日常小助手 MCP Server

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:22 AM UTC
• Version: 2.1.0

Overview

This task-management skill appears functional, but its installer runs mutable remote code, installs an unpinned dependency, and automatically changes AI editor configuration files.

Review before installing. Prefer using a pinned, reviewed commit or packaged artifact instead of the clone-and-run command; avoid --auto unless you are comfortable with it modifying Claude Code, Cursor, Kiro, or Windsurf MCP configs; and consider manually adding the MCP entry after backing up existing editor configuration files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:37

Finding

Execution of Mutable Code Retrieved from an External Repository

Content

View full analysis

Remediation

View remediation

``` 3. Publish signed releases and verify the release signature before execution. 4. Publish a SHA-256 or stronger digest through a separately trusted channel and verify it before running Python. 5. Separate retrieval and execution into distinct documented steps so users can inspect the exact revision. 6. Avoid using branch names, floating tags, or unverified archive URLs as security boundaries. 7. Update both `README.md` and `SKILL.md` so neither document continues to recommend the mutable clone-and-execute workflow. ]]>

T08 · Insecure Dependencies

Error

• Location: src/setup.py:68

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/setup.py:153

Finding

Malformed Editor Configuration Is Silently Replaced

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The manifest describes a task-management server, but the documented setup also bootstraps a Python environment, installs packages, detects AI editors, and writes or merges editor configuration. This mismatch is dangerous because users may grant trust to a seemingly simple productivity skill without realizing it modifies local tooling and configuration, increasing the risk of unwanted persistence, config tampering, or supply-chain exposure from dependency installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes a one-command installer that automatically creates directories, generates configuration files, and modifies MCP/editor configuration files, but it does not prominently warn users that local files and editor settings will be changed. In an agent/MCP context, users may copy-paste install commands with elevated trust, so undisclosed system modifications increase the risk of unwanted persistence, misconfiguration, or accidental exposure of local paths and tooling behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares no explicit tool scope or permissions despite setup instructions indicating capabilities to read/write files and invoke shell commands. In an agent ecosystem, missing scope declarations weakens user consent and policy enforcement because the skill can perform broader host modifications than the manifest suggests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The setup text emphasizes convenience and omits a clear warning that it will create a virtual environment, install dependencies, create local directories, and auto-configure the user's AI editor. This lack of upfront disclosure undermines informed consent and can lead users to run a script that changes their environment and config unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code sets LANG to Chinese by default and the MCP instructions block is written entirely in Chinese, which creates a locale preference that is imposed unless configuration is changed externally. This matches the language/locale policy concern because the skill does not present an explicit user-facing language choice or opt-in within the skill behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup script automatically detects installed AI editors and writes MCP configuration into their user config files, which extends the skill's reach beyond its stated task-management purpose. In context, this persistence-style behavior causes the server to be auto-loaded by external tools and modifies unrelated user application settings, increasing trust and execution surface without a narrowly scoped need.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/setup.py (reported line 57)May include surrounding context.

python

print(f"   ✅ .venv 已创建")

    # 检查 fastmcp 是否已安装
    check = subprocess.run(
        [str(venv_python), "-c", "import fastmcp"],
        capture_output=True,
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 78% confidence

Finding

This code automatically installs fastmcp from the package index at setup time without version pinning, hash verification, or user confirmation. While not an injection flaw, it creates a software supply-chain risk: if the package, index path, or network environment is compromised, the setup script will fetch and execute untrusted code during installation.

Content

Scanner excerpt · src/setup.py (reported line 65)May include surrounding context.

python

print(f"   ⏭️  fastmcp 已安装")
    else:
        print(f"   📦 安装 fastmcp...")
        result = subprocess.run(
            [str(venv_python), "-m", "pip", "install", "fastmcp"],
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script writes "language": "zh" into config.json unconditionally, which imposes a specific language setting. This is a natural-language policy concern because the user is not asked to choose a language and no documented justification limits the skill to a China-specific or Chinese-only context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

In --auto mode, the script modifies external AI editor configuration files without a confirmation prompt at the time of change. This is dangerous because it silently establishes persistent integration with user tooling, potentially causing the server to run automatically in trusted applications and making the setup more invasive than users may expect from a daily-assistant skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The docstring states that merging 'will not affect the user's other MCP Server configurations,' implying non-disruptive behavior. However, the code unconditionally assigns existing['mcpServers']['daily-assistant'] = entry, replacing any prior configuration for that server name and therefore altering existing editor configuration state.

Content

No source excerpt is available for this finding.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The setup guidance instructs users to install fastmcp without a pinned version, making resulting environments nondeterministic and increasing exposure to malicious or compromised upstream releases. In an MCP server context, dependencies execute locally and may be granted broad file access, so supply-chain compromise has meaningful impact.

Content

No source excerpt is available for this finding.