myhotlunchbox-mcp

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:05 PM UTC
• Version: 0.5.1

Overview

The skill is mostly transparent and purpose-related, but it exposes raw account-changing and payment-capable My Hot Lunchbox API commands that could modify orders, students, subscriptions, or charge a saved card without strong guardrails.

Install only if you are comfortable manually reviewing every command before it runs. Do not let an agent call write, delete, subscription, or payment endpoints automatically; prefer the MCP version for confirm-gated writes. Keep credentials out of persistent shell profiles, unset the password after login, and avoid saving order or transaction files in shared, synced, or version-controlled folders.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:20
• Finding: Reusable Account Credentials Exported to All Child Processes<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 20-22 **Vulnerability Type**: Sensitive credential exposure through inherited environment variables **Risk Level**: Medium ### Code Snippet ```sh export MHLB_USER='[e-mail]' export MHLB_PASS='…' # e.g. read -rs MHLB_PASS export MHLB=https://ordernow.myhotlunchbox.com ``` ### Technical Analysis The username and password only need to be shell-local variables so that `mhlb_login` can expand them into the authentication request. Exporting `MHLB_USER` and `MHLB_PASS` causes every subsequently launched child process to inherit the reusable credentials. This exceeds the minimum privilege required for authentication. Unrelated subprocesses, compromised command-line utilities, debugging tools, crash-reporting systems, or process-inspection mechanisms may be able to read the inherited environment. Unlike the short-lived access token, the password can generally be reused to create new sessions. The HTTPS transmission of these credentials to the declared My Hot Lunchbox authentication endpoint is necessary for the Skill's stated functionality. The local export to all child processes is not necessary. ### Attack Path 1. A user follows the documented setup and exports `MHLB_USER` and `MHLB_PASS`. 2. The user subsequently launches an unrelated or compromised process from the same shell. 3. That process reads its inherited environment and extracts the two variables. 4. The attacker authenticates to the My Hot Lunchbox service using the reusable credentials. 5. The attacker accesses or modifies resources available to the compromised account. ### Impact Assessment A process that captures the credentials may obtain the same remote privileges as the account owner. Depending on account permissions, this can expose student identities, school details, lunch calendars, order records, transaction information, subscriptions, gift cards, and coupons. It may also permit account and order mut ...[truncated 233 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Keep credentials in non-exported shell variables and remove the password as soon as authentication completes: ```sh MHLB_USER='[e-mail]' MHLB=https://ordernow.myhotlunchbox.com read -rs MHLB_PASS printf '\n' >&2 mhlb_login login_status=$? unset MHLB_PASS return "$login_status" ``` Additional hardening measures: - Do not place the password in shell startup files or persistent environment configuration. - Avoid passing the password as a command-line argument. - Limit the password's lifetime in memory by unsetting it immediately after login. - Consider accepting the password through standard input or a narrowly scoped credential helper. - Remove the unused `offline_access` OAuth scope unless refresh-token functionality is actually required. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38
• Finding: Authenticated Curl Helper Accepts Unrestricted Additional Operands<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 38-42 **Vulnerability Type**: Bearer-token exposure through unrestricted curl argument forwarding **Risk Level**: Medium ### Code Snippet ```sh # Authenticated GET. usage: mhlb_get /parent/childrenInfo [curl args…] mhlb_get() { local endpoint=$1; shift # NOT `path`: zsh ties $path to $PATH curl -sS "$MHLB/api$endpoint" -H "Authorization: Bearer $MHLB_TOKEN" -H 'Accept: application/json' "$@" } ``` ### Technical Analysis The helper adds the account bearer token and then forwards every remaining argument directly to `curl`. Callers can therefore supply arbitrary curl options, additional URLs, output directives, proxy settings, request methods, headers, or upload parameters. This interface is broader than necessary for the declared purpose of performing authenticated GET requests against the fixed My Hot Lunchbox API. Curl can process multiple URLs in one invocation, and request configuration may remain applicable across transfers. Consequently, an additional attacker-controlled URL can receive sensitive authorization headers unless configuration is explicitly reset. Other options can redirect sensitive responses to unintended destinations or alter the expected request. The risk is particularly relevant in an AI Agent context, where arguments may be assembled from untrusted instructions, copied content, or data returned by another tool. ### Attack Path 1. An attacker influences text or data that an Agent uses to construct an `mhlb_get` invocation. 2. The Agent includes an attacker-controlled curl option or additional URL in the helper's trailing arguments. 3. The helper forwards the operand without validation after configuring the bearer-token header. 4. Curl performs an unintended transfer using sensitive request configuration or redirects authenticated data. 5. The attacker obtains the bearer token, authenticated API data, or both. 6. Until the token expires or is revoked, th ...[truncated 706 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Remove unrestricted argument forwarding and constrain the helper to one validated API-relative endpoint: ```sh mhlb_get() { local endpoint=$1 case "$endpoint" in /*) ;; *) printf '%s\n' 'Invalid API endpoint' >&2; return 2 ;; esac case "$endpoint" in *://*|*[$'\r\n']*) printf '%s\n' 'Unsafe API endpoint' >&2 return 2 ;; esac curl --fail-with-body --silent --show-error \ --proto '=https' \ --url "$MHLB/api$endpoint" \ -H "Authorization: Bearer $MHLB_TOKEN" \ -H 'Accept: application/json' } ``` If optional behavior is needed, expose named helper parameters and map them to a small allowlist rather than accepting raw curl arguments. Also: - Reject additional URLs and URL-bearing curl options. - Require HTTPS with `--proto '=https'`. - Keep the API origin fixed rather than allowing arbitrary base URLs in routine use. - Do not accept arguments derived directly from untrusted content. - Consider disabling redirects or strictly limiting them to the expected host. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:80
