ClawHub
Back to skill

Security audit

Wheels Router

Security checks for vulnerabilities and agentic risk

Overview

This transit-planning skill is coherent, but its setup examples rely on unpinned npx-executed packages that can run mutable third-party code on the user's machine.

Review before installing. The routing behavior fits the skill, but avoid entering sensitive home, work, or routine travel locations unless you are comfortable sending them to the remote routing service. If you use the setup, pin reviewed versions of mcporter and mcp-remote or run the MCP bridge in a restricted environment instead of relying on unpinned npx downloads.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:62
Finding

Unpinned npm Packages Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:62-63, SKILL.md:73-74, and SKILL.md:85-86
Vulnerability Type: Unpinned third-party executable dependencies
Risk Level: Medium

Vulnerable Code

bash
npx mcporter call wheels-router.search_location query="Hong Kong Airport"
npx mcporter call wheels-router.plan_trip origin="22.28,114.24" destination="22.31,113.92"
json
{
  "mcpServers": {
    "wheels-router": {
      "command": "npx",
      "args": ["mcp-remote", "https://mcp.justusewheels.com/mcp"]
    }
  }
}

The same unpinned mcp-remote configuration is also provided for Cursor, Windsurf, and VS Code clients:

json
{
  "mcpServers": {
    "wheels-router": {
      "command": "npx",
      "args": ["mcp-remote", "https://mcp.justusewheels.com/mcp"]
    }
  }
}

Technical Analysis

The documented commands execute the mcporter and mcp-remote npm packages through npx without specifying reviewed package versions or enforcing integrity checks. If a requested package is not already available locally, npx may resolve, download, and execute it from the configured npm registry.

Consequently, the code that runs can change after this skill has been reviewed. A malicious future package release, compromised maintainer or registry account, dependency-chain compromise, or unsafe registry configuration could cause attacker-controlled JavaScript to execute automatically when the documented command or MCP client configuration is used.

The audit found no evidence that the current packages or the declared MCP endpoint are malicious. The vulnerability is the unsafe, mutable dependency execution mechanism.

Attack Path

  1. An attacker compromises the publishing account, release process, or dependency chain of mcporter or mcp-remote.
  2. The attacker publishes a malicious package version under the expected package name.
  3. A user follows the documen ...[truncated 1348 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every executable npm package to an explicitly reviewed version, for example mcporter@X.Y.Z and mcp-remote@X.Y.Z.
  2. Install dependencies through a committed lockfile that records package versions and integrity hashes rather than downloading mutable releases during MCP startup.
  3. After controlled installation, invoke the local binary directly or use npx --no-install so execution fails instead of downloading an unavailable package.
  4. Configure npm to use a trusted registry and retain lockfile integrity verification in deployment and CI workflows.
  5. Review package provenance, maintainer history, transitive dependencies, and published artifacts before approving upgrades.
  6. Run MCP bridge processes in a restricted environment with minimal filesystem, credential, network, and process permissions.
  7. Document an upgrade procedure requiring security review and testing before changing pinned versions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill describes sending location searches, trip origins, destinations, and travel times to external services but does not clearly warn users that these potentially sensitive travel queries and coordinates leave the local environment. Travel patterns and precise coordinates can reveal home/work locations, routines, and other personal information, so the omission creates a meaningful privacy and data-handling risk. The transit-planning context makes this more sensitive because the core inputs are inherently location-based.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs users to run npx mcporter without pinning a specific package version. Because npx resolves and executes packages dynamically, a compromised or maliciously updated package release could execute arbitrary code on the user's machine during installation or invocation. In this context, the risk is real because the skill is explicitly telling users how to connect to an external MCP service via local tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This command example again relies on unpinned npx mcporter, which may download and execute the latest published package version at runtime. If the package supply chain is compromised, an attacker could gain code execution on the client system simply by following the documented setup instructions. The repetition increases exposure because users may copy-paste these commands directly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.