T08 · Insecure Dependencies
Error
- Location
SKILL.md:26- Finding
Unpinned Third-Party Packages Are Downloaded and Executed Automatically
- Content
View full analysis
- Remediation
View remediation
Security audit
追剧/追番技能, 支持投屏到电视
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for searching and casting video streams, but it repeatedly tells users to auto-download and run unpinned third-party packages with local-network access.
Install only if you trust the current and future publishers of both `mcporter` and `mcp-vods`, or run pinned, reviewed versions in a sandbox. Be aware that searches and playback actions may reveal viewing interests, media URLs, and local TV addresses to source sites, tooling, or devices on your network.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (14)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The skill instructs use of
npx -y mcporterwithout pinning a specific version, so each execution may fetch and run whatever package version is currently published. This creates a supply-chain risk where a compromised upstream package, malicious update, or typo-squatted dependency could lead to arbitrary code execution in the user's environment.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill describes searching multiple source sites and pushing media URLs to TV devices but does not clearly warn users that their search terms, selected URLs, and device addresses may be transmitted to third-party services and local-network endpoints. This omission undermines informed consent and can expose viewing interests, media links, and internal device information.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The server component
uvx mcp-vodsis also unpinned, so the skill may download and run whatever version is currently available. This creates the same supply-chain and arbitrary code execution risk as unpinnednpx, now affecting the MCP server process itself.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The server component
uvx mcp-vodsis also unpinned, so the skill may download and run whatever version is currently available. This creates the same supply-chain and arbitrary code execution risk as unpinnednpx, now affecting the MCP server process itself.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The documented
uvx mcp-vodscommand lacks version pinning and may execute a newly published or compromised release without review. Because this component brokers searches and playback actions, compromise could affect both privacy and local-device interactions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The documented
uvx mcp-vodscommand lacks version pinning and may execute a newly published or compromised release without review. Because this component brokers searches and playback actions, compromise could affect both privacy and local-device interactions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The TV playback example runs
uvx mcp-vodswithout pinning, enabling unreviewed code execution in a context that can reach local-network devices. That combination makes compromise more dangerous than a simple read-only content search tool.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The TV playback example runs
uvx mcp-vodswithout pinning, enabling unreviewed code execution in a context that can reach local-network devices. That combination makes compromise more dangerous than a simple read-only content search tool.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
This line repeats the unpinned
uvx mcp-vodspattern for Android TV playback. If the package is malicious or compromised, it may misuse local IP configuration and send arbitrary requests to connected devices or exfiltrate data.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
This line repeats the unpinned
uvx mcp-vodspattern for Android TV playback. If the package is malicious or compromised, it may misuse local IP configuration and send arbitrary requests to connected devices or exfiltrate data.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Even the tool-listing example uses unpinned
uvx mcp-vods, which still requires fetching and executing code. Users may treat listing operations as safe reconnaissance, but they remain subject to the same supply-chain risks.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Even the tool-listing example uses unpinned
uvx mcp-vods, which still requires fetching and executing code. Users may treat listing operations as safe reconnaissance, but they remain subject to the same supply-chain risks.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The recommendation to prefer
npx -y mcportergenerally institutionalizes an unsafe execution pattern across the skill. Even though this is prose rather than a single command, it encourages repeated use of an unpinned package with supply-chain execution risk.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
All user-facing natural-language content in the skill description is written in Chinese, with no indication that users may interact in other languages or that the skill is intentionally restricted to a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in is a locale-policy concern.
- Content
Static analysis
No suspicious patterns detected.