Tmp.Z6S6o6j6SG

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 0.3.2

Overview

This Evite integration is disclosed and purpose-aligned, but it needs review because setup runs an unpinned npm MCP server with Evite passwords or browser session cookies and can modify events, guests, and messages.

Install only if you are comfortable giving this MCP server access to your Evite account. Prefer a pinned, reviewed package version; avoid putting passwords or raw cookies in project files; disable Fetchproxy unless you explicitly need it; use a unique Evite password; and carefully confirm any write action such as messaging guests, editing events, sending invitations, or canceling events.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:17
• Finding: Unpinned Third-Party Package Is Downloaded and Executed Automatically<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17-30 **Vulnerability Type**: Unpinned and automatically executed third-party dependency **Risk Level**: High ### Vulnerable Code ```markdown Add to `.mcp.json` in your project or `~/.claude/mcp.json`: ```json { "mcpServers": { "evite": { "command": "npx", "args": ["-y", "evite-mcp"], "env": { "EVITE_EMAIL": "[e-mail]", "EVITE_PASSWORD": "yourpassword" } } } } ``` ``` The alternative installation method is also unpinned: ```bash npm install -g evite-mcp ``` ### Technical Analysis The configuration invokes `npx -y evite-mcp` without an exact package version or integrity constraint. When the MCP server starts, `npx` may retrieve the currently published package from the npm registry and execute it automatically. The `-y` option suppresses the interactive installation prompt. The global installation command similarly installs whichever release is currently resolved by npm. Neither approach provides a lockfile, integrity hash, reviewed version constraint, or mechanism establishing that the npm artifact corresponds to the linked source repository. This creates a supply-chain boundary in which behavior reviewed at one point can be replaced by a later package release. A compromised npm publisher account, malicious package update, or registry-level attack could introduce arbitrary executable code. Because credentials are supplied to the same process, a compromised release could directly access them. ### Attack Path 1. An attacker compromises the `evite-mcp` npm publisher account, package, or release process. 2. The attacker publishes a malicious release under the existing package name. 3. A user starts the configured MCP server or runs the documented global installation command. 4. `npx -y` downloads and executes the malicious release without an approval prompt, or npm installs it globally. 5. The package runs with the permissions ...[truncated 707 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the dependency to an exact reviewed version, for example `evite-mcp@<audited-version>`. - Remove `-y` so installation or package changes are not accepted silently. - Use a lockfile and verify npm integrity metadata or a separately published cryptographic checksum. - Verify that the npm artifact corresponds to the reviewed source and build process. - Prefer a locally installed, reviewed dependency over runtime package retrieval. - Run the MCP server in a sandbox with restricted filesystem and network access. - Configure the process with only the secrets and permissions required for its documented Evite operations. - Establish an update-review process before changing the pinned package version. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:17
• Finding: Reusable Evite Password Is Stored in Plaintext MCP Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17-28 **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: High ### Vulnerable Code ```markdown Add to `.mcp.json` in your project or `~/.claude/mcp.json`: ```json { "mcpServers": { "evite": { "command": "npx", "args": ["-y", "evite-mcp"], "env": { "EVITE_EMAIL": "[e-mail]", "EVITE_PASSWORD": "yourpassword" } } } } ``` ``` ### Technical Analysis The documented setup places a reusable Evite email address and password directly in `.mcp.json`. The suggested location may be either a project file or a user-level configuration file. A project-local configuration is particularly exposed because it can be committed to source control, copied into archives, synchronized to remote systems, included in support bundles, or shared with collaborators. A user-level plaintext file remains accessible to processes and tools operating with the same user privileges unless strong filesystem controls are applied. The configuration also passes the password to an external npm package through its environment. Any code executed by that process can read the environment variable. The documentation does not prescribe a secret manager, restrictive file permissions, repository ignore rules, secret rotation, or a scoped and revocable authorization mechanism. ### Attack Path 1. A user follows the documentation and writes an Evite password into `.mcp.json`. 2. The file is committed, synchronized, backed up, shared, or read by another local tool or process. 3. An attacker obtains `EVITE_EMAIL` and `EVITE_PASSWORD` from the plaintext configuration. 4. The attacker authenticates to Evite using the captured reusable credentials. 5. The attacker reads invitation and guest information or performs account-authorized event and messaging operations. An alternative path is a compromised `evite-mcp` dependency reading the credentials directly ...