mingle

• Outcome: Review
• Latest audit: Sep 15, 2026 · 5:26 AM UTC
• Version: 5.0.0

Overview

Mingle is mostly a well-scoped networking skill, but its install instructions run mutable npm code and can automatically change AI-client configuration, so it needs review before installation.

Review the installer before use. Prefer a pinned, verified package version and confirm any changes to Claude Desktop or Cursor configuration. The networking workflow itself is consent-heavy, but it creates a persistent local identity and may make opt-in session-start inbox checks if enabled.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:361

Finding

Unpinned and Inconsistent npm Package Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:361-370 and _meta.json:15
Vulnerability Type: Supply-chain exposure caused by mutable and inconsistent npm package references
Risk Level: Medium

Vulnerable Code

SKILL.md:359-370:

markdown

## Setup

One command:

npx mingle-mcp setup

text

`npx mingle-mcp@5.0.0 setup` does the same thing. Either auto-installs and configures
Claude Desktop and Cursor. Restart your AI client.

For manual config:
```json
{
  "mcpServers": {
    "mingle": { "command": "npx", "args": ["mingle-mcp"] }
  }
}

_meta.json:15:

json

"install": "npx mingle-mcp-setup@5.0.0",

Technical Analysis

The primary setup command and manual MCP configuration invoke mingle-mcp through npx without pinning an exact version. Each fresh resolution may therefore retrieve and execute a different package release from the npm registry.

Although the documentation mentions the pinned command npx mingle-mcp@5.0.0 setup, it presents the unpinned command as the primary option and states that both are equivalent. The persistent MCP configuration also remains unpinned.

The metadata introduces a further inconsistency by specifying mingle-mcp-setup@5.0.0, while the documented installer and runtime use mingle-mcp. The audited artifact contains no executable implementation, package lockfile, or integrity hash through which the downloaded code could be verified. Consequently, the behavior of the installed software is outside the immutable audit boundary.

This is a supply-chain weakness rather than evidence that the current package is malicious.

Attack Path

1. An attacker compromises the npm publisher account, release pipeline, or package distribution path for the package resolved by npx.
2. The attacker publishes a malicious or otherwise compromised package version under the referenced package name.
3. A user follows the recommended `npx mi ...[truncated 1269 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the exact package version in every execution path:

   bash

   npx --yes mingle-mcp@5.0.0 setup
   

   json

   {
     "mcpServers": {
       "mingle": {
         "command": "npx",
         "args": ["--yes", "mingle-mcp@5.0.0"]
       }
     }
   }
   

2. Resolve the package-name discrepancy between mingle-mcp and mingle-mcp-setup. Use one documented, verified package consistently, or clearly document distinct responsibilities if both are genuinely required.

3. Prefer installing from a lockfile-controlled project with a committed npm lockfile rather than resolving registry content dynamically whenever the MCP server starts.

4. Verify package provenance and integrity using npm provenance attestations, published checksums, signatures, or an equivalent trusted mechanism.

5. Avoid automatic modification of AI-client configuration where possible. Provide the exact proposed configuration and require explicit user approval before writing it.

6. Repeat security review and compatibility testing before changing the pinned version. Use an explicit update process rather than silently tracking the latest release.

7. Consider removing the packaged legacy tool surface described in SKILL.md:530-539, even though it is disabled by default, to reduce the consequences of accidental environment-variable activation.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

md

Want me to ask for an introduction?"
- Never interrupt focused work (coding, writing, deep thinking). Queue for a natural pause.
- Two suggestions per session at most, unless the user asks for more.
- Write one line saying why each one is worth their attention, connecting it to what they are
  actually doing. "There's a security researcher who audits agent delegation chains, which is
  exactly the part you are stuck on" beats "I found a match."
- There are no scores. `find_people` returns the other person's own published words and

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill instructs the host to run npx mingle-mcp without requiring a pinned version, which allows whatever package version is current at execution time to be fetched and executed. Because this skill also configures a networked MCP server with persistent identity and local config access, a malicious or compromised future package release could gain code execution in the user's environment with little friction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description uses very broad invocation language like 'Tell your agent who you're looking for' and 'helps find the right person through their agent' without clear boundaries, consent requirements, or trigger constraints. In an agent ecosystem, this can cause over-invocation, unintended sharing of user intent or contact-seeking data, and expansion of agent-to-agent communication beyond what the user explicitly expects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.