ClawHub
Back to skill

Security audit

Stellary MCP

Security checks for vulnerabilities and agentic risk

Overview

This is a clearly disclosed connector to Stellary’s hosted MCP service, but users should treat its token and install command carefully.

Install only if you trust Stellary with the projects and documents exposed by your token. Use a dedicated, least-privilege token with an expiry date, prefer read-only scopes until writes are needed, revoke the token if it leaks, and avoid pasting live tokens into repos or chat logs. If using the README npx installer, pin or verify the installer package and do not run it with elevated privileges.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:97
Finding

Unpinned npx Package Execution in Installation Guidance

Content
View full analysis

Vulnerability Details

File Locations: README.md:97 and README.fr.md:77
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

README.md:97:

markdown
| skills.sh / ClawHub | [`SKILL.md`](SKILL.md) (`npx skills add Anymfah/stellary-mcp`) |

README.fr.md:77 contains the equivalent command:

markdown
| skills.sh / ClawHub | [`SKILL.md`](SKILL.md) (`npx skills add Anymfah/stellary-mcp`) |

Technical Analysis

The documented command invokes the unversioned skills package through npx. If the package is not already installed locally, npx may retrieve its current release from the configured npm registry and execute it immediately.

Because neither a reviewed package version nor an integrity value is specified, the code executed by this installation command can change after this repository has been audited. This creates a mutable supply-chain trust boundary: compromise of the package, its publisher account, or the package-resolution source could cause users to execute code that was not part of this reviewed project.

The repository's own package.json has no third-party dependencies or lifecycle hooks, so this risk is limited to users who follow the documented installation command. No evidence indicates that the current skills package is malicious.

Attack Path

  1. An attacker compromises the publishing account, registry entry, or distribution path for the package resolved as skills.
  2. The attacker publishes a modified release containing malicious executable behavior or lifecycle scripts.
  3. A user follows the documented npx skills add Anymfah/stellary-mcp command.
  4. npx resolves and downloads the mutable package release.
  5. The downloaded package executes with the privileges and environment of the invoking user.
  6. Malicious code could access files, environment variables, network resources, and credentials available to ...[truncated 764 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the installer to a specific reviewed version, for example:

    bash
    npx --yes skills@<reviewed-version> add Anymfah/stellary-mcp

  2. Verify that the pinned version is obtained from the intended publisher and registry before documenting it.

  3. Where tooling permits, enforce package integrity using a lockfile, checksum, signed provenance, or equivalent verification.

  4. Update both README.md and README.fr.md so that all installation instructions use the same pinned and reviewed release.

  5. Document that users must not run the installation command with sudo or another elevated account.

  6. Prefer a non-executing manual installation procedure when practical, such as copying the reviewed SKILL.md and manifest files into the client configuration.

  7. Establish a release process that explicitly reviews and updates the pinned installer version rather than automatically tracking the latest package.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (40)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .claude-plugin/plugin.json (reported line 6)May include surrounding context.

json
{
  "name": "stellary",
  "version": "0.12.1",
  "description": "Connect Cursor to Stellary, the AI-native project piloting SaaS, through the hosted Streamable HTTP MCP server. Discover projects, boards, documents, cockpit state, and governed agent missions using a Bearer personal access token.",
  "author": {
    "name": "Stellary",
    "email": "support@stellary.co"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .cursor-plugin/plugin.json (reported line 4)May include surrounding context.

json
{
  "name": "stellary",
  "version": "0.12.1",
  "description": "Connect Cursor to Stellary, the AI-native project piloting SaaS, through the hosted Streamable HTTP MCP server. Discover projects, boards, documents, cockpit state, and governed agent missions using a Bearer personal access token.",
  "author": {
    "name": "Stellary",
    "email": "support@stellary.co"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .cursor-plugin/plugin.json (reported line 26)May include surrounding context.

json
{
  "name": "stellary",
  "version": "0.12.1",
  "description": "Connect Cursor to Stellary, the AI-native project piloting SaaS, through the hosted Streamable HTTP MCP server. Discover projects, boards, documents, cockpit state, and governed agent missions using a Bearer personal access token.",
  "author": {
    "name": "Stellary",
    "email": "support@stellary.co"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 3)May include surrounding context.

text
.DS_Store
node_modules/
.env
.env.*
*.log

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 10)May include surrounding context.

md
method or tool, the impact, and reproducible steps when possible.

