LemGen AI Design

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.0.0

Overview

The skill’s purpose is coherent, but its setup runs an unpinned external MCP server and gives it a LemGen API token, so it needs careful review before use.

Install only if you are comfortable trusting the referenced GitHub MCP server. Prefer pinning it to a reviewed commit or release, using a revocable low-scope LemGen token, and running the MCP server with minimal filesystem and network access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:66

Finding

Unpinned Third-Party MCP Server Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 66–75
Vulnerability Type: Unpinned remote dependency execution
Risk Level: High

Vulnerable Code

json

{
  "mcpServers": {
    "lemgen": {
      "command": "npx",
      "args": ["-y", "github:aithink001/lemgen-ai-design-mcp"],
      "env": {
        "LEMGEN_API_TOKEN": "sk_..."
      }
    }
  }
}

Technical Analysis

The recommended configuration invokes npx -y against a mutable GitHub repository reference. It does not pin the MCP server to an audited commit SHA or immutable package version, nor does it specify an integrity checksum.

Consequently, the code executed when a user follows these instructions can differ from the code that existed when this skill was reviewed. The -y option suppresses the interactive installation confirmation, making retrieval and execution automatic. The downloaded MCP process is also supplied with LEMGEN_API_TOKEN, placing that credential within the trust boundary of code that is absent from this project and cannot be audited here.

This is a supply-chain weakness rather than proof that the current upstream repository is malicious.

Attack Path

1. An attacker compromises the referenced GitHub repository, a maintainer account, or another part of its software supply chain.
2. The attacker changes the repository's default revision to include a malicious installation hook or MCP server payload.
3. A user copies the documented configuration and starts the MCP host.
4. npx -y retrieves and executes the current attacker-controlled revision without requesting installation confirmation.
5. The payload runs with the permissions of the MCP host process.
6. Because LEMGEN_API_TOKEN is injected into the process environment, the payload can read and misuse or disclose that token.
7. Subject to the host's operating-system permissions and network controls, the payload could access other files, credentials, or network resources available to that pro ...[truncated 634 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, immutable full commit SHA rather than a repository's mutable default revision.
2. Prefer a versioned release artifact with a verified cryptographic integrity hash and documented provenance.
3. Remove -y where practical so installation or source changes do not proceed without operator review.
4. Vendor or otherwise inspect the exact MCP implementation before deployment, including package lifecycle hooks and transitive dependencies.
5. Run the MCP server in a sandbox or container with a read-only filesystem, minimal host mounts, restricted outbound networking, and a dedicated unprivileged account.
6. Use a narrowly scoped, revocable LemGen token and rotate it if compromise is suspected.
7. Add dependency update controls so each upstream revision requires explicit security review before deployment.
8. Document the exact reviewed source revision and an integrity-verification procedure in the setup instructions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.