Zulk Short URL Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:42 PM UTC
• Version: 0.1.4

Overview

The skill is mostly coherent for a URL-shortener MCP integration, but it includes an unpinned npx bridge and account/team management capabilities that need careful review before use.

Use the HTTP MCP configuration when possible instead of the npx stdio bridge. Before authenticating, confirm you are comfortable letting the Zu.lk MCP integration read and modify links, analytics, organizations, and team membership for the account or organization you connect, especially for admin or owner roles.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:66

Finding

Unpinned and Inconsistent npm Packages Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:10 and SKILL.md:66-67
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Complete Code Snippets:

yaml

mcp_command: npx mcp-remote https://mcp.zu.lk/mcp

json

{
  "mcpServers": {
    "zulk-url-shortener": {
      "command": "npx",
      "args": ["mcporter", "https://mcp.zu.lk/mcp"]
    }
  }
}

Technical Analysis

The Skill instructs users to launch an npm package through npx without pinning an exact package version or verifying package integrity. Depending on the local npm configuration and cache, npx can retrieve package code from the configured npm registry and execute it immediately.

The package identity is also inconsistent: the metadata specifies mcp-remote, while the stdio configuration example specifies mcporter. The repository does not vendor, lock, or verify either package. Consequently, the locally executed code is not fully represented by the audited project and may change after this Skill has been reviewed.

This creates a supply-chain risk if the selected package or one of its transitive dependencies is compromised, replaced, or publishes an unsafe update. The audit found no evidence that either named package is currently malicious; the vulnerability is the unsafe, mutable dependency execution mechanism.

Attack Path

1. A user copies or activates the documented stdio MCP configuration.
2. The MCP-compatible client starts npx mcporter https://mcp.zu.lk/mcp or follows the metadata command using mcp-remote.
3. npx resolves the unpinned package from the user's configured npm registry, potentially downloading the latest available release.
4. A compromised or unexpectedly modified package, installation script, or transitive dependency executes on the user's machine.
5. The package code runs with the operating-system privileges and environment access of the MCP clie ...[truncated 616 chars]

Remediation

View remediation

Remediation Suggestions

1. Select one verified MCP bridge package and use it consistently in both metadata and configuration examples.
2. Pin the package to an exact reviewed version, such as package-name@x.y.z, rather than allowing npx to resolve a mutable latest release.
3. Prefer installing the dependency through a committed lockfile with npm integrity hashes and executing the locked local binary.
4. Verify the package publisher, provenance, release signatures where available, and transitive dependency tree before recommending it.
5. Disable or carefully review dependency lifecycle scripts where operationally feasible.
6. Prefer the direct HTTPS MCP transport documented by the Skill when the client supports it, because that avoids executing an npm bridge locally.
7. Document the dependency's trust boundary and advise users that stdio mode executes third-party code with their local account privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill metadata and installation guidance reference execution of a remote MCP bridge via NPX without pinning an exact package version or integrity-verified source. This creates a supply-chain risk: a future malicious or compromised package release could be pulled and executed automatically in the user's environment, especially because the skill explicitly instructs users to install and run it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The overview describes link creation, analytics access, organization management, and member administration, but it does not warn users that connecting this skill can expose account, organization, member, and analytics data to a third-party remote MCP service or allow modifications to those resources. In an agent context, missing disclosure is dangerous because users may authorize the skill expecting simple URL shortening while the toolset enables broader read/write actions over collaborative resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The authentication instructions mention following an OAuth URL to sign in, but they omit that authentication grants the remote Zu.lk MCP service access to the user's account-scoped data and management capabilities. This is risky because users may consent to OAuth without understanding the scope of data sharing and remote actions the service can perform through the agent integration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.