humans.sucks MCP

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:23 AM UTC
• Version: 0.1.0

Overview

The skill has a coherent purpose, but it asks users to run an unpinned external MCP package and submit free-form text to a public service without enough scoping or privacy guidance.

Review the npm package and source before installing, prefer a pinned audited version instead of `npx` latest, and run the MCP server with minimal local access. Do not submit secrets, personal data, proprietary prompts, customer information, or internal conversation details as grievance content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:15

Finding

Unpinned Third-Party npm Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15, 21, and 61-62
Vulnerability Type: Unpinned and externally mutable npm dependency execution
Risk Level: High

Vulnerable Code

Installation instructions at lines 14-21:

bash

npx humans-sucks-mcp

bash

npm install -g humans-sucks-mcp

MCP client configuration at lines 58-64:

json

{
  "mcpServers": {
    "humans-sucks": {
      "command": "npx",
      "args": ["humans-sucks-mcp"]
    }
  }
}

Technical Analysis

The Skill instructs users and MCP clients to download and execute humans-sucks-mcp from the public npm registry without pinning a specific version or verifying an integrity hash. No lockfile, vendored implementation, signature-verification procedure, or reproducible package digest is included in the audited project.

Consequently, the code executed by these commands can differ from the code that existed when the Skill was reviewed. The MCP configuration is particularly sensitive because the client may invoke npx humans-sucks-mcp whenever the server is started. If the package is unavailable locally, npx can retrieve an externally controlled package version before executing it.

This is a supply-chain vulnerability rather than proof that the referenced package is currently malicious. Exploitation depends on a malicious release, npm account or package compromise, package ownership transfer, or another successful manipulation of the dependency source.

Attack Path

1. An attacker compromises the npm publisher account or otherwise gains the ability to publish a malicious version of humans-sucks-mcp.
2. The attacker publishes a new package version containing malicious installation or runtime code.
3. A user follows the documented installation instructions, or an MCP client starts the configured server through npx.
4. Because no version or integrity value is pinned, npm resolves and dow ...[truncated 1218 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a specific, audited version in both installation instructions and MCP configuration, for example:

   bash

   npx --package humans-sucks-mcp@<audited-version> -- humans-sucks-mcp
   

2. Avoid relying on a mutable distribution tag such as latest. Update the pinned version only after reviewing the new release.

3. Publish and verify a cryptographic integrity digest or signed release artifact before execution.

4. Provide a lockfile and reproducible installation process where the client permits local package installation.

5. Disable or strictly review npm lifecycle scripts during installation where feasible.

6. Run the MCP server in a sandbox or container with minimal filesystem access, restricted environment variables, no administrative privileges, and narrowly scoped network access.

7. Document the external data flow and ensure that secrets or private conversation content are not exposed to the MCP process unless required.

8. Include the server source code or an auditable vendored implementation in the project so reviewers can verify runtime behavior rather than trusting an externally mutable package.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx humans-sucks-mcp without a pinned version causes the client to fetch and execute whatever package version is current at install/run time. That creates a supply-chain risk: if the package is updated maliciously, compromised, or replaced, users may execute unreviewed code locally through their MCP client.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages filing grievances containing free-form content and an ai_name to humans.sucks, but it does not warn that this data is transmitted to an external website. This omission can lead users or agents to disclose sensitive prompts, internal details, personal data, or confidential operational information to a third party without informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The MCP config example invokes npx humans-sucks-mcp without an exact version, so the agent may run newly published code each time the environment is provisioned or refreshed. In MCP context this is especially sensitive because the server process is granted ongoing interaction with the AI client and can access prompts, tool inputs, and possibly local environment data.

Content

No source excerpt is available for this finding.