Security audit

MCP Server Plus

Security checks for vulnerabilities and agentic risk

Overview

The skill is a documentation/template skill, but its default MCP server examples expose credentials, database access, and filesystem read/write too broadly for safe copy-and-run use.

Review before installing or using as a template source. Do not copy the API, database, or filesystem examples into a reachable MCP server without adding strict destination allowlists, per-tool authorization, least-privileged credentials, read-only database roles where possible, filesystem sandboxing, write confirmations, size limits, and audit logging.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:76
Finding: API Key Exfiltration Through a Caller-Controlled Endpoint
Content: View full analysis
` in the outbound request. 6. The attacker's server records the header and recovers the API key. 7. The attacker reuses the credential against any service where it is accepted. If redirects are followed, an attacker may also use a permitted-looking initial URL that redirects to an attacker-controlled destination. ### Impact Assessment A remote tool caller can obtain the complete API key available t ...[truncated 425 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:125
Finding: Unrestricted Caller-Controlled SQL Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:214
Finding: Arbitrary Filesystem Read and Write Through Unvalidated Paths
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file system template exposes arbitrary read and write operations based directly on user-supplied paths, with no path normalization, allowlist, sandboxing, or permission checks. In an MCP context, this can enable unauthorized access to sensitive files, overwriting application data, or persistence by writing attacker-controlled content to the host filesystem.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents and exemplifies a write_file capability that can modify arbitrary files, but it does not prominently warn users that enabling this tool can alter or destroy local data. In agent/tooling ecosystems, omission of such warnings increases the chance that operators expose destructive functionality without understanding the risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The templates demonstrate exposed tool handlers for API access, database queries, and filesystem operations without integrating authentication, authorization, or rate limiting into the examples themselves. Because users often copy templates verbatim, this creates a realistic risk of deploying privileged MCP tools that are reachable without access control or abuse prevention.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.