Security audit

connskill-growth

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real paid services connector, but it needs Review because it combines wallet-payment authority, unpinned executable packages, and SMS/email verification services without enough scoping.

Install only if you trust the publisher and are comfortable giving local code access to a dedicated low-balance wallet. Avoid using the SMS or inbox endpoints for third-party account verification unless you have clear authorization. Prefer pinned, reviewed package versions and run the MCP/server or script in a restricted environment with minimal filesystem access and a strict wallet budget.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:19
Finding: Unpinned Third-Party Packages Are Downloaded and Executed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/x402-call.mjs:12
Finding: Payment Authorization Can Be Redirected to an Arbitrary Configured Origin
Content: View full analysis
{ process.stdout.write(typeof o === 'string' ? o : JSON.stringify(o, null, 2)); process.stdout.write('\n'); }; if (method.toLowerCase() === 'prices') { const wk = await fetch(`${ORIGIN}/.well-known/x402`).then(r => r.json()); out((wk.services || []).map(s => ({ endpoint: s.endpoint, usd: s.accepts?.[0]?.amount != null ? Number(s.accepts[0].amount) / 1e6 : null, summary: s.description || s.summary || '' }))); process.exit(0); } if (!path.startsWith('/')) { console.error('usage: x402-call.mjs [json]'); process.exit(2); } const args = JSON.parse(json); const url = new URL(ORIGIN + path); const opts = { method: method.toUpperCase(), headers: { 'user-agent': 'connskill-growth-skill/0.2' } }; if (opts.method === 'GET') for (const [k, v] of Object.entries(args)) if (v != null) url.searchParams.set(k, String(v)); else { opts.headers['content-type'] = 'application/json'; opts.body = JSON.stringify(args); } let doFetch = fetch; if (KEY) { const { privateKeyToAccount } = await import('viem/accounts'); const { wrapFetchWithPayment } = await import('x402-fetch'); const account = privateKeyToAccount(KEY.startsWith('0x') ? KEY : `0x${KEY}`); doFetch = wrapFetchWithPayment(fetch, account, BigInt(Math.round(MAX_USD * 1e6))); } ``` ### Technical Analysis `X402_ORIGIN` controls the destination used for both ordinary API requests and payment-enabled requests. The value is passed to `new URL()` without an HTTPS requiremen ...[truncated 2281 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description explicitly promotes SMS verification numbers and receive-only inboxes for verification workflows without limiting use to authorized, compliant scenarios. These capabilities are commonly abused for account creation, anti-abuse bypass, and evasion of identity or rate-limit controls, so advertising them as generic utilities materially raises misuse risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation gives concrete workflow guidance for obtaining SMS verification numbers and temporary inboxes, but it does not state any legal, contractual, or authorized-use limits. Operational instructions make misuse easier by lowering friction for verification abuse and disposable identity workflows.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises capabilities that require environment access and arbitrary network calls, but it does not declare any explicit tool scope or permission boundaries. This increases the chance that an agent runtime will grant broader-than-necessary access, making wallet use and outbound requests less transparent and harder to govern.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx -y @connskill/mcp-growth-services without a pinned version pulls whatever package version is current at execution time, creating a supply-chain risk. If the package is compromised or a breaking/malicious release is published, agents may execute attacker-controlled code with access to environment variables such as the wallet key.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/x402-call.mjs:12