Laosi Mcp Security Audit

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:21 AM UTC
• Version: 1.0.1

Overview

This is a user-run security scanner that reads files in a chosen directory and reports findings without network access, persistence, or hidden changes.

Install only if you are comfortable with a local scanner reading source and configuration files under the directory you choose. Run it on the specific MCP server or skill folder you want audited, not on your home directory or unrelated private workspaces.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation

Content

}
        
        # Scan all relevant files
        extensions = ['.py', '.js', '.ts', '.json', '.yaml', '.yml', '.txt', '.md', '.env', '.config', '.conf']
        files_to_scan = []
        
        for ext in extensions:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

}
        
        # Scan all relevant files
        extensions = ['.py', '.js', '.ts', '.json', '.yaml', '.yml', '.txt', '.md', '.env', '.config', '.conf']
        files_to_scan = []
        
        for ext in extensions:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

files_to_scan.extend(self.mcp_path.rglob(f"*{ext}"))
        
        # Also check for common config files
        common_files = ['.env', '.env.local', '.env.production', 'docker-compose.yml', 'Dockerfile']
        for cf in common_files:
            files_to_scan.extend(self.mcp_path.rglob(cf))

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

files_to_scan.extend(self.mcp_path.rglob(f"*{ext}"))
        
        # Also check for common config files
        common_files = ['.env', '.env.local', '.env.production', 'docker-compose.yml', 'Dockerfile']
        for cf in common_files:
            files_to_scan.extend(self.mcp_path.rglob(cf))

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: This code recursively enumerates and reads files under a user-supplied path, which can expose user or system data during execution. Although this is part of an auditor's purpose, the file contains no explicit user-facing disclosure, prompt, or warning in comments/docstrings about scanning file contents across the directory tree.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The code comment and field name indicate that the report is including a timestamp, but L255 stores `str(Path().cwd())`, which is the current working directory path rather than any time value. This is an active contradiction between the documented intent of the metadata field and the implemented behavior.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: All CLI usage, report headings, summaries, and recommendations are emitted only in English, with no option for user locale selection or opt-in. Under the language/locale policy, hard-coding a specific language for user-facing interaction can be a policy violation when no choice is offered.

Static analysis

No suspicious patterns detected.