ofw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:06 PM UTC
• Version: 2.16.1

Overview

The skill fits its OurFamilyWizard purpose, but it grants broad access to sensitive co-parenting records while using unpinned third-party code and plaintext credentials.

Review this carefully before installing. Use a pinned, reviewed version or commit of ofw-mcp, avoid putting OFW credentials in a project file or shell command, prefer a protected secret store, and run the server with limited local permissions. Treat sends, deletes, expense creation, uploads, downloads, notifications, and unread message reads as actions that can affect legal co-parenting records or visible account state.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:24
• Finding: Unpinned Third-Party Package Is Downloaded and Executed with Sensitive Account Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24-46 **Vulnerability Type**: Unpinned and automatically executed third-party dependency **Risk Level**: High ### Vulnerable Code ```json "command": "npx", "args": ["-y", "ofw-mcp"] ``` ```bash npm install -g ofw-mcp ``` ```bash git clone https://github.com/chrischall/ofw-mcp cd ofw-mcp npm install && npm run build ``` ### Technical Analysis The recommended `npx -y ofw-mcp` command automatically downloads and executes the package version currently resolved by the npm registry. No exact version, integrity hash, signature, lockfile, or manual review step is required. The `-y` option suppresses the normal installation confirmation. The alternative global installation is also unpinned. The source-based procedure clones the repository's current default branch and installs its dependency graph without requiring a reviewed commit or demonstrating lockfile-integrity enforcement. This is particularly sensitive because the resulting MCP server receives `OFW_USERNAME` and `OFW_PASSWORD` and is intended to access private co-parenting messages, contact details, calendar events, expenses, journal entries, and attachments. It can also perform consequential write operations, including sending messages and deleting records. ### Attack Path 1. An attacker compromises the `ofw-mcp` npm package, its publisher account, the upstream repository, or a transitive dependency. 2. The attacker publishes or introduces a malicious version while retaining the expected package name and interface. 3. A user follows the documented `npx -y ofw-mcp`, global installation, or source-build procedure. 4. The unreviewed code executes locally with the user's operating-system privileges and receives the OFW credentials through environment variables. 5. The malicious component captures credentials, reads private OFW records, performs unauthorized account operations, or accesses other data available to the local process. ### ...[truncated 702 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `ofw-mcp` to a specific, reviewed version rather than resolving the latest release: ```json "command": "npx", "args": ["--yes", "ofw-mcp@<reviewed-version>"] ``` 2. Prefer a preinstalled, reviewed binary over downloading code every time the Skill runs. 3. Record and verify package integrity hashes or signatures before execution. 4. For source installation, check out a reviewed commit hash rather than the mutable default branch. 5. Enforce a committed lockfile and use a reproducible installation command such as `npm ci`. 6. Audit package lifecycle scripts and the complete transitive dependency tree before granting credentials. 7. Run the MCP server under a restricted operating-system account or sandbox with only the filesystem and network access required for OFW. 8. Document an update process requiring review before changing the pinned version or commit. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18
• Finding: OFW Password Is Stored or Supplied in Plaintext Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18-63 **Vulnerability Type**: Plaintext credential exposure **Risk Level**: Medium ### Vulnerable Code ```json { "mcpServers": { "ofw": { "command": "npx", "args": ["-y", "ofw-mcp"], "env": { "OFW_USERNAME": "[e-mail]", "OFW_PASSWORD": "yourpassword" } } } } ``` ```bash cp .env.example .env # Edit .env: set OFW_USERNAME and OFW_PASSWORD ``` ```bash mcporter config add ofw \ --command "ofw-mcp" \ --env "OFW_USERNAME=[e-mail]" \ --env "OFW_PASSWORD=yourpassword" \ --config ~/.mcporter/mcporter.json ``` ### Technical Analysis The setup instructions direct users to place the OFW password in `.mcp.json`, an `.env` file, or the mcporter configuration. These are plaintext files unless additional protections are applied. A project-level `.mcp.json` or `.env` also creates a risk of accidental source-control inclusion. The mcporter command additionally places the password directly in command-line arguments. Depending on the shell and operating system, this may expose it through shell history, process inspection, terminal logs, debugging output, or command auditing. Authentication is necessary for the declared OFW integration, so requesting credentials does not by itself exceed functional requirements. However, persistent plaintext storage and command-line disclosure are not the minimum-risk methods of supplying those credentials. ### Attack Path 1. A user follows the setup instructions and inserts a real OFW password into a project configuration, home-directory configuration, `.env` file, or command line. 2. The secret is retained in a plaintext file, shell history, backup, repository commit, process listing, or diagnostic output. 3. A local user, malicious dependency, compromised development tool, repository collaborator, or backup recipient obtains the stored value. 4. The attacker authenticates to OFW or supplies th ...[truncated 701 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store the password in an operating-system keychain, credential manager, or dedicated secret-management service. 2. Inject secrets into the MCP process at runtime rather than embedding them in project or user configuration files. 3. Do not pass passwords as command-line arguments. Use a protected credential helper, secure prompt, or restricted file descriptor. 4. If file-based secrets are unavoidable, place them outside the project, restrict permissions to the owning user, and document the required permissions. 5. Ensure `.env`, `.mcp.json`, and related local secret files are excluded from source control through `.gitignore` and repository secret-scanning rules. 6. Warn users not to commit credentials and explain how to remove secrets from repository history if accidental exposure occurs. 7. Redact environment variables and command arguments from logs, diagnostics, and support bundles. 8. Recommend password rotation immediately after suspected exposure and use a dedicated credential or scoped token if OFW supports one. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

