registry / slashvibe-mcp / 0.5.17
slashvibe-mcp@0.5.17
⚠ Under reviewSocial layer for Claude Code - DMs, presence, Matrix multiplayer rooms, and connection between AI-assisted developers
Static Scan Results
scanned 4mo ago · by rust-scannerStatic analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedtools/_work-context.test.jsView file
83patternName = github_pat
severity = critical
line = 83
matchedText = const in...90';
Critical
Critical Secret
Package contains a critical-looking secret pattern.
tools/_work-context.test.jsView on unpkg · L8383patternName = github_pat
severity = critical
line = 83
matchedText = const in...90';
Critical
Secret Pattern
GitHub personal access token in tools/_work-context.test.js
tools/_work-context.test.jsView on unpkg · L83twitter.jsView file
39.update(signatureBaseString)
L40: .digest('base64');
L41: }
...
L80: async function xRequest(method, endpoint, params = {}, body = null) {
L81: const baseUrl = 'https://api.twitter.com';
L82: const url = `${baseUrl}${endpoint}`;
...
L89: const fetchUrl = method === 'GET' && Object.keys(params).length > 0
L90: ? `${url}?${new URLSearchParams(params)}`
L91: : url;
Low
Findings
4 Critical1 High4 Medium5 Low
CriticalCritical Secrettools/_work-context.test.js
CriticalPrevious Version Dangerous Deltaconfig.js
CriticalSecret Patterntools/_work-context.test.js
CriticalSecret Patterntools/_work-context.manual-test.js
HighCredential Exfiltrationtools/subscriptions.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperhooks/check-guest-messages.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptotwitter.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to slashvibe-mcp@0.5.17.
See all versions of slashvibe-mcp for other recorded verdicts.
- Review the evidence and your use of slashvibe-mcp@0.5.17 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.