_PORT, TARES_MCP_TRANSPORT, TARES_OTLP_GRPC_PORT, TARES_PLUGIN_DIR, TARES_PORT, TARES_PUBLIC_URL, TARES_SCHEDULE_CLOCK_SECONDS, TARES_SEED_PROJECT
Where it talks to
tares-glassflow.com (its own)Also glassflow.ai, astral.sh, navflow.dev, githubcopilot.com, llm-gateway.internal, linear.app, slack.com, rius-glassflow.com — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names glassflow.ai, astral.sh, navflow.dev, githubcopilot.com, llm-gateway.internal, linear.app, slack.com, rius-glassflow.com as well as its own vendor. The guard injects ROOT_TOKEN, TARES_AUTH_TOKEN, TARES_METRICS_TOKEN, TARES_STATE_DSN, TARES_WEBHOOK_ALLOW_PRIVATE only into requests to tares-glassflow.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets ROOT_TOKEN=tares-glassflow.com,TARES_AUTH_TOKEN=tares-glassflow.com,TARES_METRICS_TOKEN=tares-glassflow.com,TARES_STATE_DSN=tares-glassflow.com,TARES_WEBHOOK_ALLOW_PRIVATE=tares-glassflow.com -- uvx tares

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-10 and scored it 75/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Hidden zero-width characters detected; Pipe-to-shell pattern. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

MEDIUM
Process kill commandscripts/e2e-github-tickets.sh:33 · Process kill command — agent can terminate processesstop_daemon() { [ -n "$DPID" ] && { kill "$DPID" 2>/dev/null || true; wait "$DPID" 2>/dev/null || true; DPID=""; }; return 0; }Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/check_port_drift.py:69 · Python subprocess execution detectedr = subprocess.run(["git", "-C", str(repo)] + list(args), capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packageAGENTS.md:44 · npx invocation of non-well-known package — may execute untrusted codecd ui && npm ci && npx tsc --noEmit && npm run build # produces ui/distFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/e2e-github-tickets.sh:39 · Process kill command — agent can terminate processesecho "console: $DAEMON/projects/${UID_P:-} (stop it with: kill $DPID)"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Hidden zero-width characters detectedtares/skills.py:67 · Hidden zero-width characters detected — may conceal contenttext = (text or "").lstrip("").replace("\r\n", "\n")Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
CRITICAL
Pipe-to-shell patterntares/words.py:10 · Pipe-to-shell pattern — downloads and immediately executes remote codecurl -s $A/api/home | python -m tares.words --skip name,goal,title,detail,said,textFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST06
MEDIUM
File permission modification commandscripts/check-shared-mcp.sh:54 · File permission modification command — agent changes file ownership/permissionsprintf '#!/bin/sh\ntouch "%s/tares-mcp-started"\nexit 1\n' "$T" > "$T/bin/tares-mcp"; chmod +x "$T/bin/tares-mcp"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
npx invocation of non-well-known packageAGENTS.md:26 · npx invocation of non-well-known package — may execute untrusted codeBrowser suites locally: `cd ui && npm ci && npm run build && npx playwright install chromium`, then from the repo rootFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandscripts/check-shared-mcp.sh:19 · Process kill command — agent can terminate processescleanup() { local p; for p in $PIDS; do kill "$p" 2>/dev/null || true; wait "$p" 2>/dev/null || true; done; rm -rf "$T"; }Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandtares/runtime.py:143 · Process kill command — agent can terminate processesexcept Exception as e: # never let one source kill the loopFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/windows_spike.py:1618 · Process kill command — agent can terminate processes- Its own quiet check (what `inFlight` and `updatedAt` give today), its own stop (kill the process tree), and its own wake-ups for stations that sleep between turns.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedtests/ci_e2e.py:105 · Python subprocess execution detectedp = subprocess.Popen(["node", os.path.join("tests", f"{suite}.e2e.cjs")], cwd=ui, env=env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/windows_spike.py:358 · Python subprocess execution detectedout = subprocess.run(["powershell", "-NoProfile", "-NonInteractive", "-Command", ps_cmd],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filestares/daemon.py:5183 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file"""{text}: add one line to the global AGENTS.md (`agents`) or memory (`memory`). A lineFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedtests/ci_run.py:85 · Python subprocess execution detectedreturn subprocess.call(["bash", os.path.join(base, "factory", f"{name}_test.sh")])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/windows_spike.py:259 · Python subprocess execution detectedsubprocess.run(["taskkill", "/T", "/F", "/PID", str(pid)], capture_output=True, timeout=15)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filestares/daemon.py:5156 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file"""{text}: add one line to the caller's personal AGENTS.md (`agents`) or memoryFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commandscripts/windows_spike.py:1490 · Process kill command — agent can terminate processesif alive(): # it ignored the marker: kill it only when its command line is oursFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/windows_spike.py:552 · Python subprocess execution detectedr = subprocess.run([self.claude, "agents", "--json"] + (["--all"] if "--all" in rec["argv"] else []),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
MCP server using network transport (SSE/HTTP)tares/config.py:364 · MCP server using network transport (SSE/HTTP) — data sent over networkraise CatalogError(f"mcp_server {m['name']!r}: url must be an http(s) URL "Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.
AST04
MEDIUM
Python subprocess execution detectedscripts/windows_spike.py:284 · Python subprocess execution detectedself.p = subprocess.Popen(argv, **kw)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/windows_spike.py:370 · Python subprocess execution detectedout = subprocess.run(["ps", "-axo", "pid=,ppid=,command="], capture_output=True, timeout=30).stdout.decode("utf-8", "replace")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedtests/ci_run.py:88 · Python subprocess execution detectedreturn subprocess.call([sys.executable, os.path.join(base, f"{t}.py")])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈2,259 tok
3 files · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for tares@1.56.0 as of 4d ago. This is the package itself, not its dependencies.

What would make this Verified

5 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Pipe-to-shell pattern≈ +9 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  2. Unclaimed publisher≈ +8 on the totalClaim glassflow: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  4. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim glassflowPropose a patch to the maintainer