Security audit
Security checks for vulnerabilities and agentic risk
This skill appears purpose-built for Stockpile commerce, but it gives agents live authority over storefront, inventory, fulfillment, checkout, and message-routing actions without enough scoping or confirmation guidance.
Review this skill before installing it on a production Stockpile account. Use the least-privilege API key available, prefer a non-production or low-risk store first, pin the package version yourself if your runner allows it, and require human approval before inventory deletion, batch listing, checkout creation, fulfillment, message routing, or automated sweeps.
The README instructs users to execute uvx mcp-stockpile without pinning a specific version, so first-time installs or later reinstalls may fetch whatever package version is current at execution time. For an MCP server that is granted API credentials and can take live commerce actions, an unexpected upstream update or a compromised published release could immediately run with those privileges.
This command example again references uvx mcp-stockpile without version pinning, creating a supply-chain exposure where the resolved package can change over time. Because the server is configured with a live STOCKPILE_API_KEY and exposes order, inventory, routing, and billing-related operations, a malicious or compromised future release could have immediate real-world impact.
The README advertises numerous tools that can modify live storefront inventory, route customer communications, fulfill orders, delete data, and initiate paid checkout flows, but it does not clearly warn users that these actions affect production commerce systems. In an MCP setting, users may connect the server directly to an agent and grant it credentials, so the lack of explicit safety guidance increases the chance of accidental destructive or customer-facing actions.
The skill installs and runs an MCP server via uvx without pinning an exact package version. This creates a supply-chain risk: future upstream releases of mcp-stockpile could change behavior or introduce malicious code, and agents would automatically consume it when installing or launching the skill.
The metadata declares a uvx-based installation flow but does not pin the underlying package version. Because this skill enables storefront and order-management actions, a compromised or unsafe upstream package could gain direct access to API-backed commerce operations when users install or run the MCP server.
The package field references mcp-stockpile without a pinned version, allowing resolution to the latest available release at install time. In an agent-integrated MCP context, this is dangerous because the server exposes sensitive actions like inventory changes, fulfillment, and refunds, so any malicious or breaking upstream update can immediately affect real commerce workflows.
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
mcporter list stockpile --schema
Or call any tool directly:
```bash
mcporter call stockpile.search_catalog query="mechanical keyboard"
The skill advertises destructive commerce capabilities such as delete_inventory_item, fulfill_order, and refund_order without clear operator warnings, confirmation guidance, or mention of irreversible business effects. In an autonomous agent setting, omission of these guardrails increases the chance of accidental financial loss, inventory deletion, or improper order handling.
The authenticated endpoints include multiple state-changing marketplace actions such as creating stores, listing inventory, and fulfilling orders, but the spec provides no warning, confirmation, or explicit safe-use guidance for potentially irreversible commercial actions. In an agentic context, this increases the risk that an automated system will execute unintended transactions or fulfillment actions from ambiguous prompts, causing financial loss, reputational harm, or operational disruption.
The skill installs and runs the MCP server via uvx without pinning an exact package version. That creates a supply-chain risk: future upstream releases of mcp-stockpile could change behavior or introduce malicious code, and agent operators would silently consume it at runtime.
The metadata declares uvx execution for the MCP package but does not constrain the package to a fixed version. In an autonomous agent context, unpinned runtime dependencies are dangerous because they allow unreviewed upstream updates to gain access to API keys and transactional capabilities.
The package: mcp-stockpile entry references a mutable package name rather than a pinned version. Because this skill interfaces with storefront management, fulfillment, and refunds, a compromised or changed package could directly perform unauthorized commerce actions or exfiltrate secrets.
The skill advertises order fulfillment and refund operations but does not clearly warn that these actions can trigger real-world financial and operational consequences. In an autonomous setting, users may enable the skill without understanding that the agent can ship orders, issue refunds, or otherwise affect live commerce workflows.
The documentation encourages users to 'call any tool directly,' which normalizes unrestricted invocation of sensitive capabilities without discussing authorization boundaries or approval checks. Given that the server exposes store creation, inventory deletion, fulfillment, and refunds, broad direct tool access increases the chance of accidental or unauthorized high-impact actions.
mcporter list stockpile --schema
Or call any tool directly:
```bash
mcporter call stockpile.search_catalog query="mechanical keyboard"
The documented tools include destructive or irreversible actions such as delete_inventory_item, fulfill_order, and refund_order, but the skill omits direct warnings about side effects. This is risky because agents or operators may treat these tools as routine API helpers rather than actions that alter inventory, customer orders, and funds.
The tool contract states that only unpinned bulletin notes may be removed, but the implementation forwards any supplied note_id directly to the delete endpoint without checking pinned state. In an agent setting, this mismatch can cause unauthorized or unintended deletion of important pinned announcements if the backend does not enforce the rule consistently.
The delete_store_item handler performs a DELETE request that removes or unlists store inventory, but the code provides no confirmation prompt, logging, or inline warning to disclose the destructive action at execution time. For a code file, this matches the missing-warning criterion for destructive or irreversible operations lacking any form of user disclosure.
pip install mcp-stockpile installs the latest available release rather than a known-reviewed version, which weakens reproducibility and increases supply-chain risk. In this context the package is an MCP server intended to receive sensitive API keys and perform live store operations, so compromise of a published package could lead to credential theft or unauthorized commerce actions.
The dependency declaration mcp>=1.0.0 is open-ended and does not constrain installation to versions known to be free of the listed MCP SDK advisories. In an MCP server package, this is more dangerous than a generic library because MCP is part of the server’s trust boundary and known flaws in request validation, DNS rebinding protection, or task authorization could directly affect deployed agent/server behavior.
The httpx>=0.27.0 requirement is not strictly pinned, so consumers may resolve to versions whose security posture has not been reviewed in this project. Although the known advisory set for httpx appears older and may not affect current versions, the manifest still leaves supply-chain uncertainty and weakens reproducibility.
The pydantic>=2.0.0 specifier permits a broad set of releases without demonstrating that vulnerable versions are excluded. Because pydantic often processes untrusted input, unresolved exposure to parsing or regex-related flaws could become reachable depending on how the package validates MCP or HTTP data.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
The delete_bulletin_note branch issues a DELETE request to remove bulletin content, but there is no confirmation, logging, or nearby comment/docstring warning that content will be deleted. This is a file-modifying/destructive action exposed by code without any explicit disclosure.
Detected: suspicious.exposed_secret_literal