Expanso cve-scan

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:54 PM UTC
• Version: 1.0.0

Overview

The skill is a mostly coherent CVE scanner, but its MCP mode exposes an unauthenticated network service on all interfaces and the CLI sends SBOM package data to OSV without clear top-level warning.

Review before installing or running in a sensitive environment. Use the CLI only if you are comfortable sending dependency names and versions from the SBOM to OSV, and do not expose the MCP pipeline on an untrusted network without binding it to localhost or adding authentication and request limits.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: pipeline-mcp.yaml:6

Finding

Unauthenticated HTTP Scan Endpoint Exposed on All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: pipeline-mcp.yaml, lines 6-14
Vulnerability Type: Unauthenticated network service with unrestricted interface binding
Risk Level: Medium

Vulnerable Code

yaml

config:
  http:
    enabled: true
    address: "0.0.0.0:${PORT:-8080}"

  input:
    http_server:
      path: /scan
      allowed_verbs: [POST]
      timeout: 120s

Technical Analysis

The MCP pipeline binds its HTTP server to 0.0.0.0, making the service reachable through every available network interface. The /scan endpoint accepts POST requests without any configured authentication or authorization control.

No request-body size limit, component-count limit, or rate limit is defined. The subsequent mapping processor parses the caller-supplied sbom object and traverses its components array. A remote client with network access can therefore submit oversized SBOM documents or repeatedly invoke the endpoint, consuming parsing, memory, and processing resources.

Attack Path

1. An attacker identifies a host running the MCP pipeline on its configured port, which defaults to TCP port 8080.
2. The attacker connects to the service through any reachable interface.
3. The attacker sends unauthenticated POST /scan requests containing very large JSON bodies or SBOM objects with oversized components arrays.
4. The pipeline parses and traverses each accepted request.
5. Repeated or concurrent requests consume service resources and may degrade availability.

Impact Assessment

A remote attacker with network connectivity can invoke the endpoint without credentials. This does not provide operating-system privileges or code execution based on the reviewed configuration. However, it permits unauthorized service use and creates a denial-of-service risk through excessive request size, component volume, or request frequency. The exposure scope includes every network from which the conf ...[truncated 35 chars]

Remediation

View remediation

Remediation Suggestions

1. Bind the server to 127.0.0.1 by default unless remote access is explicitly required.
2. Require authenticated access for remote deployments, such as API-key validation, mutual TLS, or authentication enforced by a trusted reverse proxy.
3. Add authorization controls so only approved clients can invoke the scan operation.
4. Enforce a strict maximum HTTP request-body size before JSON parsing.
5. Validate the SBOM schema and impose a maximum number of components and maximum lengths for component fields.
6. Add per-client rate limiting, concurrency limits, and bounded processing time.
7. Place the service behind firewall or network-policy restrictions and expose the listening port only to trusted networks.
8. Document that binding to 0.0.0.0 creates remote network exposure and should require an explicit deployment choice.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The pipeline transmits package names, versions, and potentially identifying dependency metadata derived from the SBOM to the external OSV service without any explicit user-facing disclosure or consent mechanism. Even though OSV is the intended vulnerability database and this behavior is functionally aligned with the skill's purpose, SBOM contents can reveal proprietary technologies, internal components, or unreleased software composition details.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This skill performs an outbound HTTP POST to a third-party API, sending dependency inventory data off-host. In context, the network call is expected for CVE lookups and does not appear covert or malicious, but it still creates a real data egress path that may expose sensitive software composition information to an external service.

Content

Scanner excerpt · pipeline-cli.yaml (reported line 58)May include surrounding context.

yaml

}

      - http:
          url: "https://api.osv.dev/v1/querybatch"
          verb: POST
          headers:
            Content-Type: "application/json"

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This is a manifest file, so vague-trigger review applies. The file describes usage and purpose, but it does not specify any narrow invocation conditions, exclusions, or negative examples beyond the filename, which can make the skill's activation scope ambiguous in systems that use manifest text for discovery or routing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.