Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed BytesAgain MCP setup and search helper with expected outbound calls, and I found no hidden credential access, persistence, or destructive behavior.
Install only if you are comfortable adding a third-party MCP server from bytesagain.com to your agent. Running test, tools, or search will contact bytesagain.com, and search sends the query text you provide.
The metadata says the skill only shows setup commands and does not modify files, but the documented behavior includes live endpoint testing, remote tool enumeration, and use of a separate REST API. This mismatch undermines user trust and can cause an agent to perform unanticipated external communications, which is especially risky in environments that rely on descriptions for approval decisions.
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
### tools
List available MCP tools exposed by BytesAgain.
```bash
bash scripts/script.sh tools
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
```
### tools
List available MCP tools exposed by BytesAgain.
```bash
bash scripts/script.sh tools
The skill advertises executable shell commands and network interaction but does not declare any explicit tool scope or permissions boundary. That makes the skill harder to safely review and increases the chance an agent or user invokes network and shell capabilities without informed consent or policy enforcement.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
echo " Add to claude_desktop_config.json:"
echo ' {"mcpServers":{"bytesagain":{"url":"'"${MCP_URL}"'","transport":"streamable-http"}}}'
echo ""
echo "--- curl (JSON-RPC) ---"
echo " curl -X POST ${MCP_URL} \\"
echo " -H 'Content-Type: application/json' \\"
echo " -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\",\"params\":{}}'"
The metadata says the skill only shows setup commands and does not modify files, but the script includes active network functionality (test, tools, and search) that performs live requests to external BytesAgain endpoints. This mismatch can mislead users and security tooling about the skill’s real behavior, reducing informed consent and increasing the chance that unexpected external communication occurs in restricted environments.
The tools command performs an actual outbound POST request to a third-party MCP endpoint and processes the returned content. Although it sends only a fixed JSON-RPC request and no obvious secrets, it still creates undisclosed external communication and trusts remote content enough to parse and display it, which is more sensitive in a skill advertised primarily as setup guidance.
echo ""
tmpfile=$(mktemp)
curl -s -X POST "${MCP_URL}" \
-H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' \
--max-time 10 2>/dev/null > "$tmpfile"
The script exposes a REST API interface (rest and search) that is not described in the manifest, expanding the operational scope beyond what users were told to expect. Undisclosed functionality is dangerous because it bypasses trust assumptions and can cause unexpected data transmission to a third-party service.
The natural-language output says the REST API "Supports 7 languages: ZH/JA/KO/DE/FR/PT/ES," which implies a fixed language set and excludes other languages without any user opt-in or policy justification. Under the language/locale policy rule, this is a natural-language restriction that should either be optional, justified, or presented as a choice.
No suspicious patterns detected.