Chart Splat

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:29 PM UTC
• Version: 1.1.0

Overview

The skill does what it claims, but its preferred unpinned npx execution and configurable API endpoint create review-worthy supply-chain and credential exposure risks.

Install only if you are comfortable sending chart data to Chart Splat and using an npm CLI. Prefer a pinned, reviewed `chartsplat-cli` version, avoid sensitive chart contents unless approved, restrict network egress to the Chart Splat API, and do not set `CHARTSPLAT_API_URL` except in a trusted environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Remediation

View remediation

``` 3. Include a lockfile containing registry URLs and integrity hashes, and enforce reproducible installation with `npm ci`. 4. Avoid `npx -y` for production or Agent runtime execution. Install dependencies in a controlled build or provisioning phase and execute only the locally verified binary. 5. Use a trusted registry and verify package provenance, signatures, maintainers, and published integrity metadata. 6. Audit and pin transitive dependencies. Add automated dependency monitoring, but require review before accepting upgrades. 7. Run the CLI in a restricted environment with: - Minimal filesystem access. - Only the required API credential. - Network egress limited to the documented Chart Splat endpoint. - No access to unrelated workspace secrets. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate-chart.js:17

Finding

API Credential and Complete Chart Payload Can Be Sent to an Unrestricted Endpoint

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The primary purpose matches the description: the code generates charts via the Chart Splat API and produces PNG output. However, there is a material feature mismatch because the description explicitly claims support for candlestick/OHLC charts, while the implementation only allows line, bar, pie, doughnut, radar, and polarArea. The local file write behavior is an implementation detail for a CLI tool rather than a separate primary capability, so it is only a minor undeclared behavior. Overall, this should be flagged as a mismatch due to overstated supported chart types.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares environment and network requirements but does not define an explicit tool scope such as permissions or allowed-tools. That makes its execution boundary ambiguous, increasing the chance an agent grants broader access than intended when handling user-supplied chart data and API-key-backed network calls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger text is broad enough to activate on many generic requests to create or visualize data, which can cause the agent to route user content to this skill unexpectedly. In context, that means user data may be sent to an external API and saved locally even when the user did not clearly consent to those side effects.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill states a dependency on npx/network access without pinning an exact package version, which allows execution of whatever package version is current at runtime. This creates a supply-chain risk: a compromised or maliciously updated package could run arbitrary code and access the configured API key or local files.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The install metadata references npm execution paths without an immutable version boundary, so the runtime may fetch or execute changing upstream code. In a skill that requires network and an API key, that exposes users to package-tampering and account-token theft risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill does not prominently warn that chart data is transmitted to an external service and written to local PNG files. This is dangerous because users or orchestrators may pass sensitive business or personal data into the skill without realizing it leaves the local trust boundary and persists on disk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Running npx -y chartsplat-cli without a pinned version causes the latest available package to be fetched and executed at runtime. If the package or one of its transitive dependencies is compromised, arbitrary code can run with the skill's network access, local file access, and API key environment variable.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This example uses an unpinned npx package invocation, exposing users to runtime package substitution or malicious updates. Because the command processes user-supplied chart content and writes files locally, a compromised package could abuse both data and filesystem access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This command fetches and executes chartsplat-cli via npx without a version pin, making behavior dependent on mutable upstream state. That enables supply-chain compromise leading to arbitrary code execution and possible exfiltration of the Chart Splat API key.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The unpinned npx invocation leaves the skill exposed to package drift and malicious package takeover. Since the skill requires network access and writes output files, the blast radius includes data leakage and arbitrary local file modification within the agent's permissions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using npx -y chartsplat-cli without a fixed version means a later package update can silently change what code runs. In an agent environment, that is a meaningful supply-chain vulnerability because the package executes with the skill's privileges and user-provided inputs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This documentation instructs an unpinned npx execution of a remote npm package, which is a classic supply-chain weakness. A compromised package version could execute arbitrary code, harvest secrets from environment variables, or tamper with generated output.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The command relies on an unversioned npm package at runtime, so trust is placed in mutable upstream content. Given the skill's external API usage and local output handling, compromise could affect confidentiality, integrity, and availability.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This unpinned npx invocation creates a supply-chain execution risk because the resolved package can change over time without review. A malicious release could run arbitrary code under the agent context and misuse both network and file-write capabilities.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The candlestick example also uses an unpinned npx package, so the same supply-chain risk applies here. The config-file workflow may further increase exposure because a compromised package can read and misuse local config contents before generating output.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The complex-chart example instructs users to execute an unpinned npm package at runtime, which permits silent upstream code changes. Because complex configs may include rich user data, compromise could leak sensitive chart contents as well as environment secrets.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 6)May include surrounding context.

Endpoint

text

POST https://api.chartsplat.com/chart

Authentication

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file instructs users to send an API key in HTTP headers to an external endpoint, which is a privacy- and security-relevant behavior. The document provides usage details but does not include any warning or disclosure about safeguarding credentials or the fact that request data is sent to a third-party service.

Content

No source excerpt is available for this finding.