handover-mcp

Hostile

Score 26 / 100 · 80 files read · 1 critical, 0 high, 6 medium, 3 low findings

Report 6fa5083ea56966e9 · first scanned 2026-10-28 · scanned 4× · keyed to the exact package contents, so this link always shows this version

Listed in the Agent Census directory data

Subscores

credentials96

exfiltration92

execution23

injection100

obfuscation98

files92

100 is clean. Deductions come only from the cited findings below.

criticalDownloads a remote file and pipes it straight into a shell interpreter

README.md · line 268 · rule C1

propriate: ```bash curl -fsSL https://handover.sh/install.sh | sh ``` Package releases are built from this public repository. Th

mediumCode contacts static.modelcontextprotocol.io, which the documentation never mentions

(package) · line 1 · rule M3

static.modelcontextprotocol.io

mediumWrites files under the user home directory

cli/handover.mjs · line 20 · rule M5

readFile, rm, writeFile, } from "node:fs/promises"; import { homedir } from "node:os"; import process from "node:process";

mediumCan run shell commands from code

cli/test/doctor.test.mjs · line 2 · rule M1

spawn } from "node:child_process"; import { mkdtemp, readFile, rm } from "node:fs/promises"; import { createServer } from "node:h

mediumCan run shell commands from code

tests/handoff-skill.test.mjs · line 3 · rule M1

wnSync } from "node:child_process"; import test from "node:test"; const skillUrl = new URL("../skills/handoff/SKILL.md", import.m

mediumCan run shell commands from code

tests/independent-results.test.mjs · line 2 · rule M1

t/strict"; import { execFile } from "node:child_process"; import { mkdir, mkdtemp, readFile, rm, writeFile, } from "node

mediumCan run shell commands from code

tests/validate-skill.test.mjs · line 5 · rule M1

wnSync } from "node:child_process"; import test from "node:test"; const validator = new URL( "../templates/handover-skill/valid

low4 binary file(s) were not parsed (static text analysis only)

(package) · line 1 · rule L3

4 binary files

lowReads named environment variables (normal for API keys; listed in the permission summary)

cli/handover.mjs · line 820 · rule L1

onfigPath() { if (process.env.HANDOVER_CONFIG) return resolve(process.env.HANDOVER_CONFIG); const root = process.env.XDG_C

lowReads named environment variables (normal for API keys; listed in the permission summary)

cli/test/doctor.test.mjs · line 83 · rule L1

, { env: { ...process.env, ...env }, stdio: ["ignore", "pipe", "pipe"], }); let stdout = ""; let stderr =

Network endpoints: code.claude.comgithub.comglama.aihandover.shimg.shields.iojson-schema.orglearn.chatgpt.commodelcontextprotocol.ioregistry.modelcontextprotocol.ioregistry.npmjs.orgskills.handover.shskills.shstatic.modelcontextprotocol.iowww.npmjs.comwww.skills.sh
Environment read: HANDOVER_CONFIGXDG_CONFIG_HOME
Shell execution: yes — code or scripts can run shell commands
Install hooks: none
Credential material: Reads named environment variables (normal for API keys; listed in the permission summary)

Interest list only. We store the address and this report link, nothing else. No mail is sent in v1.