Security audit

signupgenius

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed SignUpGenius MCP integration with sensitive account access, but its behavior is coherent with its stated purpose and write actions are described as confirmation-gated.

Install only if you are comfortable giving a local MCP server access to your SignUpGenius session, password, or API key. Use project-level MCP config where possible, verify the browser extension/package source, and keep write confirmations enabled before adding members, RSVPing, claiming, or releasing slots.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

MCP Config Access

High

Category: Agent Snooping
Confidence: 95% confidence
Finding: The skill instructs users to register an MCP server in project or global configuration and, in Mode 1, to rely on a browser extension that reads authentication cookies once at startup. That creates a high-trust path where a third-party MCP server may gain access to sensitive account credentials or tokens from local config/runtime context, which is especially risky because the skill also supports write actions against the user's account.
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
Mode 1 — fetchproxy fallback (zero env vars, recommended)

Install the ContextMint Bridge browser extension once (releases: Chrome loads the chrome zip unpacked; Safari isn't available yet, so use Chrome for now — it's the fetchproxy extension renamed, source at https://github.com/nullnet-app/contextmint-bridge, verify a zip with its .sha256 file), sign into signupgenius.com, and add to .mcp.json (project) or ~/.claude/mcp.json (global):

json
{

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger description is extremely broad, including generic phrases like 'available slots' and any request involving common community-organizing scenarios. This can cause unintended invocation in conversations where the user did not clearly intend to access SignUpGenius data or perform related actions, increasing the chance of unnecessary account access and follow-on write previews.
Content: No source excerpt is available for this finding.

Session Persistence