FootballGPT

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:51 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent FootballGPT MCP integration, with expected API-key and external-service use disclosed in the setup.

Install this only if you intend to use FootballGPT's hosted service and are comfortable providing a FootballGPT API key. Avoid sending sensitive player or team information unless appropriate for your organization, and consider pinning or reviewing the mcporter package before installation in higher-trust environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned npm Dependency Permits Supply-Chain Substitution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-21
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

"requires": { "bins": ["mcporter"], "env": ["FOOTBALLGPT_API_KEY"] },
"primaryEnv": "FOOTBALLGPT_API_KEY",
"install":
  [
    {
      "id": "node",
      "kind": "node",
      "package": "mcporter",
      "bins": ["mcporter"],
      "label": "Install mcporter (npm)",
    },
  ],

Technical Analysis

The installation metadata identifies the npm package only as mcporter, without an exact version or integrity hash. Consequently, installation can resolve to whichever package release the configured registry currently serves rather than to an immutable, previously audited artifact.

If the package, its maintainer account, the package registry, or the dependency-resolution path is compromised, a malicious release could execute code through package lifecycle scripts or through the installed mcporter binary. The Skill subsequently configures that binary to handle the FOOTBALLGPT_API_KEY, increasing the sensitivity of a dependency compromise.

The reviewed file does not establish that mcporter is currently malicious. The vulnerability is the mutable and insufficiently verified dependency specification.

Attack Path

1. An attacker compromises the npm package, a maintainer account, or the dependency-delivery path and publishes or serves a malicious mcporter release.
2. A user installs the Skill when the unversioned package declaration resolves to that release.
3. Malicious code executes during an npm lifecycle phase or when the installed command is invoked.
4. The code runs with the installing or invoking user's privileges.
5. It may inspect local files and environment variables, including FOOTBALLGPT_API_KEY when available, or alter requests sent through the configured MCP client.
6. Stolen information may then be transmit ...[truncated 635 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin mcporter to an exact, reviewed version rather than relying on the latest registry release.
2. Enforce a cryptographic integrity hash or lockfile for the complete transitive dependency graph.
3. Retrieve packages only from an explicitly trusted registry and use registry allowlisting where supported.
4. Verify package provenance or signatures before installation.
5. Disable npm lifecycle scripts where operationally feasible, or review all lifecycle scripts before permitting execution.
6. Run installation and the MCP client with least privilege in an isolated environment.
7. Limit exposure of FOOTBALLGPT_API_KEY, rotate it after suspected dependency compromise, and monitor for unauthorized API activity.
8. Document the expected package publisher, version, checksum, and registry so substitutions can be detected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation description is very broad, covering generic football-related requests such as tactics, player development, and statistics without clear boundaries for when the skill should or should not be invoked. This can cause over-triggering of the external skill, unnecessarily sending user prompts to a third-party service and increasing the chance of unintended data exposure or tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation lists tools like get_my_profile, search_player_stats, and coaching advice generation but does not clearly warn that user prompts, team/profile information, and other tool inputs are transmitted to FootballGPT's external MCP endpoint. Users may unknowingly share sensitive coaching, team, or player-related information with a third party, preventing informed consent and increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.