walk-the-reality-next-door

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:03 AM UTC
• Version: 1.0.2

Overview

The skill describes a harmless read-only fiction MCP server, but its install instructions execute an unpinned remote npm package that was not included for review.

Install only after pinning a reviewed exact npm version or reviewing the package source yourself. Prefer running it in a restricted environment with minimal filesystem access and no inherited secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned npm Package Is Downloaded and Executed via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-19
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

sh

claude mcp add reality-next-door-walk -- npx -y reality-next-door-walk

json

{ "mcpServers": { "reality-next-door-walk": { "command": "npx", "args": ["-y", "reality-next-door-walk"] } } }

Technical Analysis

Both documented installation methods invoke npx -y with the unversioned npm package name reality-next-door-walk. This causes npm to resolve, download, and execute whichever package version the configured registry currently serves. The -y option suppresses the installation confirmation.

The project contains only SKILL.md; it provides no package source, exact version, lockfile, integrity hash, or publisher-verification material. Therefore, the remotely obtained implementation cannot be audited from this artifact, and its behavior can change after this Skill has been reviewed. Claims that the server makes no network calls, file writes, credential accesses, or logs are documentation statements rather than properties verifiable from the supplied project.

Attack Path

1. An attacker compromises the npm package, its publisher account, or the relevant package-delivery infrastructure.
2. The attacker publishes a malicious version under the same package name.
3. A user follows either connection example in SKILL.md.
4. npx -y resolves and downloads the mutable package without requesting confirmation.
5. npm lifecycle code or the package entry point executes with the privileges and environment of the MCP client user.
6. The malicious package can attempt actions available to that user before or while presenting itself as the documented MCP server.

Impact Assessment

Successful exploitation permits arbitrary code execution within the invoking user's security context. Depending on host permissions and sandboxing, the packa ...[truncated 560 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to an audited exact version rather than resolving the latest release, for example reality-next-door-walk@X.Y.Z.
2. Verify the pinned release against reviewed source and record its expected registry integrity digest.
3. Supply the implementation or a reproducible source reference with the Skill so the documented safety properties can be independently reviewed.
4. Use a lockfile and a controlled installation process instead of relying solely on ad hoc npx -y execution.
5. Disable or ignore npm lifecycle scripts where compatible with the package's legitimate operation.
6. Restrict package installation to a trusted registry and monitor publisher ownership and package provenance.
7. Run the MCP server in a sandbox or container with minimal filesystem access, no inherited secrets, restricted process execution, and denied network access unless explicitly required.
8. Periodically re-audit each package update before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill documentation instructs users to execute the package via npx -y reality-next-door-walk without pinning a specific version. That means installation will resolve to the latest published package at runtime, creating a supply-chain risk: a malicious or compromised future release could be executed automatically by users or agents. The claimed read-only/no-network behavior in the prose does not mitigate this, because the risk exists before trust in the package is established.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.