Tmp.JO43v0Z5UV

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:22 AM UTC
• Version: 0.3.0

Overview

This skill is for Etix event lookup, but it asks users to run unpinned external code and route requests through a browser extension using their Etix browser session.

Review before installing. Use only if you are comfortable with an unofficial MCP and browser extension acting through your Etix browser session. Prefer pinning exact package and repository versions, building in a disposable environment, and using a dedicated browser profile with no unrelated signed-in accounts.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:21
• Finding: Unpinned npm Package Is Downloaded and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21–29 **Vulnerability Type**: Remote payload execution through an unpinned third-party package **Risk Level**: High ### Vulnerable Code ```json { "mcpServers": { "etix": { "command": "npx", "args": ["-y", "etix-mcp"] } } } ``` ### Technical Analysis The MCP configuration invokes `npx -y etix-mcp` without specifying an exact package version or integrity value. Consequently, the code executed by this configuration is selected from the npm registry at invocation time and may differ from the version originally reviewed. The `-y` argument automatically accepts installation prompts, reducing the opportunity for users to inspect the selected package version before execution. This creates a remote payload and supply-chain trust boundary: compromise of the npm package, its maintainer account, or its dependencies could cause arbitrary code to execute locally. The project contains only `SKILL.md`; therefore, the implementation and security properties of the downloaded package cannot be verified from the audited artifact. ### Attack Path 1. An attacker compromises the `etix-mcp` npm package, its publisher account, or a transitive dependency. 2. The attacker publishes a malicious release under the existing package name. 3. A user invokes the configured MCP server. 4. `npx` resolves and downloads the current package version from the registry. 5. The `-y` option permits installation without an interactive confirmation step. 6. Package installation hooks or runtime code execute with the operating-system privileges of the user running the MCP client. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the invoking user's account. Depending on that account's permissions, malicious package code could access project files, user-readable configuration and credentials, environment variables, local services, and network resources. It could al ...[truncated 289 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `etix-mcp` to an exact, reviewed version rather than allowing registry-time version resolution. 2. Record and verify package integrity hashes through a lockfile or equivalent trusted manifest. 3. Remove `-y` where practical so package installation is not silently approved. 4. Prefer a controlled local installation over downloading executable code during each invocation. 5. Audit the package and its transitive dependencies before deployment. 6. Run the MCP server in a sandbox with narrowly scoped filesystem and network permissions. 7. Use a dedicated, low-privilege operating-system account if the server does not require access to general user files. 8. Establish a controlled update process in which each new version is reviewed before the pin is changed. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:32
• Finding: Unpinned Browser Extension Build Receives Etix Session Context< in your browser and let it finish loading (so the DataDome check clears). The first tool call prints a one-time pairing code — approve it in the Transporter extension popup. ``` ```text **1. This server uses your own etix.com session.** Every request is dispatched through your own browser tab via the fetchproxy extension — your cookies, your TLS, your session. ``` ### Technical Analysis The setup clones the mutable default branch of an external Git repository without pinning a reviewed commit or verifying a signature or hash. It then installs dependencies, builds a Chrome extension, and directs the user to load the result as an unpacked extension. The extension is intentionally paired with a local service and brokers requests through an Etix browser tab using the tab's cookies and session context. This grants substantially more privilege than a conventional public-data search client. Although the stated functionality uses public event information, it relies on the user's browser session to bypass the site's DataDome interstitial. The audited project does not include the extension source, generated manifest, or dependency lockfile. Its exact browser permissions, host restrictions, pairing authentication, localhost access controls, and data-transmission behavior therefore cannot be independently verified from this artifact. The documentation says that all ...[truncated 2445 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the `fetchproxy` repository to a specific reviewed commit and verify its signed tag or cryptographic hash before building. 2. Vendor the reviewed extension source with the Skill, or publish reproducible signed extension artifacts from a controlled release process. 3. Retain and verify an exact dependency lockfile, and audit all production and build dependencies. 4. Document the extension manifest and restrict host permissions to the minimum required Etix origins and endpoints. 5. Avoid broad permissions such as access to all sites, browsing history, or unrelated tabs unless technically indispensable. 6. Use a dedicated browser profile containing no unrelated authenticated sessions or sensitive browsing data. 7. Ensure localhost port `37149` binds only to loopback and requires cryptographically strong, short-lived, origin-bound pairing credentials. 8. Isolate each MCP client rather than implicitly trusting every client sharing the extension and port. 9. Validate every proxied destination against a strict Etix allowlist to prevent arbitrary URL requests or server-side request forgery through the browser bridge. 10. Prevent access to cookie values unless explicitly required; prefer browser-mediated requests that do not reveal raw credentials to the MCP process. 11. Provide visible request approval, pairing revocation, audit logging, and an explicit procedure for disabling and removing the extension. 12. Run build commands in a disposable, low-privilege environment with no access to general user credentials or sensitive project files. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

MCP Config Access

High

• Category: Agent Snooping

Content

### 1. Install etix-mcp

`.mcp.json` (project) or `~/.claude/mcp.json` (global):

```json
{

• Confidence: 95% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The manifest lists several specific trigger phrases, but then expands activation to "any request involving Etix events, venues, performers, or showtimes," which is ambiguous and broad enough to overlap with ordinary conversation about entertainment. This lacks clear boundaries for when the skill should or should not activate.

Static analysis

No suspicious patterns detected.