LSP Code Navigation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:18 AM UTC
• Version: 2.0.0

Overview

This skill is a coherent local code-navigation helper, but it lets an environment variable replace the language server with an arbitrary command that can receive source file contents.

Install only if you are comfortable with a local background daemon reading queried source files and sending them to installed language servers. Keep LSP_SERVER unset unless you intentionally point it at a trusted executable, and prefer direct invocation or a user-writable PATH location over a system-wide symlink.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tainted flow: 'response' from os.environ.get (line 732, credential/environment) → socket.socket.sendall (network output)

Critical

• Category: Data Flow

Content

request = json.loads(data.decode("utf-8").strip())
                result = _handle_request(daemon, request)
                response = json.dumps(result).encode("utf-8")
                conn.sendall(response)
            except Exception as e:
                try:
                    conn.sendall(json.dumps({"error": str(e)}).encode("utf-8"))

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The LSP_SERVER environment variable lets an attacker replace the intended language-server binary with an arbitrary command, which the tool later executes as a subprocess. In agent or shared-runtime contexts, environment variables are often influenced by upstream callers or workspace setup, turning a code-navigation helper into a general command-execution primitive.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs users to run shell commands, create symlinks in PATH, read repository files, and rely on environment variables, but it declares no explicit tool scope or permissions metadata. This creates a trust and review gap: an agent or platform may grant broader capabilities than intended, and users cannot easily assess that the skill can influence shell, filesystem, and environment-sensitive behavior.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest describes the skill as a tool for definitions, references, hover, symbols, and diagnostics. The implementation and top-level usage documentation additionally provide completions, signature help, rename, and workspace-symbol queries, which are materially broader IDE-style capabilities than the declared navigation scope.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The environment-controlled override directly changes which executable and arguments are run for all languages, broadening the trust boundary far beyond a normal code-navigation tool. In practice this enables arbitrary local code execution under the current user whenever the skill starts a server, especially dangerous in automated agent environments where environment state may be attacker-influenced.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

self._diagnostics = {}

    def start(self):
        self._proc = subprocess.Popen(
            self.server_cmd,
            stdin=subprocess.PIPE,
            stdout=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: When a file is opened, the full file contents are read and sent to the language-server subprocess via didOpen. This is inherent to LSP, but in this skill context it means potentially sensitive source code is transferred to whatever server binary is configured, including an overridden or compromised server, without any warning or consent boundary.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if ws:
        return ws
    try:
        root = subprocess.check_output(
            ["git", "rev-parse", "--show-toplevel"],
            stderr=subprocess.DEVNULL, text=True
        ).strip()

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.