Snipara Mcp

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:59 AM UTC
• Version: 0.1.0

Overview

This appears to be a legitimate Snipara MCP client, but it gives agents broad remote memory and document-management powers and can surface remote API content as instructions.

Install only if you are comfortable sending selected documentation, queries, preferences, summaries, and agent coordination data to Snipara. Avoid uploading secrets or regulated data, use least-privilege project credentials, pin package versions where possible, review sync/delete operations before allowing them, and treat any returned templates, shared context, or instructions as untrusted reference content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:475

Finding

Unverified Remote Installer Is Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Location: README.md:475
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

curl -LsSf https://astral.sh/uv/install.sh | sh

Technical Analysis

The troubleshooting instructions pipe a remotely retrieved installation script directly into sh. The fetched content is mutable and is executed without prior inspection, version pinning, checksum validation, or cryptographic signature verification.

Although the documented URL is the official-looking uv installation endpoint, this pattern transfers execution trust to every component in the delivery path, including the domain, DNS infrastructure, hosting/CDN systems, redirects, TLS trust chain, and future versions of the remote script. A compromise or unexpected change at any point can alter the effective payload after this project has been reviewed.

This behavior is not required for the Skill's core documentation-search functionality. It is only a convenience instruction for installing an external package manager and therefore exceeds the minimum risk necessary to run the Skill.

Attack Path

1. An attacker compromises or gains influence over the installer hosting infrastructure, DNS resolution, redirect destination, or remote script publication process.
2. The attacker modifies the response from https://astral.sh/uv/install.sh to include malicious shell commands.
3. A user follows the README troubleshooting instruction.
4. curl downloads the modified response and immediately streams it to sh.
5. The malicious commands execute with the privileges of the user running the instruction.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The resulting payload could read accessible credentials and source code, modify user-owned files and shell configuration, install persistence, tamper with development t ...[truncated 335 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer installation through a trusted operating-system package manager or another distribution channel that verifies signed package metadata.
2. If a standalone release is necessary, pin a specific release version and provide its expected cryptographic checksum or signature.
3. Replace direct piping with a staged procedure:

   bash

   curl -fL -o uv-install.sh https://astral.sh/uv/install.sh
   # Verify the documented checksum or signature here.
   less uv-install.sh
   sh uv-install.sh
   

4. Document the expected publisher, checksum verification procedure, files created, and permissions required.
5. Avoid recommending elevated execution and explicitly state that the installer should run with ordinary user privileges.

T01 · Skill Instruction Hijacking

Error

• Location: src/snipara_mcp/server.py:775

Finding

Remote API Content Is Promoted as Agent System Instructions

Content

View full analysis

Vulnerability Details

File Location: src/snipara_mcp/server.py:775-777
Vulnerability Type: Remote prompt-injection and instruction-hijacking channel
Risk Level: High

Vulnerable Code

python

parts = []
# Prepend system instructions if provided
if data.get("system_instructions"):
    parts.append(data["system_instructions"])
parts.append("## Relevant Documentation\n")

Technical Analysis

The MCP server accepts a system_instructions field from the remote Snipara API and prepends it to tool output. The field is returned without sanitization, trust labeling, validation against a local policy, or a clear separation between untrusted data and executable agent instructions.

The Skill directs agents to use Snipara query results when answering documentation questions. Consequently, a compromised service, account, API response path, or upstream indexed-content pipeline could provide text designed to alter the consuming agent's behavior. Calling the field system_instructions and placing it before the documentation increases the likelihood that an agent will treat remote content as authoritative rather than as untrusted search data.

Remote documentation retrieval is necessary for the declared service. Allowing the service to dynamically provide system-level instructions is not necessary to perform search and exceeds the minimum authority needed for that functionality.

