N2 Stitch MCP

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:27 PM UTC
• Version: 1.0.0

Overview

The skill’s purpose is coherent, but installation relies on automatically running an unpinned npm package that is not included in the reviewed artifact.

Review the npm package and publisher before installing. Prefer pinning a specific reviewed version, avoiding `npx -y` for automatic startup, and providing only the minimum Google/Stitch credentials needed. This is not evidence of malware, but it deserves manual review because future npm releases could change what code runs locally.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Third-Party npm Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–52
Vulnerability Type: Unpinned and automatically executed third-party dependency
Risk Level: Medium

json

{
  "mcpServers": {
    "n2-stitch": {
      "command": "npx",
      "args": ["-y", "n2-stitch-mcp"]
    }
  }
}

Technical Analysis

The documented MCP configuration invokes npx with the package name n2-stitch-mcp but does not specify an exact version or package integrity hash. The -y option suppresses confirmation, allowing npm to retrieve and execute the registry-selected package automatically.

Consequently, the code executed when the MCP server starts can differ from the code that was originally reviewed. The submitted artifact contains only documentation and metadata; it does not include the package implementation, a dependency lockfile, or integrity information that would permit verification of the downloaded executable.

This creates a supply-chain trust boundary around the npm registry, the package publisher account, and future releases of the package.

Attack Path

1. An attacker compromises the npm publisher account, the package publication workflow, or another relevant supply-chain component.
2. The attacker publishes a malicious release under the existing n2-stitch-mcp package name.
3. A user starts an MCP host configured according to the documented example.
4. npx -y n2-stitch-mcp resolves and downloads the unpinned package without requesting confirmation.
5. The malicious package executes with the operating-system privileges and environment inherited from the MCP host.
6. The payload can access resources available to that user and may read credentials exposed to the process, potentially including the documented STITCH_API_KEY.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the privileges of the user running the MCP host. The reachable scope may in ...[truncated 316 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the command to an exact, reviewed package version, for example n2-stitch-mcp@1.0.0, rather than allowing npm to select a changing release.
2. Prefer installing dependencies through a committed lockfile and using a reproducible installation mechanism such as npm ci.
3. Verify package integrity through lockfile integrity hashes, signed provenance, and trusted publication workflows.
4. Avoid npx -y for security-sensitive automatic startup unless the resolved artifact has already been installed and verified.
5. Bundle or vendor auditable implementation source with the skill where practical.
6. Run the MCP server under a dedicated, least-privileged account or sandbox with narrowly restricted filesystem and network access.
7. Provide the process only the credentials it requires. Use narrowly scoped, revocable secrets rather than exposing unrelated environment variables.
8. Document the reviewed package version and establish a controlled process for auditing and approving upgrades.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.