Laosi Mcp Security Audit

• Outcome: Pass
• Latest audit: Jun 1, 2026 at 7:35 AM UTC
• Version:
  1.0.1

Overview

This is a local security-audit tool that scans a user-chosen directory and reports findings without network access, persistence, or destructive behavior.

Install only if you want a local Python tool to inspect MCP/server directories for security issues. Run it against specific project folders, not broad personal directories, because it can read config and .env-style files while searching for hardcoded credentials.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The tool recursively scans many file types, including configuration and environment files, and reads their contents without any explicit consent prompt, scope restriction, or disclosure to the user. In a security-auditing context this behavior is expected, but it can still collect secrets from .env and config files and surface them in reports, logs, or downstream systems if the scan path is broader than intended.

VirusTotal

66/66 vendors flagged this skill as clean.