Expanso yaml-to-json

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:55 PM UTC
• Version: 1.0.0

Overview

This YAML-to-JSON skill performs its stated task, but its server mode exposes an unauthenticated conversion endpoint on all network interfaces by default.

Review before installing if you plan to run the MCP server. Prefer the CLI mode for local conversion, or bind the server to localhost, put it behind authentication, and add request-size/rate limits before exposing it to a network.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: pipeline-mcp.yaml:5

Finding

Unauthenticated YAML Conversion Service Exposed on All Network Interfaces

Content

View full analysis

Vulnerability Details

File Location: pipeline-mcp.yaml, lines 5–11
Vulnerability Type: Unauthenticated network exposure and unbounded request processing
Risk Level: Medium

Vulnerable Code

yaml

http:
  enabled: true
  address: "0.0.0.0:${PORT:-8080}"

input:
  http_server:
    path: /convert
    allowed_verbs: [POST]
    timeout: 30s

Technical Analysis

The MCP pipeline binds its HTTP listener to 0.0.0.0, making the /convert endpoint reachable through every network interface permitted by the host firewall. The reviewed configuration does not require authentication or authorization and does not define rate limiting.

The endpoint passes attacker-controlled request content to parse_yaml(). Unlike the CLI pipeline, which specifies a 1 MiB max_buffer, the MCP pipeline does not explicitly impose a request-body size limit. Consequently, any client with network access can invoke YAML parsing repeatedly or submit unusually large or parser-intensive documents.

This is an insecure configuration rather than evidence of deliberate malicious behavior. No command execution, credential access, data exfiltration, persistence, or privilege-escalation mechanism was found.

Attack Path

1. An operator starts the MCP pipeline using expanso-edge run pipeline-mcp.yaml.
2. The service listens on all interfaces on ${PORT}, or port 8080 by default.
3. An attacker who can reach that port sends unauthenticated POST requests to /convert.
4. The attacker submits large, complex, or numerous YAML documents.
5. The service parses each request, consuming CPU and memory until requests time out or host resources become constrained.
6. Repeated or concurrent requests may degrade availability for legitimate users or the host.

Impact Assessment

An attacker can obtain unauthorized use of the conversion endpoint and may degrade service availability through resource consumption. The affe ...[truncated 428 chars]

Remediation

View remediation

Remediation Suggestions

1. Bind to 127.0.0.1 by default and require explicit operator configuration before exposing the service externally.
2. Require authentication and authorization for /convert, such as a validated bearer token or authenticated reverse proxy.
3. Configure a strict request-body size limit comparable to or smaller than the CLI pipeline's 1 MiB limit.
4. Add per-client and global rate limits, concurrency limits, and request quotas.
5. Place the service behind a hardened reverse proxy when remote access is required.
6. Restrict inbound traffic with host, container, or cloud firewall rules.
7. Apply CPU and memory limits to the service process and reject excessively complex YAML inputs.
8. Add security tests covering oversized payloads, high request concurrency, unauthenticated access, malformed YAML, and parser-intensive documents.
9. Document the endpoint's network exposure, authentication requirements, and safe deployment settings.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.