Security audit

accessoticketing-mcp

Security checks for vulnerabilities and agentic risk

Overview

The skill reads tickets as described, but a crafted ticket page can make barcode saving create files outside your selected folder.

Avoid --barcodes until filenames are sanitized, output paths are confined to the chosen folder, and PNG content is validated. Use verified ticket links and keep ticket URLs, Wallet links, and barcodes private. All bundled source files were reviewed; testing used mocked filesystem operations without live service requests.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: references/parse-tickets.mjs
Finding: Page-controlled ticket IDs escape the barcode output directory
Content: View full analysis
Impact

Attacker-controlled files can be created outside the barcode directory wherever the process has write permission and the destination parent exists. The sanitized MIME subtype controls the extension, and decoded contents are not restricted to PNG images. Existing files cannot be overwritten through this operation; automatic execution was not established.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
`references/parse-tickets.mjs` is dependency-free (no `node_modules`) and takes a URL, a file, or `-` for stdin:

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: network.

Medium