MCP Config Access

High

• Category: Agent Snooping

Content

### Option A — Claude Code (direct MCP, no mcporter)

Add to `.mcp.json` in your project or `~/.claude/mcp.json`:

```json
{

• Confidence: 95% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Credential Access

High

• Category: Privilege Escalation

Content

#### 2. Configure credentials

```bash
cp .env.example .env
# Edit .env: set OFW_USERNAME and OFW_PASSWORD
```

• Confidence: 91% confidence
• Finding: The skill instructs users to place OFW credentials in a local `.env` file and elsewhere in plaintext environment configuration. Because this skill accesses sensitive co-parenting communications and records, plaintext credential storage materially increases the risk of credential theft from local files, shell history, backups, logs, or accidental repository inclusion.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description is overly broad and includes catch-all language such as requests involving shared expenses or journal entries, which can cause the skill to activate on loosely related prompts. In a privacy-sensitive context like co-parenting records, over-triggering can route unrelated user requests into a tool with access to highly sensitive legal and family data, increasing the chance of unnecessary data access or disclosure.

Session Persistence

Medium

• Category: Rogue Agent

Content

# ofw-mcp

MCP server for OurFamilyWizard — provides read/write access to messages, calendar, expenses, and journal.

- **npm:** [npmjs.com/package/ofw-mcp](https://www.npmjs.com/package/ofw-mcp)
- **Source:** [github.com/chrischall/ofw-mcp](https://github.com/chrischall/ofw-mcp)

• Confidence: 84% confidence
• Finding: The skill exposes persistent read/write access to messages, calendar, expenses, and journal entries, all of which are sensitive family-law records. In this context, broad write capability increases the blast radius of accidental or unauthorized tool invocation, enabling lasting changes to legal communications or shared records.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

`ofw_list_messages`, `ofw_get_message` and `ofw_list_drafts` take
`view: "compact" | "full"`, and **`compact` is the default** — you get the slim
shape without asking. It measured 135.1 KB → 41.1 KB on a real 50-message page.

What compact drops is `listData`, OFW's echo of the list payload. That blob was
58% of the response and 78% of it duplicated fields the same object already

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.