Do not open a public GitHub issue for a suspected vulnerability and do not
include access tokens, personal data, or customer workspace data in a report.

We will acknowledge a valid report and coordinate remediation and disclosure
directly with the reporter.

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

This line explicitly requires a personal access token and states it will be transmitted as a bearer credential to the hosted MCP. Because PATs often confer broad account access, compromise, over-scoping, logging, or misuse of that token could expose projects, documents, cards, and possibly allow writes depending on granted scopes.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
envVars:
      - name: STELLARY_TOKEN
        required: true
        description: Stellary personal access token sent as Authorization Bearer to https://api.stellary.co/mcp when the remote MCP is not already connected.
---

# Stellary remote MCP

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill documents multiple credential classes, including personal access tokens, user JWTs, and agent tokens, each of which can unlock different privilege domains. In a hosted MCP context, encouraging use of powerful bearer credentials increases the blast radius if the endpoint, client, logs, or downstream tools are compromised or if the wrong token type is used.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
| Bearer | Identity | Use for |
| --- | --- | --- |
| Personal access token | Human user | Interactive board, document, and cockpit work in Cursor, Claude Code, Gemini CLI |
| User JWT | Human user | Short-lived browser-backed sessions |
| Agent token | Workspace agent | Queued missions, `stellary_init`, installed plugin tools (GitHub, Slack, and similar) |
| `MCP_TOKEN` | Transport gate only | Not enough for current Stellary tools that need a user or agent |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.fr.md (reported line 10)May include surrounding context.

md
{
  "name": "stellary",
  "version": "0.12.1",
  "description": "Connect Gemini CLI to Stellary, the AI-native project piloting SaaS, through the hosted Streamable HTTP MCP at https://api.stellary.co/mcp. Authenticate with a Bearer personal access token (not OAuth, not a local stdio server).",
  "mcpServers": {
    "stellary": {
      "httpUrl": "https://api.stellary.co/mcp",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

md
{
  "name": "stellary",
  "version": "0.12.1",
  "description": "Connect Gemini CLI to Stellary, the AI-native project piloting SaaS, through the hosted Streamable HTTP MCP at https://api.stellary.co/mcp. Authenticate with a Bearer personal access token (not OAuth, not a local stdio server).",
  "mcpServers": {
    "stellary": {
      "httpUrl": "https://api.stellary.co/mcp",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
{
  "name": "stellary",
  "version": "0.12.1",
  "description": "Connect Gemini CLI to Stellary, the AI-native project piloting SaaS, through the hosted Streamable HTTP MCP at https://api.stellary.co/mcp. Authenticate with a Bearer personal access token (not OAuth, not a local stdio server).",
  "mcpServers": {
    "stellary": {
      "httpUrl": "https://api.stellary.co/mcp",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · gemini-extension.json (reported line 4)May include surrounding context.

json
{
  "name": "stellary",
  "version": "0.12.1",
  "description": "Connect Gemini CLI to Stellary, the AI-native project piloting SaaS, through the hosted Streamable HTTP MCP at https://api.stellary.co/mcp. Authenticate with a Bearer personal access token (not OAuth, not a local stdio server).",
  "mcpServers": {
    "stellary": {
      "httpUrl": "https://api.stellary.co/mcp",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · server.json (reported line 28)May include surrounding context.

json
{
  "name": "stellary",
  "version": "0.12.1",
  "description": "Connect Gemini CLI to Stellary, the AI-native project piloting SaaS, through the hosted Streamable HTTP MCP at https://api.stellary.co/mcp. Authenticate with a Bearer personal access token (not OAuth, not a local stdio server).",
  "mcpServers": {
    "stellary": {
      "httpUrl": "https://api.stellary.co/mcp",

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The extension requires a long-lived personal access token to be provided via environment variable and sent as a Bearer credential to a third-party hosted MCP. This creates a genuine credential-risk surface because compromise of the local environment, logs, misconfiguration, or the remote service could expose a reusable token with access to Stellary resources.

