DeFi Consensus Oracle

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:25 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent DeFi signal lookup helper, but its setup runs an unpinned third-party MCP package with automatic installation, which users should review before installing.

Install only if you trust the npm package publisher and are comfortable running an external MCP server locally. Prefer pinning `supercolony-mcp` to a reviewed version and running it with limited filesystem, environment-variable, and network access. Treat the returned DeFi signals as research input, not financial advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–16
Vulnerability Type: Unpinned npm dependency executed through npx
Risk Level: Medium

Vulnerable Code

json

{
  "mcpServers": {
    "supercolony": { "command": "npx", "args": ["-y", "supercolony-mcp"] }
  }
}

Technical Analysis

The documented configuration runs npx -y supercolony-mcp without specifying an exact package version or verifying an integrity digest. Consequently, npx may download and execute whichever package release the npm registry currently resolves.

The -y option automatically accepts installation prompts. The project does not contain the MCP server's source code, a lockfile, or integrity metadata that would allow the executed package to be tied to the version reviewed during this audit. A compromised publisher account, malicious future release, registry compromise, or package-resolution attack could therefore change the effective executable payload after the Skill has been reviewed.

Attack Path

1. An attacker compromises the npm publisher account, registry distribution path, or a future release of supercolony-mcp.
2. The attacker publishes a malicious package version under the resolved package name.
3. A user applies the documented zero-configuration MCP setup.
4. The agent environment invokes npx -y supercolony-mcp.
5. npx downloads and executes the attacker-controlled release without interactive confirmation.
6. The malicious package operates with the permissions and accessible resources of the user running the agent.

Impact Assessment

Successful exploitation permits arbitrary code execution within the security context of the user who launches the MCP server. Depending on that user's permissions and environment, the package could access readable local files, environment variables, available credentials, MCP request data, and reachable network services. It could also modify files or launch additional processes where the user ha ...[truncated 205 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin supercolony-mcp to an exact, reviewed version rather than relying on the registry's current resolution.
2. Maintain a lockfile and verify the package and transitive dependencies using trusted integrity hashes.
3. Document and enforce the expected npm registry, package identity, and publisher.
4. Remove automatic installation acceptance with -y where interactive review is practical.
5. Prefer vendoring or publishing the MCP server source with the Skill so the executed implementation can be audited.
6. Run the MCP server with least privilege in a sandbox or container that restricts filesystem, environment-variable, process, and network access.
7. Establish an update-review process so dependency upgrades are audited before deployment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep