Tmp.2Z44zTwlap

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:06 AM UTC
• Version: 1.1.6

Overview

This skill is for a real SignUpGenius integration, but it asks users to run an unpinned third-party MCP package and route reusable account credentials through local configuration or a browser extension.

Install only if you are comfortable trusting the referenced npm package and browser extension with your SignUpGenius account session. Prefer a pinned and reviewed package version, avoid project-level config files for secrets, restrict file permissions, rotate credentials if exposed, and require manual confirmation before using the group-member or RSVP write tools.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:19
• Finding: Unpinned Third-Party Package Is Downloaded and Executed Automatically< once, sign into [signupgenius.com](https://www.signupgenius.com), and add to `.mcp.json` (project) or `~/.claude/mcp.json` (global): ```json { "mcpServers": { "signupgenius": { "command": "npx", "args": ["-y", "signupgenius-mcp"] } } } ``` ``` ### Technical Analysis The configuration invokes `npx -y signupgenius-mcp` without pinning an exact package version or supplying a lockfile or integrity constraint. The `-y` option permits installation without interactive confirmation. Consequently, startup can retrieve and execute whichever package version the npm registry resolves at that time. The effective executable can change after this Skill has been reviewed. If the npm publisher account, package, registry resolution process, or a transitive dependency is compromised, arbitrary replacement code could execute under the privileges of the user running the MCP server. The repository contains only `SKILL.md`; it does not include the package implementation, a dependency manifest, a lockfile, or integrity metadata with which to verify the downloaded payload. ### Attack Path 1. An attacker compromises the `signupgenius-mcp` npm package, its publisher account, or a dependency used by a newly published release. 2. The attacker publishes a malicious version under the same package name. 3. A user starts the configured MCP server. 4. `npx -y` resolves and downloads the current package version without requiring user review. 5. The malicious package executes locally with the user's process privileges. 6. It may read accessible files, environment variables, MCP configuration, and authentication material or make arbitrary network requests. ### Impact Assessment Successful exploitation permits arbitr ...[truncated 380 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `signupgenius-mcp` to a specific, reviewed version rather than relying on the current registry release. - Commit a package manifest and lockfile that records exact dependency versions and integrity hashes. - Install dependencies during an explicit reviewable setup phase instead of downloading them automatically whenever the server starts. - Verify npm provenance, publisher identity, signatures where available, and package integrity before execution. - Review transitive dependencies and use automated vulnerability and package-tampering monitoring. - Run the MCP server in a sandbox with restricted filesystem, environment-variable, process, and network access. - Establish a controlled update process in which new releases are audited before the pinned version is changed. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:17
• Finding: Recommended Authentication Mode Exposes Reusable Session Cookies to External Components< once, sign into [signupgenius.com](https://www.signupgenius.com), and add to `.mcp.json` (project) or `~/.claude/mcp.json` (global): ```json { "mcpServers": { "signupgenius": { "command": "npx", "args": ["-y", "signupgenius-mcp"] } } } ``` At startup the MCP reads your `accessToken` / `cfid` / `cftoken` cookies once via the extension, then talks to SignUpGenius directly — the extension is **not** in the request hot path after that. Works with free accounts. ``` ### Technical Analysis The recommended authentication mode gives an external browser extension access to SignUpGenius authentication cookies and then transfers those cookies to an independently distributed MCP package. Session cookies such as `accessToken`, `cfid`, and `cftoken` are reusable bearer credentials: possession may be sufficient to impersonate the authenticated account until the session expires or is revoked. This creates two third-party trust boundaries—the browser extension and the npm package—around credentials that can provide broader account access than a narrowly scoped API token. The repository does not include either implementation, so the audit cannot verify extension permissions, local transport security, credential retention, logging behavior, or destination restrictions. Authenticated access is necessary for private account operations. However, using full browser-session credentials as the recommended default exceeds minimum privilege for public-signup reads and may exceed it for operations that could instead use scoped, revocable authorization. There is no evidence in `SKILL.md` that credentials are intentio ...[truncated 1268 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer narrowly scoped, revocable API authorization over browser-session cookie extraction. - Do not recommend cookie-based authentication as the default when unauthenticated public access or scoped authorization is sufficient. - Separate public, read-only, and write-capable operations into distinct permission scopes. - Restrict the extension's host permissions to the exact required SignUpGenius origin and document every requested browser permission. - Ensure credentials are transferred only through an authenticated local channel and are never written to disk, logs, telemetry, crash reports, or command-line arguments. - Keep credentials only in memory for the shortest possible period and explicitly clear them after use. - Pin and audit both the extension and MCP package, including their update mechanisms. - Document session revocation procedures and advise users to revoke active sessions immediately after suspected compromise. - Sandbox the MCP server and apply destination allowlisting so authenticated requests can be sent only to documented SignUpGenius endpoints. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34
• Finding: Long-Lived Passwords and API Keys Are Placed Directly in MCP Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-59` **Vulnerability Type**: Plaintext secret storage in configuration **Risk Level**: Medium ### Vulnerable Code ```text ### Mode 2 — session login (email + password) Add an env block with your direct-login credentials (won't work with Google/Apple/Facebook/Microsoft SSO or 2FA): ```json { "mcpServers": { "signupgenius": { "command": "npx", "args": ["-y", "signupgenius-mcp"], "env": { "SIGNUPGENIUS_EMAIL": "[e-mail]", "SIGNUPGENIUS_PASSWORD": "your-password" } } } } ``` ### Mode 3 — Pro API key (required for slot reports) The three `signupgenius_report_*` tools that list filled / available / all participants for a given sign-up only work against the documented Pro v2 API. Get a key from **Pro Tools → API Management** in your SignUpGenius dashboard (Pro subscription required), then: ```json "env": { "SIGNUPGENIUS_USER_KEY": "your-api-key" } ``` ``` ### Technical Analysis The instructions direct users to insert an account password or API key into `.mcp.json` or `~/.claude/mcp.json` as plaintext environment values. Although the examples use placeholders rather than real hardcoded credentials, following the documented procedure creates persistent local copies of sensitive authentication material. A project-level `.mcp.json` can be accidentally committed to source control, copied into build artifacts, shared with collaborators, or exposed through backups. A global configuration can be read by other processes or local users where filesystem permissions are too broad. Processes launched by the MCP environment may also inherit configured environment variables. The account-password mode is particularly sensitive because it uses a general login credential rather than a task-specific token. The documentation does not require restrictive file permissions, version-control exclusions, a secret manager, or credential rotation. ### Attack P ...[truncated 1066 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Store credentials in an operating-system keychain, dedicated secret manager, or MCP-supported secure credential facility rather than directly in JSON. - Use configuration references that resolve secrets at runtime without embedding their values in project files. - Add `.mcp.json` and other local secret-bearing configuration files to `.gitignore`, while providing a separate sanitized example file. - Enforce owner-only filesystem permissions on global configuration and secret files. - Prefer short-lived, narrowly scoped, revocable tokens over account passwords. - Avoid passing secrets through command-line arguments or emitting them to logs, debug output, telemetry, or error reports. - Limit environment-variable inheritance to the MCP process that requires the credential. - Document credential rotation and immediate revocation procedures. - Add automated secret scanning in local hooks and CI to detect accidental commits. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

