LSP Code Navigation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:18 AM UTC
• Version: 2.0.0

Overview

This skill is a coherent local code-navigation helper, but it lets an environment variable replace the language server with an arbitrary command that can receive source file contents.

Install only if you are comfortable with a local background daemon reading queried source files and sending them to installed language servers. Keep LSP_SERVER unset unless you intentionally point it at a trusted executable, and prefer direct invocation or a user-writable PATH location over a system-wide symlink.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tainted flow: 'response' from os.environ.get (line 732, credential/environment) → socket.socket.sendall (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/lsp-query.py (reported line 733)May include surrounding context.

python

request = json.loads(data.decode("utf-8").strip())
                result = _handle_request(daemon, request)
                response = json.dumps(result).encode("utf-8")
                conn.sendall(response)
            except Exception as e:
                try:
                    conn.sendall(json.dumps({"error": str(e)}).encode("utf-8"))

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The LSP_SERVER environment variable lets an attacker replace the intended language-server binary with an arbitrary command, which the tool later executes as a subprocess. In agent or shared-runtime contexts, environment variables are often influenced by upstream callers or workspace setup, turning a code-navigation helper into a general command-execution primitive.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs users to run shell commands, create symlinks in PATH, read repository files, and rely on environment variables, but it declares no explicit tool scope or permissions metadata. This creates a trust and review gap: an agent or platform may grant broader capabilities than intended, and users cannot easily assess that the skill can influence shell, filesystem, and environment-sensitive behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes the skill as a tool for definitions, references, hover, symbols, and diagnostics. The implementation and top-level usage documentation additionally provide completions, signature help, rename, and workspace-symbol queries, which are materially broader IDE-style capabilities than the declared navigation scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The environment-controlled override directly changes which executable and arguments are run for all languages, broadening the trust boundary far beyond a normal code-navigation tool. In practice this enables arbitrary local code execution under the current user whenever the skill starts a server, especially dangerous in automated agent environments where environment state may be attacker-influenced.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/lsp-query.py (reported line 231)May include surrounding context.

python

self._diagnostics = {}

    def start(self):
        self._proc = subprocess.Popen(
            self.server_cmd,
            stdin=subprocess.PIPE,
            stdout=subprocess.PIPE,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

When a file is opened, the full file contents are read and sent to the language-server subprocess via didOpen. This is inherent to LSP, but in this skill context it means potentially sensitive source code is transferred to whatever server binary is configured, including an overridden or compromised server, without any warning or consent boundary.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/lsp-query.py (reported line 587)May include surrounding context.

python

if ws:
        return ws
    try:
        root = subprocess.check_output(
            ["git", "rev-parse", "--show-toplevel"],
            stderr=subprocess.DEVNULL, text=True
        ).strip()

Static analysis

No suspicious patterns detected.