Is Open Steps safe?
- Defense-evasion command idiom
- Python filesystem read
- Python filesystem write/delete
What to do: Nothing here argues against installing it. Grant the capabilities it lists only if you expect the tool to need them.
Open Steps is a directory analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 1 risky construct is reported for review. It can: filesystem read and filesystem write — capabilities are what the code can do, not a verdict on intent. Risk score 20/100 (low).
repo
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of Open Steps's authors. Report a false positive.
Behavioral traits
How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.
Findings (3)
A command uses a known defense-evasion idiom: PowerShell execution-policy bypass / encoded command / hidden window, macOS code-signing bypass, or launching a payload from a world-writable temp directory. These are hallmarks of droppers and rarely appear in legitimate code.
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "$(dirname "$agent_bin")/cursor-agent.ps1" -p --trust --model "$model" --output-format stream-json "$prompt"
Fix: Verify why the component bypasses execution policy / code signing or runs from a temp directory; these patterns are characteristic of malware staging.
The component reads files from disk.
for line in path.read_text().splitlines():
for line in path.read_text(errors="replace").splitlines():
text = README.read_text()
Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.
Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.
The component writes or deletes files on disk.
README.write_text(new)
out.write_text(text)
Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.
Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.
How attackers abuse these capabilities
Interactive labs on the attack class behind the rules above. They show the technique, not anything found in Open Steps.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →