untappd-mcp

• Outcome: Review
• Latest audit: Oct 16, 2026 · 10:34 AM UTC
• Version: 2.3.2

Overview

This Untappd skill is coherent, but it needs review because it handles account credentials, can post to a public account, and can retain social activity in a local cache.

Install only if you are comfortable giving the skill Untappd account-level access. Prefer a pre-existing access token over username/password login, avoid configurations that auto-confirm public posts, keep the cache path private, and periodically delete cached users or the database if you do not want historical check-ins, venues, and comments retained locally.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This skill explicitly handles access tokens and can obtain them via username/password, making credential exposure a central risk. Because the skill also enables account actions like posting check-ins, toasts, and comments, compromise of these credentials or tokens could grant persistent control over a user's Untappd account and visibility into private or friend-scoped data.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

# Untappd MCP

Talks to Untappd's mobile (v4) API using your own account, calling the same
endpoints the iPad app uses. Authenticates with an access token you already
hold, or mints one via the app's `xauth` endpoint (username + password).

## Setup

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation description is broad enough to trigger on requests about other people's profiles, check-ins, wishlists, and friend activity, increasing the chance of unnecessary collection or disclosure of third-party data. In a social-data context, overbroad routing can cause the agent to use account-linked tools in situations where user intent or authorization is ambiguous.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill can mint access tokens using username/password plus mobile-app client credentials captured outside normal documented flows, which is a credential-handling and token-acquisition risk. Encouraging direct collection of account passwords and reuse of app credentials broadens the attack surface, may violate platform expectations, and could enable account compromise if the environment or logs are exposed.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

## Response shape (`view`)

Thirteen of this server's 46 tools take `view: "compact" | "full"`, and
**`compact` is the DEFAULT** — the slim rung is what you get without asking
for it.

**If you were told to pass `compact: true`, that advice is stale.** It used to

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The skill supports write operations to a public account using confirmation tokens and server modes that can be set to auto, which creates a risk of unintended or reusable action authorization if session state is mishandled. Even though confirmations are a safety control, persisted or automatically approved confirmation state can reduce protection against accidental or coerced posting actions.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md

(#161) — it takes a `view` now, and its field shape is documented with the
  other projections above.

## Write tools (confirmation-gated — these post to your public account)

Each asks the user to confirm first. Where the client can show a confirmation
prompt, it does (unless the server sets `MCP_CONFIRM_ELICITATION=off`). Otherwise the first call makes NO network call and returns

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill stores a local SQLite mirror of users' check-ins, venues, comments, and related history, which expands retention beyond transient API usage and increases privacy risk. Persisting friends' or other users' historical activity can create a secondary data store containing sensitive behavioral data that may be accessed later, retained too long, or exposed through backup/sync mechanisms.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest presents the skill as supporting reading wishlists and posting check-ins, toasts, and comments, but the file-level documentation later says some related write capabilities such as wishlist add/remove and photo attachment are not supported. This creates a capability-description mismatch because the manifest suggests a broader supported action surface than the implementation docs describe.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.