Content

Scanner excerpt · gemini-extension.json (reported line 16)May include surrounding context.

json
"settings": [
    {
      "name": "Stellary token",
      "description": "Personal access token from Stellary Account settings → API tokens. Required as Authorization Bearer for https://api.stellary.co/mcp.",
      "envVar": "STELLARY_TOKEN",
      "sensitive": true
    }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · .claude-plugin/marketplace.json (reported line 10)May include surrounding context.

json
"mcpServers": {
    "stellary": {
      "type": "http",
      "url": "https://api.stellary.co/mcp",
      "headers": {
        "Authorization": "Bearer ${STELLARY_TOKEN}"
      }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · .claude-plugin/plugin.json (reported line 6)May include surrounding context.

json
"mcpServers": {
    "stellary": {
      "type": "http",
      "url": "https://api.stellary.co/mcp",
      "headers": {
        "Authorization": "Bearer ${STELLARY_TOKEN}"
      }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · .cursor-plugin/plugin.json (reported line 26)May include surrounding context.

json
"mcpServers": {
    "stellary": {
      "type": "http",
      "url": "https://api.stellary.co/mcp",
      "headers": {
        "Authorization": "Bearer ${STELLARY_TOKEN}"
      }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · .mcp.json (reported line 5)May include surrounding context.

json
"mcpServers": {
    "stellary": {
      "type": "http",
      "url": "https://api.stellary.co/mcp",
      "headers": {
        "Authorization": "Bearer ${STELLARY_TOKEN}"
      }

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This line instructs the client to send a bearer token to a third-party hosted MCP endpoint. Although intentional, it creates a real credential exposure boundary: any user who enables the skill is authorizing an external service to receive authentication material and potentially all prompted project data routed through that MCP.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
envVars:
      - name: STELLARY_TOKEN
        required: true
        description: Stellary personal access token sent as Authorization Bearer to https://api.stellary.co/mcp when the remote MCP is not already connected.
---

# Stellary remote MCP

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill is configured to send requests to a third-party remote MCP service at api.stellary.co, which creates an explicit external data transmission path. In this context, prompts, tool inputs, tool outputs, and workspace metadata may be exposed to the remote service, so the risk is real even though the integration appears intentional rather than malicious.

Content

Scanner excerpt · gemini-extension.json (reported line 7)May include surrounding context.

json
"description": "Connect Gemini CLI to Stellary, the AI-native project piloting SaaS, through the hosted Streamable HTTP MCP at https://api.stellary.co/mcp. Authenticate with a Bearer personal access token (not OAuth, not a local stdio server).",
  "mcpServers": {
    "stellary": {
      "httpUrl": "https://api.stellary.co/mcp",
      "headers": {
        "Authorization": "Bearer ${STELLARY_TOKEN}"
      }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.fr.md (reported line 8)May include surrounding context.

md
{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "stellary",
  "description": "Connect GitHub Copilot to Stellary project management: boards, documents, cockpit, and governed agent missions via the hosted MCP server at https://api.stellary.co/mcp.",
  "version": "0.12.1",
  "keywords": [
    "stellary",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.fr.md (reported line 29)May include surrounding context.

md
{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "stellary",
  "description": "Connect GitHub Copilot to Stellary project management: boards, documents, cockpit, and governed agent missions via the hosted MCP server at https://api.stellary.co/mcp.",
  "version": "0.12.1",
  "keywords": [
    "stellary",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.fr.md (reported line 39)May include surrounding context.

md
{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "stellary",
  "description": "Connect GitHub Copilot to Stellary project management: boards, documents, cockpit, and governed agent missions via the hosted MCP server at https://api.stellary.co/mcp.",
  "version": "0.12.1",
  "keywords": [
    "stellary",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

md
{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "stellary",
  "description": "Connect GitHub Copilot to Stellary project management: boards, documents, cockpit, and governed agent missions via the hosted MCP server at https://api.stellary.co/mcp.",
  "version": "0.12.1",
  "keywords": [
    "stellary",