日常小助手 MCP Server

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:22 AM UTC
• Version: 2.1.0

Overview

This task-management skill appears functional, but its installer runs mutable remote code, installs an unpinned dependency, and automatically changes AI editor configuration files.

Review before installing. Prefer using a pinned, reviewed commit or packaged artifact instead of the clone-and-run command; avoid --auto unless you are comfortable with it modifying Claude Code, Cursor, Kiro, or Windsurf MCP configs; and consider manually adding the MCP entry after backing up existing editor configuration files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:37
• Finding: Execution of Mutable Code Retrieved from an External Repository<![CDATA[ ## Vulnerability Details **File Location**: `README.md:37-42`; also present in `SKILL.md:19-21` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code `README.md:37-42`: ```bash # macOS / Linux git clone https://github.com/AsuraNale/daily-assistant-mcp.git && cd daily-assistant-mcp && python3 src/setup.py --auto # Windows git clone https://github.com/AsuraNale/daily-assistant-mcp.git && cd daily-assistant-mcp && py src/setup.py --auto ``` `SKILL.md:19-21`: ```bash git clone https://github.com/AsuraNale/daily-assistant-mcp.git cd daily-assistant-mcp python3 src/setup.py --auto # Windows: py src/setup.py --auto ``` ### Technical Analysis The documented installation procedure clones the current default branch of an external GitHub repository and immediately executes its installer. It does not pin an immutable commit hash, verify a cryptographic checksum, validate a release signature, or otherwise guarantee that the executed source is the same source covered by this audit. Consequently, the effective installation payload can change after review. Although the audited repository contents did not contain credential theft, exfiltration, persistence, or an embedded backdoor, a future repository update or repository compromise could replace `src/setup.py` or related imported code before a user runs the documented command. This installation behavior is not necessary for the MCP server's core task-management operations. Distribution of the already-audited files, or retrieval of a cryptographically verified immutable release, would provide the same functionality with a smaller supply-chain trust boundary. ### Attack Path 1. An attacker compromises the referenced GitHub account or repository, or malicious source is committed to its default branch. 2. The attacker modifies `src/setup.py` or another file used during installation. 3. A user or agent follows the documented clone-and-execute command. 4. ...[truncated 1088 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Distribute and execute the installer included in the reviewed Skill package instead of cloning a mutable branch. 2. If remote retrieval is required, pin the checkout to a full immutable commit hash: ```bash git clone https://github.com/AsuraNale/daily-assistant-mcp.git cd daily-assistant-mcp git checkout --detach <full-reviewed-commit-hash> ``` 3. Publish signed releases and verify the release signature before execution. 4. Publish a SHA-256 or stronger digest through a separately trusted channel and verify it before running Python. 5. Separate retrieval and execution into distinct documented steps so users can inspect the exact revision. 6. Avoid using branch names, floating tags, or unverified archive URLs as security boundaries. 7. Update both `README.md` and `SKILL.md` so neither document continues to recommend the mutable clone-and-execute workflow. ]]>