• Finding: Sensitive Order Model Written to a Predictable Working-Directory File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 80-84 **Vulnerability Type**: Insecure storage of sensitive account data **Risk Level**: Low ### Code Snippet ```sh mhlb_get '/event/createOrder?eventId=123&studentId=456' > order.json # edit quantities in order.json curl -sS -X POST "$MHLB/api/event/createOrder" \ -H "Authorization: Bearer $MHLB_TOKEN" -H 'Content-Type: application/json' \ -d @order.json ``` ### Technical Analysis The documented workflow writes an order model to the predictable file `order.json` in the current directory. It does not establish restrictive permissions, use secure temporary-file creation, warn against version-controlled or synchronized directories, or remove the file after use. The order model may contain student identifiers, event information, menu selections, prices, or other account metadata. File accessibility depends on the user's current `umask` and directory permissions. The predictable filename also allows an existing file or symbolic link to be overwritten when run in an attacker-influenced directory. ### Attack Path 1. A user runs the documented command in a shared, synchronized, attacker-influenced, or version-controlled directory. 2. The shell creates or truncates `order.json` using ambient filesystem permissions, or follows an existing symbolic link. 3. Sensitive order data remains available after the operation. 4. Another local user, synchronization service, backup process, or repository commit captures the file. 5. The exposed data is used to identify students, orders, dates, or other private account details. ### Impact Assessment Successful exploitation exposes the contents of the retrieved order model. It does not directly provide account credentials or additional remote privileges, but it can compromise student and order privacy. In a symbolic-link scenario, the command may also overwrite a file writable by the user running the Skill. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Use restrictive permissions and secure temporary-file handling: ```sh umask 077 order_file=$(mktemp "${TMPDIR:-/tmp}/mhlb-order.XXXXXX") || exit 1 trap 'rm -f "$order_file"' EXIT HUP INT TERM mhlb_get '/event/createOrder?eventId=123&studentId=456' > "$order_file" # Review and edit "$order_file" before submission. ``` Further hardening should include: - Delete the temporary file immediately after successful submission. - Avoid predictable filenames. - Do not store the file in a repository, shared directory, or cloud-synchronized directory. - Verify that the file is a regular file owned by the current user before editing or submitting it. - Warn users that the fetched model may contain private student and order information. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: references/endpoints.md:106
• Finding: Sensitive Transaction Details Persisted in an Unprotected Local File<![CDATA[ ## Vulnerability Details **File Location**: `references/endpoints.md`, lines 106-108 **Vulnerability Type**: Insecure storage of transaction data **Risk Level**: Low ### Code Snippet ```sh ID=$(mhlb_get /event/transactionsList | jq -r '.transactions[0].id') mhlb_get "/event/transactionDetails?id=$ID" | jq -c '. + {isCreditType:false}' > tx.json mhlb_pdf /parentReports/printTransactions "$(cat tx.json)" 'Transaction.pdf' ``` ### Technical Analysis The recipe stores transaction details in the predictable working-directory file `tx.json` and leaves both that file and the generated receipt PDF on disk. No restrictive `umask`, secure temporary file, cleanup trap, or storage warning is provided. Transaction details and receipt documents may contain names, transaction identifiers, order history, amounts, credits, and other financial metadata. Their effective permissions depend on the user's environment. Running the recipe in a shared, synchronized, backed-up, or version-controlled directory can cause unintended disclosure. ### Attack Path 1. A user executes the recipe under ordinary filesystem permissions. 2. Transaction data is written to `tx.json`, and a receipt is written to `Transaction.pdf`. 3. The files remain in the working directory after the command finishes. 4. Another local principal, automated synchronization service, backup system, or accidental source-control commit obtains the files. 5. Private transaction and account information is disclosed. ### Impact Assessment The exposed files may reveal account identity, transaction identifiers, purchase history, payment totals, and related student or order information. This is primarily a confidentiality issue and does not by itself grant authentication privileges. The scope is limited to records written by the user, but those records are financially and personally sensitive. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Avoid an unnecessary persistent JSON file by using a securely created temporary file: ```sh umask 077 tx_file=$(mktemp "${TMPDIR:-/tmp}/mhlb-tx.XXXXXX") || exit 1 trap 'rm -f "$tx_file"' EXIT HUP INT TERM ID=$(mhlb_get /event/transactionsList | jq -r '.transactions[0].id') mhlb_get "/event/transactionDetails?id=$ID" | jq -c '. + {isCreditType:false}' > "$tx_file" mhlb_pdf /parentReports/printTransactions \ "$(cat "$tx_file")" \ 'Transaction.pdf' ``` Additionally: - Apply restrictive permissions to the output PDF, such as through `umask 077`. - Prompt the user for an intentional receipt destination. - Warn against saving receipts in shared, synchronized, or version-controlled directories. - Remove temporary transaction data immediately after the PDF is generated. - Clearly document that both the JSON record and PDF may contain sensitive financial and student-related information. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Ae1

