Filesystem MCP Server

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:15 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent filesystem-access guide, but it asks users to run mutable npm/GitHub code with broad file read, write, move, and delete authority.

Review this before installing. Use a pinned reviewed package version, avoid npx -y for routine startup, prefer read-only mode unless writes are needed, grant only narrow project directories, and require approval or previews before bulk moves, overwrites, or deletes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Unpinned npm Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36–42 and 53–56
Vulnerability Type: Unpinned third-party dependency and mutable source installation
Risk Level: Medium

Vulnerable code snippets:

bash

# Official reference implementation
npm install -g @modelcontextprotocol/server-filesystem

# Or build from source
git clone https://github.com/modelcontextprotocol/servers
cd servers/src/filesystem
npm install
npm run build

json

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/yourname/Documents",
        "/Users/yourname/Projects"
      ]
    }
  }
}

Technical Analysis

The installation instructions do not pin @modelcontextprotocol/server-filesystem to an audited version. The MCP configuration also combines an unpinned package name with npx -y, which permits automatic package retrieval and execution without an interactive confirmation step. Consequently, the code executed can change over time even when the reviewed Skill file remains unchanged.

The alternative source-build process clones a mutable repository branch without specifying or verifying an immutable commit or release tag. It then installs the repository's dependency graph and runs its build script. A compromised package release, maintainer account, repository state, or transitive dependency could therefore introduce attacker-controlled installation scripts, build scripts, or server code.

The issue is a supply-chain weakness rather than evidence that the currently referenced project is malicious.

Attack Path

1. An attacker compromises the npm package, its publisher account, the source repository, or a transitive dependency.
2. The attacker publishes or commits malicious package, lifecycle-script, build-script, or server code.
3. A user follows the documented global in ...[truncated 1087 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm package to a reviewed exact version, such as @modelcontextprotocol/server-filesystem@X.Y.Z, rather than relying on the latest registry resolution.
2. Avoid npx -y for security-sensitive server startup. Install the reviewed version locally and invoke its locked executable.
3. Commit and enforce a lockfile containing package integrity metadata, and use deterministic installation such as npm ci.
4. Pin source installations to a reviewed immutable Git commit rather than cloning a mutable default branch.
5. Verify release provenance, package signatures or attestations, repository identity, and expected checksums before installation.
6. Review npm lifecycle and build scripts before execution, and disable lifecycle scripts where they are unnecessary.
7. Prefer a project-local installation over a global installation to reduce scope and improve version isolation.
8. Run the MCP server using a dedicated, minimally privileged account or container, with only the required directories mounted.
9. Establish a controlled dependency-update process that includes code review, vulnerability scanning, and provenance verification before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.

Allowed: /Users/dev/projects Agent tries: /Users/dev/projects/src/index.ts → ✅ Allowed Agent tries: /Users/dev/projects/../secret → ❌ Blocked Agent tries: /etc/passwd → ❌ Blocked

text

### Best Practices

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description recommends use for a very broad class of tasks whenever filesystem access might help. Overly broad activation guidance increases the chance that an agent invokes a high-impact file manipulation tool in contexts where read-only or no filesystem access would have been safer, expanding attack surface and risk of accidental modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation promotes create, write, edit, move, and delete-capable operations without a clear upfront warning that these actions can modify or overwrite user data. In an agent setting, missing safety framing can lead to destructive actions being taken without adequate user awareness or confirmation, especially when the skill is positioned as a general workflow tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow examples include organization, moving, and deletion-style behaviors that may be hard to reverse, but they are presented without strong warnings about destructive consequences. This can normalize bulk file changes by agents and increase the likelihood of accidental data loss, especially in recursive or large-directory operations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation presents conflicting security claims: the metadata says the skill can manage file permissions, while the security model later says agents cannot modify file permissions. In a filesystem tool, this kind of inconsistency can cause operators to grant access under false assumptions, leading to unintended privilege changes or unsafe deployment decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The document claims 'Zero External Dependencies' and 'No external API dependencies or rate limits,' which communicates a purely self-contained implementation. Yet the installation instructions immediately rely on npm and GitHub downloads, so the documentation overstates self-containment in a way that contradicts how the skill is actually obtained and run.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.