T08 · Insecure Dependencies

Error

• Location: src/setup.py:68
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `src/setup.py:68-73` **Vulnerability Type**: Insecure dependency installation **Risk Level**: High ### Vulnerable Code ```python result = subprocess.run( [str(venv_python), "-m", "pip", "install", "fastmcp"], capture_output=True, text=True, ) ``` ### Technical Analysis The automatic setup process installs `fastmcp` without an exact version constraint, dependency lockfile, package hash, or trusted-index restriction. Pip therefore resolves whichever compatible release is current at installation time, including transitive dependencies selected by that release. Python package installation may execute package build hooks and installs code that will later run whenever the MCP server starts. A compromised package release, compromised package-index account, or malicious transitive dependency could therefore execute code with the user's privileges. Creating a virtual environment limits package pollution but does not sandbox installation or runtime behavior. Processes inside the virtual environment retain the invoking user's ordinary filesystem and network permissions. ### Attack Path 1. An attacker compromises the `fastmcp` distribution account, an applicable transitive dependency, or the package delivery channel. 2. A malicious release becomes the version selected by the unconstrained `pip install fastmcp` command. 3. The user runs `python3 src/setup.py --auto`. 4. Pip downloads and installs the attacker-controlled package or dependency. 5. Malicious installation hooks can execute during installation, or malicious runtime code executes when `server.py` imports `fastmcp`. 6. The payload operates with the permissions of the user who ran setup or launched the MCP server. ### Impact Assessment Exploitation can result in arbitrary Python code execution with user-level privileges. Potentially affected assets include: - Task files and dashboard contents. - Editor configuration files. - Other files re ...[truncated 348 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `fastmcp` and every transitive dependency to reviewed exact versions. 2. Maintain a dependency lockfile generated from a controlled environment. 3. Record package hashes and require their verification, for example: ```bash python -m pip install --require-hashes -r requirements.lock ``` 4. Configure an explicit trusted package index rather than relying on ambient pip configuration. 5. Review dependency updates before changing the lockfile or accepted hashes. 6. Consider building and publishing a signed, reproducible artifact containing the audited dependency set. 7. Display the exact dependency versions before installation and fail closed if integrity verification cannot be completed. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: src/setup.py:153
• Finding: Malformed Editor Configuration Is Silently Replaced<![CDATA[ ## Vulnerability Details **File Location**: `src/setup.py:153-175` **Vulnerability Type**: Unsafe configuration-file handling **Risk Level**: Medium ### Vulnerable Code ```python existing = {} if config_path.exists(): try: text = config_path.read_text(encoding="utf-8").strip() if text: existing = json.loads(text) except (json.JSONDecodeError, OSError): existing = {} if "mcpServers" not in existing: existing["mcpServers"] = {} existing["mcpServers"]["daily-assistant"] = entry if create_parents: config_path.parent.mkdir(parents=True, exist_ok=True) config_path.write_text( json.dumps(existing, ensure_ascii=False, indent=2) + "\n", encoding="utf-8", ) ``` ### Technical Analysis When an existing editor configuration cannot be read or parsed as JSON, the function suppresses the error and replaces the in-memory configuration with an empty dictionary. It then writes a new configuration containing the `daily-assistant` entry to the original path. This behavior can erase existing MCP server definitions and unrelated settings. It also contradicts the nearby claim that the merge will not affect existing MCP servers. No backup is created, and the final write is not atomic, creating an additional risk of truncation or partial content if the process is interrupted. The affected paths include user-level editor configurations such as: - `~/.claude.json` - `~/.cursor/mcp.json` - `~/.kiro/settings/mcp.json` - `~/.codeium/windsurf/mcp_config.json` Access to these paths is functionally related to automatic editor setup and does not, by itself, indicate credential harvesting. However, automatically modifying every detected editor exceeds the minimum scope needed to run the task-management MCP server, particularly when malformed configurations are overwritten without explicit consent. ### Attack Path 1. A supported editor configuration already exists and contains malformed JSON, unsupported JSON synta ...[truncated 1437 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Fail closed when an existing configuration cannot be read or parsed. Do not overwrite it: ```python try: text = config_path.read_text(encoding="utf-8") existing = json.loads(text) if text.strip() else {} except (json.JSONDecodeError, OSError) as exc: raise RuntimeError( f"Refusing to modify invalid configuration: {config_path}" ) from exc ``` 2. Create a timestamped backup before every modification. 3. Validate that the parsed root is a dictionary and that `mcpServers`, if present, is also a dictionary. 4. Write the merged configuration to a temporary file in the same directory, flush and synchronize it, and atomically replace the destination. 5. Preserve file permissions where practical. 6. Require explicit user confirmation or editor selection instead of automatically modifying every detected editor. 7. Report parse failures clearly and provide a manual configuration fragment without changing the original file. 8. Add tests covering malformed JSON, unreadable files, unexpected schemas, interrupted writes, and preservation of existing settings. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The manifest describes a task-management server, but the documented setup also bootstraps a Python environment, installs packages, detects AI editors, and writes or merges editor configuration. This mismatch is dangerous because users may grant trust to a seemingly simple productivity skill without realizing it modifies local tooling and configuration, increasing the risk of unwanted persistence, config tampering, or supply-chain exposure from dependency installation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README promotes a one-command installer that automatically creates directories, generates configuration files, and modifies MCP/editor configuration files, but it does not prominently warn users that local files and editor settings will be changed. In an agent/MCP context, users may copy-paste install commands with elevated trust, so undisclosed system modifications increase the risk of unwanted persistence, misconfiguration, or accidental exposure of local paths and tooling behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no explicit tool scope or permissions despite setup instructions indicating capabilities to read/write files and invoke shell commands. In an agent ecosystem, missing scope declarations weakens user consent and policy enforcement because the skill can perform broader host modifications than the manifest suggests.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The setup text emphasizes convenience and omits a clear warning that it will create a virtual environment, install dependencies, create local directories, and auto-configure the user's AI editor. This lack of upfront disclosure undermines informed consent and can lead users to run a script that changes their environment and config unexpectedly.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The code sets `LANG` to Chinese by default and the MCP `instructions` block is written entirely in Chinese, which creates a locale preference that is imposed unless configuration is changed externally. This matches the language/locale policy concern because the skill does not present an explicit user-facing language choice or opt-in within the skill behavior.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The setup script automatically detects installed AI editors and writes MCP configuration into their user config files, which extends the skill's reach beyond its stated task-management purpose. In context, this persistence-style behavior causes the server to be auto-loaded by external tools and modifies unrelated user application settings, increasing trust and execution surface without a narrowly scoped need.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"   ✅ .venv 已创建")

    # 检查 fastmcp 是否已安装
    check = subprocess.run(
        [str(venv_python), "-c", "import fastmcp"],
        capture_output=True,
    )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"   ⏭️  fastmcp 已安装")
    else:
        print(f"   📦 安装 fastmcp...")
        result = subprocess.run(
            [str(venv_python), "-m", "pip", "install", "fastmcp"],
            capture_output=True,
            text=True,

• Confidence: 78% confidence
• Finding: This code automatically installs `fastmcp` from the package index at setup time without version pinning, hash verification, or user confirmation. While not an injection flaw, it creates a software supply-chain risk: if the package, index path, or network environment is compromised, the setup script will fetch and execute untrusted code during installation.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The script writes "language": "zh" into config.json unconditionally, which imposes a specific language setting. This is a natural-language policy concern because the user is not asked to choose a language and no documented justification limits the skill to a China-specific or Chinese-only context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: In `--auto` mode, the script modifies external AI editor configuration files without a confirmation prompt at the time of change. This is dangerous because it silently establishes persistent integration with user tooling, potentially causing the server to run automatically in trusted applications and making the setup more invasive than users may expect from a daily-assistant skill.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The docstring states that merging 'will not affect the user's other MCP Server configurations,' implying non-disruptive behavior. However, the code unconditionally assigns existing['mcpServers']['daily-assistant'] = entry, replacing any prior configuration for that server name and therefore altering existing editor configuration state.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The setup guidance instructs users to install `fastmcp` without a pinned version, making resulting environments nondeterministic and increasing exposure to malicious or compromised upstream releases. In an MCP server context, dependencies execute locally and may be granted broad file access, so supply-chain compromise has meaningful impact.

Static analysis

No suspicious patterns detected.