DoubleTick

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:26 AM UTC
• Version: 1.0.1

Overview

The skill does what it says, but it asks users to run an unpinned npm package with Gmail access and enables recipient email-open tracking without clear consent or privacy guidance.

Review this carefully before installing. Pin doubletick-cli to a reviewed exact version, avoid runtime npx -y resolution where possible, and use it only where recipients have appropriate notice or consent for open tracking and metadata collection.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-38
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: node
    package: doubletick-cli
    bins:
      - doubletick

bash

npx doubletick-cli login

json

{
  "mcpServers": {
    "doubletick": {
      "command": "npx",
      "args": ["-y", "doubletick-cli"]
    }
  }
}

Technical Analysis

The skill instructs users and the MCP host to execute doubletick-cli without specifying an exact package version or verifying an integrity digest. In particular, the MCP configuration uses npx -y, which permits npm to resolve, download, and execute the currently available package without interactive confirmation.

Consequently, the code ultimately executed can change after the skill has been audited. If a future package release, npm account, package ownership, or transitive dependency is compromised, launching the MCP server could execute attacker-controlled code. The reviewed SKILL.md does not itself contain a malicious payload; the risk arises from unsafe dependency resolution and execution.

Attack Path

1. An attacker compromises the npm publisher account, package ownership, release process, or a dependency of doubletick-cli.
2. The attacker publishes a malicious package version that satisfies the unpinned package reference.
3. A user follows the documented login command or starts the configured MCP server.
4. npx, particularly with the -y option, resolves and downloads the malicious version without asking the user to approve the installation.
5. The malicious package executes with the permissions and environment of the user running the agent or MCP host.
6. The payload can access resources available to that process and perform actions under the user's operating-system account.

Impact Assessment

Successful explo ...[truncated 535 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin doubletick-cli to a reviewed exact version in every installation and execution command, such as doubletick-cli@X.Y.Z.
2. Replace the runtime npx -y doubletick-cli invocation with a lockfile-controlled local installation and execute the installed binary directly.
3. Commit and enforce a package lockfile containing integrity hashes, using deterministic installation such as npm ci.
4. Verify the package publisher, provenance, signatures where available, and npm integrity metadata before approving upgrades.
5. Review direct and transitive dependency changes before updating the pinned version.
6. Run the MCP server with least privilege in an isolated environment, exposing only the files, environment variables, and credentials required for its declared email-tracking function.
7. Avoid automatic installation approval for security-sensitive runtime startup. If dynamic installation remains necessary, require explicit confirmation and validate the resolved package version and integrity before execution.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The skill installs and runs a Node package via npx without pinning an exact version, which allows whatever version is current at execution time to be fetched and executed. This creates a supply-chain risk: a malicious update, account compromise, or dependency hijack could lead to arbitrary code execution on the user's system when they install or start the MCP server.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The MCP server configuration launches npx -y doubletick-cli without a pinned version, so each run may download and execute the latest published package. In the MCP context this is especially dangerous because the server is intended to be regularly invoked by an agent, increasing exposure to supply-chain compromise and unreviewed code changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly enables covert email-open tracking and collection of metadata such as open count, device, and timing, but the documentation does not present a prominent warning about recipient privacy, consent, or legal/compliance implications. This omission can mislead users into deploying surveillance-like functionality without understanding that it may violate policy, expectations, or applicable privacy laws.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.