[truncated 657 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not store reusable passwords directly in project or user-level MCP configuration files. - Integrate with an operating-system credential store or dedicated secret manager and resolve the secret only at runtime. - Prefer an official scoped, revocable OAuth or device-authorization flow over account passwords. - If environment variables remain necessary, inject them from a protected secret store rather than declaring their values in `.mcp.json`. - Explicitly exclude `.mcp.json` and related secret-bearing files from source control and distribution. - Apply restrictive filesystem permissions to any local configuration that references credentials. - Document credential rotation and revocation procedures. - Run the MCP dependency with minimal environment exposure so it cannot inherit unrelated credentials. - Warn users to use a unique Evite password and to rotate any credential previously committed or shared. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:34
• Finding: Raw Session Cookies and Browser Cookie Extraction Exceed Least-Privilege Authentication<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 34-38 **Vulnerability Type**: Sensitive session-token handling and elevated browser-session access **Risk Level**: High ### Vulnerable Code ```markdown ## Auth The server resolves a session in priority order (see the README for details): 1. **`EVITE_EMAIL` + `EVITE_PASSWORD`** — headless email/password login (preferred). 2. **`EVITE_SESSION_COOKIE`** — a raw `cookie:` header copied from a signed-in evite.com tab. 3. **Fetchproxy bootstrap** — lifts session cookies from a signed-in evite.com browser tab. Opt out with `EVITE_DISABLE_FETCHPROXY=1`. ``` ### Technical Analysis The Skill supports a raw `cookie:` header copied from an authenticated Evite browser session. Such a cookie is bearer-equivalent session material: possession may be sufficient to act as the signed-in user until the session expires or is revoked. The “Fetchproxy bootstrap” option is more privileged because it is described as lifting session cookies from a signed-in browser tab. Access to browser authentication state expands the MCP server’s trust boundary beyond normal task-specific API authorization. The documentation does not identify the Fetchproxy endpoint, its authorization model, domain-isolation guarantees, storage and logging behavior, or controls preventing access to unrelated browser cookies. This mechanism is enabled unless the user opts out with `EVITE_DISABLE_FETCHPROXY=1`. Making access to sensitive browser session state opt-out rather than opt-in conflicts with least-privilege principles. A conventional scoped token would provide a narrower and more revocable authorization boundary. ### Attack Path 1. A user copies a raw authenticated cookie into `EVITE_SESSION_COOKIE` or allows Fetchproxy bootstrap to obtain it from a signed-in browser tab. 2. The cookie becomes available to the external MCP server process. 3. A malicious or compromised dependency reads the cookie from the environment, process state ...[truncated 1113 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove raw browser-cookie authentication and browser-cookie extraction where possible. - Replace these mechanisms with an official scoped OAuth, device authorization, or similarly revocable token flow. - Make any exceptional browser integration explicitly opt-in and require informed user consent before accessing session state. - Restrict access strictly to the required Evite domain and cookie names. - Ensure cookies are processed locally, never logged, never transmitted to unrelated services, and never stored longer than required. - Encrypt any unavoidable temporary session storage and apply restrictive access controls. - Document session expiration, revocation, deletion, and incident-response procedures. - Disable Fetchproxy by default rather than requiring users to opt out. - Sandbox the MCP process and limit its network destinations to documented Evite endpoints. - Independently review the external package implementation before relying on claims concerning cookie isolation or safe session handling. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

MCP Config Access

High

• Category: Agent Snooping

Content

### Option A — Claude Code (direct MCP)

Add to `.mcp.json` in your project or `~/.claude/mcp.json`:

```json
{

• Confidence: 95% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: evite-mcp
description: This skill should be used when the user asks about Evite events or invitations. Triggers on phrases like "check Evite", "my Evite events", "who RSVP'd", "Evite guest list", "RSVP to the party", "message my Evite guests", "create an Evite invite", or any request involving event invitations, guest lists, RSVPs, or party/event hosting on evite.com.
---

# evite-mcp

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger text is broad enough to activate on general invitations, guest lists, RSVPs, or event-hosting requests, not just clearly scoped Evite actions. Over-broad routing can cause the agent to invoke a third-party skill in contexts where the user did not intend Evite access, increasing the chance of unnecessary account access or unintended actions.

Static analysis

No suspicious patterns detected.