High

• Category: analysis-evasion

Content

`references/endpoints.md` has the rest — deliveries, transactions,

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

External Transmission

Medium

• Category: Data Exfiltration

Content

# The lunch calendar for a date range (POST, despite being a read).
# The fields are `start`/`end`. Using `startDate`/`endDate` returns 200 with an
# EMPTY events array — a silent wrong answer, not an error.
curl -sS -X POST "$MHLB/api/calendar/studentSchoolData" \
  -H "Authorization: Bearer $MHLB_TOKEN" -H 'Content-Type: application/json' \
  -d '{"start":"2026-09-01","end":"2026-09-30"}' | jq '.events[] | {studentId, id, start, className}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill is presented as a shell-based way to 'read and manage' an account, but the documented workflow includes full order-modification and references a live payment endpoint that can charge a real card. This creates a real integrity and financial-risk surface because a user or downstream agent following the skill can submit destructive or billable writes directly with curl, and the text explicitly notes that omitted fields are cleared and that write payloads are unverified.

External Transmission

Medium

• Category: Data Exfiltration

Content

```sh
mhlb_get '/event/createOrder?eventId=123&studentId=456' > order.json
# edit quantities in order.json
curl -sS -X POST "$MHLB/api/event/createOrder" \
  -H "Authorization: Bearer $MHLB_TOKEN" -H 'Content-Type: application/json' \
  -d @order.json
```

• Confidence: 95% confidence
• Finding: This command sends an authenticated write payload to create or modify orders on a real account, and the surrounding documentation warns that missing fields are cleared rather than preserved. Because the payload is edited manually and then posted wholesale, mistakes or unsafe automation can alter orders unexpectedly, causing unauthorized changes, loss of existing selections, or downstream charges when coupled with checkout.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Lunch calendar for a range — a POST that reads
mhlb_post() {
  local endpoint=$1; shift   # NOT `path`: zsh ties $path to $PATH
  curl -sS -X POST "$MHLB/api$endpoint" -H "Authorization: Bearer $MHLB_TOKEN" \
    -H 'Content-Type: application/json' -d "${1:-{\}}"
}

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```sh
mhlb_pdf() {  # usage: mhlb_pdf <endpoint> <json> <out.pdf>
  curl -sS -X POST "$MHLB/api$1" -H "Authorization: Bearer $MHLB_TOKEN" \
    -H 'Content-Type: application/json' -d "$2" -o "$3" && file "$3"
}

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This documentation exposes concrete write-capable and payment endpoints, including order deletion, student modification, subscription changes, and checkout. In a skill intended for scripted use, these instructions materially enable destructive or financially sensitive actions and increase the chance an agent or user triggers real state changes without sufficient confirmation or guardrails.

Description-Behavior Mismatch

Low

• Confidence: 77% confidence
• Finding: The manifest describes reading and managing a My Hot Lunchbox account from a shell with curl, but does not mention generating binary reports and saving PDFs to local files. While related to account data, emitting files is an additional behavior that a user would not clearly infer from the stated description.

Static analysis

No suspicious patterns detected.