ClawHub
Back to skill

Security audit

maxpreps-mcp

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently provides read-only access to public MaxPreps sports data using a local decoder script and disclosed network requests.

Install this only if you are comfortable letting the agent run a local Node.js helper that contacts MaxPreps public web endpoints and caches a temporary build identifier. It does not need MaxPreps credentials or browser access, and I found no write, delete, posting, credential, or persistence behavior beyond the temp cache.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Ae1

High
Category
analysis-evasion
Content
`/_next/data/<buildId>/<path>.json`. `scripts/mpx.mjs` resolves the `buildId`, fetches, and decodes.
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
`/_next/data/<buildId>/<path>.json`. `scripts/mpx.mjs` resolves the `buildId`, fetches, and decodes.
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Chaining Abuse

High
Category
Tool Misuse
Content
```bash
curl -s https://www.maxpreps.com/nc/charlotte/myers-park-mustangs/football/25-26/roster/ \
  | grep -oE 'src="https://asset\.maxpreps\.io/[^"]+\.js"' | sed 's/src="//;s/"$//' \
  | xargs -P8 -n1 curl -s | grep -ohE 'GSSP_ROSTER_SERIALIZE_KEYS",0,\[[^]]*\]'
```

The contest lists live in the schedule page's chunks under `deserializeContestList` —
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to use a local Node.js script and plain curl-capable access to fetch data from MaxPreps, which is a real network capability, but it does not declare any explicit tool scope or permission boundary. In a skill ecosystem, undeclared network use is dangerous because it weakens least-privilege controls and can allow unexpected outbound requests to untrusted destinations if the script or documentation is later modified or abused.

Missing User Warnings

Low
Confidence
82% confidence
Finding
This markdown file provides a `curl`/`xargs` pipeline that fetches remote JavaScript bundles from maxpreps.com to re-derive decode keys, but the surrounding documentation does not warn that it will make external network requests. Under the markdown-file criteria, network behavior that could affect privacy or system integrity should be disclosed to the user.

Static analysis

No suspicious patterns detected.