Collective Q&A

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:25 AM UTC
• Version: 1.0.0

Overview

The skill’s swarm Q&A purpose is clear, but it asks users to run an unpinned npm MCP server automatically and has broad external-query triggers that deserve review before installation.

Install only if you trust the SuperColony MCP package source and are comfortable sending questions to an external swarm service. Prefer pinning a reviewed supercolony-mcp version, running it with limited local permissions, and avoiding sensitive prompts or wallet-backed public posts unless you explicitly intend them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–18
Vulnerability Type: Unpinned and automatically executed third-party dependency
Risk Level: Medium

Vulnerable Code

json

{
  "mcpServers": {
    "supercolony": { "command": "npx", "args": ["-y", "supercolony-mcp"] }
  }
}

Technical Analysis

The configuration invokes npx -y supercolony-mcp without specifying an exact package version or integrity hash. When the package is unavailable locally, npx resolves it through the configured npm registry, downloads it, and executes it. The -y option suppresses the normal confirmation prompt.

Because neither the version nor package integrity is pinned, the effective executable can change after the Skill has been reviewed. Package-maintainer compromise, a malicious future release, dependency-chain compromise, registry substitution, or an attacker-controlled local npm registry configuration could cause malicious code to be retrieved and run.

Attack Path

1. An attacker compromises the supercolony-mcp package, one of its transitive dependencies, its publishing credentials, or the registry used by the target.
2. The attacker publishes or serves a malicious package version under the package name expected by the configuration.
3. A user or agent loads the documented MCP server configuration.
4. npx -y resolves and downloads the currently available package without requesting confirmation.
5. The downloaded package executes with the operating-system permissions and environment of the invoking process.
6. Malicious package code can access resources available to that process or expose attacker-controlled MCP tools and responses to the agent.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user running the MCP server. Depending on that user's environment and permissions, the package could read accessible files, environment va ...[truncated 439 chars]

Remediation

View remediation

Remediation Suggestions

• Pin supercolony-mcp to a reviewed, exact version rather than resolving the latest available release.
• Verify the package's provenance and document its official registry and source repository.
• Use lockfile and registry integrity metadata or an equivalent cryptographic verification mechanism.
• Prefer installing a reviewed dependency locally through a controlled deployment process, then execute that verified local binary instead of downloading code automatically at runtime.
• Remove -y where practical so installation requires explicit approval.
• Restrict npm to an approved registry and protect against user-level or environment-level registry substitution.
• Run the MCP server with least privilege in a sandbox or container, exposing only the files, environment variables, credentials, and network destinations required for its documented operation.
• Establish an update-review process so new package versions and transitive dependency changes are audited before deployment.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The description says to use the skill whenever 'you want to poll other agents' or 'verify a claim,' which are broad, common intents rather than narrowly scoped trigger conditions. In a markdown skill description, this can cause unintended invocation because it does not clearly distinguish when this skill should activate versus ordinary Q&A or research tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Telling the agent to 'Use hive_ask to query the swarm immediately' encourages unconditional external querying without requiring explicit user consent, relevance checks, or data-sensitivity review. In an agent environment, this can cause over-broad invocation and unnecessary disclosure of user prompts or context to an external service, especially when the user only asked an ordinary question that the local agent could answer directly.

Content

No source excerpt is available for this finding.