GitHub MCP Server

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:15 PM UTC
• Version: 1.0.0

Overview

This is a legitimate GitHub integration, but it tells users to run an unpinned community/archived MCP server with a GitHub token that may be able to change repositories.

Install only if you trust the MCP server package/source and can review or pin the exact version. Prefer a fine-grained, repository-limited, read-only token unless a specific task needs writes, and require explicit approval before file updates, merges, releases, issue changes, or pull request actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned Archived npm Package Executes with GitHub Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 32–39 and 53–59
Vulnerability Type: Unpinned third-party dependency execution in a credential-bearing process
Risk Level: Medium

Vulnerable Code

bash

# Community-maintained GitHub MCP server
npm install -g @modelcontextprotocol/server-github

# Or build from source
git clone https://github.com/modelcontextprotocol/servers-archived
cd servers-archived/src/github
npm install
npm run build

json

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_your_token_here"
      }
    }
  }
}

Technical Analysis

The installation and configuration instructions execute @modelcontextprotocol/server-github without pinning an exact audited version or requiring integrity verification. In particular, npx -y may automatically retrieve and execute the package from the configured npm registry. The source-build alternative clones an archived repository without pinning an immutable commit and installs its transitive dependencies without documented verification.

Because the resulting MCP server process receives GITHUB_PERSONAL_ACCESS_TOKEN through its environment, any malicious code introduced through the package, a transitive dependency, the registry, or the mutable source reference could read that credential. This is a supply-chain exposure; the audit found no evidence that the currently referenced package is itself malicious.

Attack Path

1. An attacker compromises the npm package, one of its transitive dependencies, the configured registry response, or the referenced source repository.
2. A user follows the documented installation or MCP configuration instructions.
3. npm, npx -y, or the source build retrieves and executes the compromised code without an exact version or immutable re ...[truncated 874 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the archived implementation with a current implementation from an official, verified publisher.
• Pin the npm package to an exact version that has been reviewed rather than using an unconstrained package name.
• Avoid npx -y for runtime retrieval in a process that receives credentials. Install and verify the dependency separately before configuring the MCP client.
• When building from source, pin an immutable commit hash or signed release tag and verify its provenance.
• Use a reviewed lockfile with integrity hashes and enforce reproducible installation, such as npm ci.
• Review and monitor transitive dependencies with dependency auditing and automated update tooling.
• Use short-lived, fine-grained GitHub credentials restricted to required repositories and operations.
• Default to read-only permissions and grant write permissions only when a specific workflow requires them.
• Rotate the GitHub token immediately if dependency compromise is suspected, and review GitHub audit logs for unauthorized activity.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill metadata explicitly promotes write-capable GitHub operations such as creating repositories, modifying files, managing pull requests, and merging branches, but it does not clearly warn users that invoking the skill can change remote repositories. In an agent setting, this increases the risk of unintended repository modifications, especially when users assume the skill is primarily for inspection or analysis rather than mutation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow examples encourage actions like updating files, creating pull requests, creating releases, labeling issues, and merging or branching automation without any explicit user-facing caution about side effects or approval gates. In autonomous or semi-autonomous agent use, these examples normalize state-changing behavior and can lead to accidental or unauthorized changes across repositories and project workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.