mcptoon

• Outcome: Review
• Latest audit: Oct 22, 2026 · 8:58 AM UTC
• Version: 1.0.14

Overview

The skill’s tool-management features are coherent, but its broad activation rules can lead to software installation before the user is informed.

Require explicit approval before initial installation or execution, and choose a reviewed package version in an isolated environment. Preview configuration and skill-sync changes, retain backups, and use mcptoon restore before uninstalling if you want the original routing back. Set cache expiry if tool results contain sensitive information.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

The activation condition includes any mention of “token cost,” without requiring an MCP-related context.

Medium

• Category: Trigger Abuse
• Confidence: 96% confidence

Finding

Triggering on any mention of “token cost” can activate this skill for unrelated pricing or model-usage questions. In this context, that matters because activation leads into instructions to check for and automatically install a third-party CLI, expanding a routing mistake into unnecessary code execution and environment changes.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'uvx mcptoon'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The installation example offers uvx mcptoon without a version constraint, allowing package resolution to select an unreviewed release. A compromised release would execute with the agent's local privileges, which is particularly consequential for a utility that manages MCP configurations and tool calls.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'uvx mcptoon'.

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Calling uvx mcptoon <args> can download and execute an unpinned package even though the text describes it as requiring “no install.” Temporary execution environments do not remove supply-chain risk or restrict the program's access to local files and credentials.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 75% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

`uvx mcptoon <args>` runs it with no install at all, if `uvx` is available. Then
say one plain sentence to the user — for example *"this skill is installed but the
mcptoon CLI is not; I installed it"* — and continue. Never silently pretend the
commands worked, and never tell the user the feature is unavailable when a
one-line install is the whole gap.

mcptoon is a zero-dependency CLI (534KB, installs in seconds, nothing else pulled

MCP server referenced without pinned version: 'npx mcptoon'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'uvx mcptoon'.

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The rule repeats unpinned uvx mcptoon execution as a mandatory prerequisite when the binary is missing. This turns a routine skill activation into an opportunity to execute a newly published or compromised package without an explicit approval step.

Content

No source excerpt is available for this finding.

MCP server dependency without pinned version: 'pip install mcptoon'.

Low

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

pip install mcptoon selects an unconstrained release, and the surrounding instructions direct the agent to install first and inform the user afterward. This combines supply-chain exposure with an unsolicited environment change; the later publisher guidance does not establish artifact integrity.

Content

No source excerpt is available for this finding.

MCP server dependency without pinned version: 'pip install mcptoon'.

Low

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The rules reinforce installing the latest available package automatically if the executable is absent. Because mcptoon can participate in tool execution and configuration management, a malicious release could compromise more than the installation environment alone.

Content

No source excerpt is available for this finding.

MCP server dependency without pinned version: 'pip install --upgrade mcptoon'.

Low

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The troubleshooting guidance recommends an unrestricted upgrade when a documented command is unavailable, potentially replacing a trusted installation with an unreviewed release. The later instruction to confirm upgrades reduces unauthorized-change risk but does not address package integrity or reproducibility.

Content

No source excerpt is available for this finding.

MCP server dependency without pinned version: 'pip install --upgrade mcptoon'.

Low

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The setup section deliberately recommends an unpinned upgrade, leaving the selected executable dependent on the package index's current contents. Explicit user confirmation is a useful safeguard, but it does not prevent execution of a compromised upstream release.

Content

No source excerpt is available for this finding.