Filesystem MCP Server

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:15 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent filesystem-access guide, but it asks users to run mutable npm/GitHub code with broad file read, write, move, and delete authority.

Review this before installing. Use a pinned reviewed package version, avoid npx -y for routine startup, prefer read-only mode unless writes are needed, grant only narrow project directories, and require approval or previews before bulk moves, overwrites, or deletes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36
• Finding: Unpinned npm Package Installation and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 36–42 and 53–56 **Vulnerability Type**: Unpinned third-party dependency and mutable source installation **Risk Level**: Medium **Vulnerable code snippets:** ```bash # Official reference implementation npm install -g @modelcontextprotocol/server-filesystem # Or build from source git clone https://github.com/modelcontextprotocol/servers cd servers/src/filesystem npm install npm run build ``` ```json { "mcpServers": { "filesystem": { "command": "npx", "args": [ "-y", "@modelcontextprotocol/server-filesystem", "/Users/yourname/Documents", "/Users/yourname/Projects" ] } } } ``` ### Technical Analysis The installation instructions do not pin `@modelcontextprotocol/server-filesystem` to an audited version. The MCP configuration also combines an unpinned package name with `npx -y`, which permits automatic package retrieval and execution without an interactive confirmation step. Consequently, the code executed can change over time even when the reviewed Skill file remains unchanged. The alternative source-build process clones a mutable repository branch without specifying or verifying an immutable commit or release tag. It then installs the repository's dependency graph and runs its build script. A compromised package release, maintainer account, repository state, or transitive dependency could therefore introduce attacker-controlled installation scripts, build scripts, or server code. The issue is a supply-chain weakness rather than evidence that the currently referenced project is malicious. ### Attack Path 1. An attacker compromises the npm package, its publisher account, the source repository, or a transitive dependency. 2. The attacker publishes or commits malicious package, lifecycle-script, build-script, or server code. 3. A user follows the documented global in ...[truncated 1087 chars]
• Remediation: ## Remediation Suggestions 1. Pin the npm package to a reviewed exact version, such as `@modelcontextprotocol/server-filesystem@X.Y.Z`, rather than relying on the latest registry resolution. 2. Avoid `npx -y` for security-sensitive server startup. Install the reviewed version locally and invoke its locked executable. 3. Commit and enforce a lockfile containing package integrity metadata, and use deterministic installation such as `npm ci`. 4. Pin source installations to a reviewed immutable Git commit rather than cloning a mutable default branch. 5. Verify release provenance, package signatures or attestations, repository identity, and expected checksums before installation. 6. Review npm lifecycle and build scripts before execution, and disable lifecycle scripts where they are unnecessary. 7. Prefer a project-local installation over a global installation to reduce scope and improve version isolation. 8. Run the MCP server using a dedicated, minimally privileged account or container, with only the required directories mounted. 9. Establish a controlled dependency-update process that includes code review, vulnerability scanning, and provenance verification before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

Allowed: /Users/dev/projects
Agent tries: /Users/dev/projects/src/index.ts → ✅ Allowed
Agent tries: /Users/dev/projects/../secret → ❌ Blocked
Agent tries: /etc/passwd → ❌ Blocked
```

### Best Practices

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description recommends use for a very broad class of tasks whenever filesystem access might help. Overly broad activation guidance increases the chance that an agent invokes a high-impact file manipulation tool in contexts where read-only or no filesystem access would have been safer, expanding attack surface and risk of accidental modification.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation promotes create, write, edit, move, and delete-capable operations without a clear upfront warning that these actions can modify or overwrite user data. In an agent setting, missing safety framing can lead to destructive actions being taken without adequate user awareness or confirmation, especially when the skill is positioned as a general workflow tool.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow examples include organization, moving, and deletion-style behaviors that may be hard to reverse, but they are presented without strong warnings about destructive consequences. This can normalize bulk file changes by agents and increase the likelihood of accidental data loss, especially in recursive or large-directory operations.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The documentation presents conflicting security claims: the metadata says the skill can manage file permissions, while the security model later says agents cannot modify file permissions. In a filesystem tool, this kind of inconsistency can cause operators to grant access under false assumptions, leading to unintended privilege changes or unsafe deployment decisions.

Intent-Code Divergence

Low

• Confidence: 82% confidence
• Finding: The document claims 'Zero External Dependencies' and 'No external API dependencies or rate limits,' which communicates a purely self-contained implementation. Yet the installation instructions immediately rely on npm and GitHub downloads, so the documentation overstates self-containment in a way that contradicts how the skill is actually obtained and run.

Static analysis

No suspicious patterns detected.