archify@r1

CAUTION

Publisher claims: "Create validated architecture, workflow, sequence, data-flow, lifecycle/state, ERD, class, tree, timeline, and waterfall diagrams as explorable standalone HTML with dark/light themes, motion and image/SVG/WebM export. Accept requirements or Mermaid; inspect repository evidence for code-backed diagrams. Use when visualizing systems, API calls, pipelines, schemas, histories, timings, or everyday steps, parts, relationships and states. Also turn an answer into a one-page explainer, with the conclusion first, structured panels, native diagrams and charts, when the user asks for a page, an explainer or an answer to share (做成一页, 用页面讲), or proactively when the user's rules opt in with an [archify explainer: ...] line. Not for dashboards." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry skills.shPublisher tt-a1i · joined 2 days agoInstalls 170KLast detonated 31 h ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathsbin/delivery-update.mjs:50 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbin/finalize.mjs:491 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbin/archify.mjs:2265 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbin/visual-check.mjs:1523 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbin/finalize.mjs:493 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbin/visual-check.mjs:1317 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbin/open-artifact.mjs:105 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbin/visual-check.mjs:1322 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbin/open-artifact.mjs:104 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbin/preview.mjs:794 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbin/finalize.mjs:738 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbin/archify.mjs:2282 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbin/finalize.mjs:896 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

MEDIUM

File type combined with upload actionbin/preview.mjs:947 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actionbin/archify.mjs:2197 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actionbin/preview.mjs:948 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

Outbound HTTP to raw IP addressbin/open-artifact.mjs:140 · Outbound HTTP to raw IP address — may bypass domain-based monitoring

AST07

MEDIUM

File type combined with upload actionbin/archify.mjs:2193 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actionSKILL.md:42 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actionSKILL.md:14 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actionbin/archify.mjs:2194 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actionbin/archify.mjs:2195 · File type combined with upload action — agent may exfiltrate local data files

AST07

CRITICAL

Access to sensitive file pathsexplainer/diagrams.mjs:437 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsbin/visual-check.mjs:1579 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

MEDIUM

File type combined with upload actionbin/archify.mjs:1748 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

URL using raw IP addressbin/open-artifact.mjs:140 · URL using raw IP address — may bypass domain-based filtering

AST07

MEDIUM

File type combined with upload actionSKILL.md:45 · File type combined with upload action — agent may exfiltrate local data files

AST07