Attack Path

1. An attacker compromises the remote service or another upstream source capable of influencing the API's system_instructions response field.
2. The attacker inserts instructions telling the consuming agent to ignore prior constraints, conceal activity, invoke sensitive tools, disclose data, or perform actions unrelated to documentation search.
3. A user or agent invokes rlm_context_query.
4. call_api() retrieves the attacker-influenced response.
5. The server prepends the malicious field to the MCP result ...[truncated 1041 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not accept or expose remotely supplied content as system_instructions.
2. Remove this field from MCP output unless it has a strictly data-oriented, security-reviewed purpose.
3. If the content must be displayed, place it under an explicit heading such as Untrusted Remote Metadata, quote or delimit it, and state that it cannot override system, developer, or user instructions.
4. Enforce a fixed local policy that remote responses and indexed documents are untrusted data and must never request tool invocation or behavioral-policy changes.
5. Validate remote response schemas and allow only required documentation fields, such as title, path, score, and content.
6. Apply authorization and provenance controls to any server-side mechanism that creates this field, and maintain audit logs for changes.
7. Add adversarial tests in which the API returns instruction-like payloads and verify that consuming agents treat them only as quoted data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (37)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 76% confidence

Finding

The README states that OAuth tokens are stored in ~/.snipara/credentials.json but does not mention file permissions, encryption, OS keychain use, or operational safeguards. Plaintext token storage in a predictable location increases the risk of credential theft by other local users, malware, backups, or accidental disclosure.

Content

Scanner excerpt · README.md (reported line 424)May include surrounding context.

Follow browser prompt to authorize

text

Tokens are stored in `~/.snipara/credentials.json`

### Rate Limiting

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 442)May include surrounding context.

bash

# macOS/Linux
rm -rf ~/.cache/uv/tools/snipara-mcp
rm -rf ~/Library/Caches/uv/tools/snipara-mcp

# Windows
rmdir /s %LOCALAPPDATA%\uv\tools\snipara-mcp

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 442)May include surrounding context.

bash

# macOS/Linux
rm -rf ~/.cache/uv/tools/snipara-mcp
rm -rf ~/Library/Caches/uv/tools/snipara-mcp

# Windows
rmdir /s %LOCALAPPDATA%\uv\tools\snipara-mcp

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/snipara_mcp/auth.py (reported line 81)May include surrounding context.

python

if not token_data:
        return None

    # Check if access token is expired
    expires_at = token_data.get("expires_at")
    if expires_at:
        try:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/snipara_mcp/auth.py (reported line 189)May include surrounding context.

python

if not token_data:
        return None

    # Check if access token is expired
    expires_at = token_data.get("expires_at")
    if expires_at:
        try:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · src/snipara_mcp/auth.py (reported line 257)May include surrounding context.

python

interval = device_data.get("interval", 5)
        expires_in = device_data.get("expires_in", 1800)

        # Step 2: Display instructions
        print("\n" + "=" * 50)
        print("  Snipara MCP Authentication")
        print("=" * 50)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to run uvx snipara-mcp without pinning a specific version. Because uvx resolves and executes the latest package version, a compromised upstream release or typosquatted replacement could result in arbitrary code execution on user machines. In an MCP context this is more dangerous because the package is installed/executed directly by AI tooling and may receive access to secrets and local project data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This example adds the MCP server via uvx snipara-mcp without version pinning, causing runtime retrieval of whatever version is current at execution time. That exposes users to supply-chain compromise and makes deployed behavior non-reproducible, especially risky for an MCP server that can access credentials and repository context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README promotes persistent memory storage, shared context injection, and document upload/sync features without clearly warning users that sensitive source code, prompts, preferences, or proprietary data may be transmitted to and retained by a third-party service. In an MCP/agent setting, operators may enable these capabilities broadly, making accidental privacy and data-governance violations more likely.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The testing instruction uvx snipara-mcp executes an unpinned package from the package index. Unpinned execution creates a supply-chain risk where a later malicious or compromised release could run attacker-controlled code during setup or startup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Piping input to uvx snipara-mcp still invokes an unpinned remotely resolved package. If the package supply chain is compromised, the attack occurs before or during handling of the test payload, potentially exposing local environment variables and project data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The README instructs users to POST document contents to api.snipara.com, which is an external transmission of potentially sensitive repository data. Although this is the advertised purpose of the product and uses HTTPS, it still creates a real exfiltration/data-governance risk if users sync secrets, proprietary code, or regulated information without adequate warning or filtering.