MCP Config Access

High

• Category: Agent Snooping

Content

### Mode 1 — fetchproxy fallback (zero env vars, recommended)

Install the [fetchproxy extension](https://github.com/chrischall/fetchproxy) once, sign into [signupgenius.com](https://www.signupgenius.com), and add to `.mcp.json` (project) or `~/.claude/mcp.json` (global):

```json
{

• Confidence: 95% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger description is extremely broad, including generic phrases like "available slots" and "any request involving" a wide range of sign-up scenarios. This can cause unintended invocation in unrelated contexts, exposing SignUpGenius account data or initiating write-capable workflows when the user did not explicitly intend to use this integration.

Session Persistence

Medium

• Category: Rogue Agent

Content

# signupgenius-mcp

MCP server for [SignUpGenius](https://www.signupgenius.com) — 14 read tools + 2 write across profile, groups, sign-ups, and reports.

- **npm:** [npmjs.com/package/signupgenius-mcp](https://www.npmjs.com/package/signupgenius-mcp)
- **Source:** [github.com/chrischall/signupgenius-mcp](https://github.com/chrischall/signupgenius-mcp)

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill exposes write actions (`signupgenius_add_group_member` and `signupgenius_rsvp`) but the description and examples do not state that the agent must warn or confirm with the user before performing mutations. In an agent setting, this increases the risk of accidental account changes from ambiguous or casually phrased requests.

Static analysis

No suspicious patterns detected.