Security audit

signupgenius

Security checks for vulnerabilities and agentic risk

Overview

This SignUpGenius skill is mostly purpose-aligned, but it needs review because it uses account/session access and undercounts its write actions.

Review this before installing. It can use sensitive SignUpGenius session cookies, passwords, or API keys, and it can change account or signup state. Only configure it for accounts you control, prefer the narrowest auth mode that works, and require explicit confirmation before any RSVP, slot claim/release, or group-member change.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

MCP Config Access

High

Category: Agent Snooping
Content: ### Mode 1 — fetchproxy fallback (zero env vars, recommended) Install the [fetchproxy extension](https://github.com/chrischall/fetchproxy) once, sign into [signupgenius.com](https://www.signupgenius.com), and add to `.mcp.json` (project) or `~/.claude/mcp.json` (global): ```json {
Confidence: 95% confidence
Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest description says the skill reads sign-up sheets and adds members to groups, but later documentation also exposes public RSVP, slot-claim, and slot-release write operations. This mismatch can mislead users and orchestrators into invoking a skill with broader mutation capability than advertised, weakening informed consent and safe routing.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger description covers broad phrases like any request involving SignUpGenius sign-ups, RSVPs, volunteer slots, or groups, which may over-match ordinary conversation. Overly broad invocation increases the chance an agent routes a user request into a skill with write capabilities when the user did not clearly intend to use it.

Session Persistence

Medium

Category: Rogue Agent
Content: # signupgenius-mcp MCP server for [SignUpGenius](https://www.signupgenius.com) — 14 read tools + 2 write across profile, groups, sign-ups, and reports. - **npm:** [npmjs.com/package/signupgenius-mcp](https://www.npmjs.com/package/signupgenius-mcp) - **Source:** [github.com/chrischall/signupgenius-mcp](https://github.com/chrischall/signupgenius-mcp)
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The file states there are only '2 write' tools, but the documented tool list includes additional write-capable operations such as signupgenius_rsvp, signupgenius_claim_slot, and signupgenius_release_slot. Understating write surface area creates a deceptive security boundary and increases the risk of unintended state-changing actions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation says signupgenius_list_slots can reveal who has signed up on any public sign-up, but it does not clearly warn users that participant visibility extends to public sheets they do not own. This omission can normalize privacy-invasive use and lead to accidental disclosure or harvesting of participant information.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The Gotchas section claims only two tools mutate, directly contradicting earlier documentation of RSVP, slot claim, and slot release operations. Contradictory safety-relevant documentation can cause users or agent wrappers to treat the skill as lower risk than it actually is.

Static analysis

No suspicious patterns detected.