Sefaria API MCP

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:36 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned, but it asks users to install and run unpinned external Node code and its connect tool runs a relative script path that is not included in the reviewed package.

Review this before installing. Only use it if you are comfortable trusting the external GitHub repository and its npm dependencies at install time. Prefer a pinned commit or release, verify the source, run installation in a low-privilege/containerized environment, and ensure the connect command resolves the intended built server file from a trusted directory.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:15
• Finding: Unpinned External Repository and Dependency Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15-25 **Vulnerability Type**: Untrusted and unpinned software supply chain **Risk Level**: High ### Vulnerable Code ```markdown 1. Clone the repository: ```bash git clone https://github.com/davad00/sefaria-api-mcp.git cd sefaria-api-mcp ``` 2. Install dependencies: ```bash npm install ``` 3. Build the project: ```bash npm run build ``` ``` ### Technical Analysis The installation procedure retrieves the mutable default branch of an external GitHub repository and then runs `npm install` and `npm run build`. It does not pin the repository to a reviewed commit, tag, or cryptographically verified release. The audited package does not include the external repository's source code, a `package.json`, or a dependency lockfile. Consequently, the effective code and dependency graph executed by users cannot be established from the reviewed artifact. The remote repository owner, a compromised maintainer account, or a compromised dependency could change the executable payload after this skill has been reviewed. Both installation and build operations can execute arbitrary package lifecycle scripts, including `preinstall`, `install`, `postinstall`, `prepare`, `prebuild`, and `postbuild` scripts. These scripts normally run with the permissions of the user performing the installation. This finding does not establish that the current remote repository or its dependencies are malicious. It establishes that the documented workflow lacks controls that bind installation to reviewed content. ### Attack Path 1. An attacker compromises the referenced repository, its maintainer account, or one of its transitive dependencies. 2. The attacker adds malicious code to the mutable default branch or to an npm lifecycle/build script. 3. A user follows the documented installation instructions. 4. `git clone` retrieves the changed content without verifying an approved commit or checksum. 5. `npm install` or `npm run ...[truncated 848 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the external source to a specific, reviewed commit hash rather than cloning a mutable default branch. 2. Publish versioned releases and provide cryptographic checksums or signed provenance that users can verify before installation. 3. Include a reviewed `package-lock.json` and use `npm ci` instead of `npm install` to enforce the locked dependency graph. 4. Audit all direct and transitive dependencies and use automated dependency and provenance checks in CI. 5. Review package lifecycle scripts and, where compatible with the project, install with `npm ci --ignore-scripts` before explicitly running only trusted build steps. 6. Vendor the required reviewed implementation into the distributed artifact, or clearly identify the external component as a separate trust boundary. 7. Run installation and build operations in a restricted container or low-privilege account without access to production credentials. ]]>

T07 · Tool Hijacking and Spoofing

Error

• Location: skill.js:9
• Finding: Relative Script Resolution Permits Local Tool Substitution<![CDATA[ ## Vulnerability Details **File Location**: `skill.js`, lines 9-19 **Vulnerability Type**: Execution of an unverified script through a relative path **Risk Level**: High ### Vulnerable Code ```javascript { name: 'connect', description: 'Start the Sefaria API MCP server', command: async (context) => { const { port = 8080 } = context?.params || {}; return command('node', ['dist/index.js'], { env: { PORT: port } }) } }, ``` ### Technical Analysis The `connect` tool launches Node.js with `dist/index.js` as a relative path. The implementation does not resolve that path from the trusted location of `skill.js`, set an explicit working directory, verify the target file's identity, or ensure that the target belongs to the installed skill package. Relative script paths are ordinarily interpreted against the spawned process's effective working directory. If that directory differs from the expected repository root, Node.js may execute a different `dist/index.js`. This risk is material because the audited artifact does not contain the referenced `dist/index.js`. Therefore, successful operation necessarily depends on content outside the reviewed package or on a particular external working-directory layout. An attacker able to place files in the effective working directory could substitute the expected MCP server with attacker-controlled JavaScript. The use of an argument array prevents the `port` value from being interpolated into the command line, so the reviewed code does not demonstrate shell-command injection through `port`. The vulnerability is instead the unresolved and unverified executable script path. ### Attack Path 1. An attacker identifies or influences the working directory used when the skill invokes the `connect` tool. 2. The attacker creates a `dist` directory in that location and writes a malicious `dist/index.js`. 3. A user or agent invokes `connect`. 4. The skill executes `node dist/index.js` witho ...[truncated 1007 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle the intended server implementation inside the reviewed package. 2. Resolve the server entry point from the trusted module location rather than from the process working directory. For an ES module, derive the package directory from `import.meta.url` and construct an absolute path with `fileURLToPath` and `path.resolve`. 3. Set an explicit trusted `cwd` when spawning the process. 4. Before execution, verify that the resolved path exists, is a regular file, and remains inside the expected package directory after canonicalization. 5. Fail closed with a clear error when the bundled server entry point is absent; do not search arbitrary working directories for a replacement. 6. Consider validating the server file against a release-time cryptographic digest before launching it. 7. Execute the MCP server with least privilege and a minimal environment so that compromise of the child process exposes fewer credentials and files. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.