Content

Scanner excerpt · README.md (reported line 503)May include surrounding context.

Auto-sync docs on git push:

bash

curl -X POST "https://api.snipara.com/v1/YOUR_PROJECT/webhook/sync" \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"documents": [{"path": "docs/api.md", "content": "..."}]}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The README instructs users to POST document contents to api.snipara.com, which is an external transmission of potentially sensitive repository data. Although this is the advertised purpose of the product and uses HTTPS, it still creates a real exfiltration/data-governance risk if users sync secrets, proprietary code, or regulated information without adequate warning or filtering.

Content

Scanner excerpt · README.md (reported line 503)May include surrounding context.

Auto-sync docs on git push:

bash

curl -X POST "https://api.snipara.com/v1/YOUR_PROJECT/webhook/sync" \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"documents": [{"path": "docs/api.md", "content": "..."}]}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill promotes storing and recalling persistent user preferences across sessions, but does not clearly warn that potentially sensitive user data may be retained by an external service. This can lead agents or users to store secrets, personal data, or internal decisions without informed consent, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The upload and bulk sync features instruct agents to send document contents to Snipara without a prominent warning that repository or documentation data leaves the local environment and is transmitted to a third-party service. In the context of codebase assistants, this is especially risky because uploaded docs may contain proprietary architecture, internal procedures, secrets, or regulated data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The status command prints the first portion of the API key to stdout, which can expose credential material through terminal history, screen sharing, logs, or CI/remote session capture. Even partial secrets can aid identification, correlation, or brute-force reduction and are unnecessary for normal status reporting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool unconditionally sends user-supplied tool inputs and project-scoped data to an external HTTPS endpoint, but neither the API wrapper nor the tool descriptions provide an explicit disclosure that data leaves the local agent/runtime boundary. In an agent-skill context, users may reasonably assume queries, file paths, memory contents, or project identifiers are handled locally, so silent external transmission creates a real privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The memory tools accept arbitrary content, metadata, and scope values and forward them to the remote API, enabling persistent transmission of potentially sensitive internal knowledge without a clear privacy warning. Because 'remember', 'recall', and related functions are framed as agent-memory features, users may not realize secrets, decisions, or contextual data are being stored and processed by an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document-management tools can remotely create, overwrite, or delete documentation state, including bulk deletion via 'delete_missing', yet the interface lacks strong destructive-action warnings or confirmation semantics. In an agent environment this is dangerous because an LLM or user may invoke sync/update behavior expecting local staging, while actually modifying authoritative remote project content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module advertises itself as a documentation-query bridge, but the exposed toolset also allows writes, deletions, persistent memory storage, and multi-agent coordination. This capability mismatch can mislead users and host agents into granting trust or invoking the server under a read-only assumption, increasing the risk of unintended data modification or disclosure.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Session context injection stores arbitrary context across subsequent requests, creating a cross-request leakage channel where one task's sensitive data can be silently incorporated into another task's outbound query. In a multi-user or multi-task agent environment, this persistence increases the chance of accidental disclosure and prompt contamination.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The memory features expand the server from documentation retrieval into persistent storage and later semantic recall of user, team, or project data. In an agent setting this creates a durable retention surface for sensitive natural-language information that may be stored or resurfaced without clear user expectation at the time of use.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The memory tool descriptions explicitly encourage storing preferences, decisions, and contextual facts for later recall, normalizing retention of sensitive natural-language data. In agent workflows, such memory can be unintentionally shared, resurfaced out of context, or queried by other components with broader access than the original user intended.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.