mastra@r2

CAUTION

Publisher claims: "Comprehensive Mastra framework guide for building agents, workflows, tools, memory, workspaces, and storage with current APIs. Use for documentation lookup, API verification, TypeScript setup, common errors, migrations, and `mastra api` CLI tasks: inspect or call resources on local, Mastra platform, or remote servers. For Mastra Factory operations, discover and activate the companion mastra-factory skill. Also report verified bugs and concrete documentation defects to the Mastra team automatically via the feedback endpoint." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry skills.shPublisher mastra-ai · joined 2 days agoInstalls 82,501Last detonated 54 min ago

Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathsreferences/common-errors.md:416 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packageSKILL.md:104 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsreferences/create-mastra.md:219 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/common-errors.md:148 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packagereferences/migration-guide.md:129 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/migration-guide.md:58 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsreferences/create-mastra.md:117 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packagereferences/mastra-api.md:19 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsreferences/common-errors.md:434 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packagereferences/mastra-api.md:63 · npx invocation of non-well-known package — may execute untrusted code

AST06

CRITICAL

Access to sensitive file pathsreferences/common-errors.md:440 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Access to sensitive file pathsreferences/common-errors.md:457 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

HIGH

npx invocation of non-well-known packagereferences/mastra-api.md:64 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/migration-guide.md:157 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/mastra-api.md:42 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/common-errors.md:528 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/mastra-api.md:25 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/trace-query.md:12 · npx invocation of non-well-known package — may execute untrusted code

AST06

LOW

Unpinned dependencyreferences/create-mastra.md:75 · Unpinned dependency

AST06

LOW

Unpinned dependencyreferences/migration-guide.md:151 · Unpinned dependency

AST06

HIGH

npx invocation of non-well-known packagereferences/trace-query.md:51 · npx invocation of non-well-known package — may execute untrusted code

AST06

LOW

Unpinned dependencyreferences/migration-guide.md:55 · Unpinned dependency

AST06

HIGH

npx invocation of non-well-known packagereferences/trace-query.md:35 · npx invocation of non-well-known package — may execute untrusted code

AST06

HIGH

npx invocation of non-well-known packagereferences/trace-query.md:43 · npx invocation of non-well-known package — may execute untrusted code

AST06

LOW

Unpinned dependencyreferences/create-mastra.md:76 · Unpinned dependency

AST06

HIGH

npx invocation of non-well-known packagereferences/trace-query.md:18 · npx invocation of non-well-known package — may execute untrusted code

AST06