Security audit

plan-to-eat

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Plan to Eat integration that needs account credentials and read/write access to meal-planning data, with ordinary supply-chain cautions around its install commands.

Install only from the package/version or repository you trust, prefer the pinned npm command over the clone-from-default-branch path, and keep the Plan to Eat password and session file scoped to your own account and machine.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:44
Finding: Third-Party Code Installation Without Immutable Source Pinning
Content: View full analysis
Remediation: View remediation
``` 2. Publish expected package integrity information and verify the downloaded npm artifact against that value before execution. 3. Require verification of npm provenance and signatures before launching or globally installing the package. Verification should confirm the expected package identity, source repository, release version, and build origin. 4. Use a committed lockfile with integrity fields for clone-based installation. Prefer deterministic installation such as `npm ci` instead of an unconstrained `npm install`. 5. Disable lifecycle scripts during dependency acquisition where feasible: ```bash npm ci --ignore-scripts ``` Any required lifecycle or build scripts should then be reviewed and run explicitly. 6. Avoid global installation where possible. Execute the server in an isolated environment or container with access only to the required credentials, session file, and network destinations. 7. Apply least privilege to the session cache and credential environment. Ensure the session file is readable only by its owner and is not placed in a shared or world-readable directory. 8. Document a trusted release-verification procedure that users must complete before installation, rather than presenting post-installation verification as optional. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.