Security audit

Sefaria API MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned, but it asks users to install and run unpinned external Node code and its connect tool runs a relative script path that is not included in the reviewed package.

Review this before installing. Only use it if you are comfortable trusting the external GitHub repository and its npm dependencies at install time. Prefer a pinned commit or release, verify the source, run installation in a low-privilege/containerized environment, and ensure the connect command resolves the intended built server file from a trusted directory.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:15
Finding: Unpinned External Repository and Dependency Execution
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: skill.js:9
Finding: Relative Script Resolution Permits Local Tool Substitution
Content: View full analysis
{ const { port = 8080 } = context?.params || {}; return command('node', ['dist/index.js'], { env: { PORT: port } }) } }, ``` ### Technical Analysis The `connect` tool launches Node.js with `dist/index.js` as a relative path. The implementation does not resolve that path from the trusted location of `skill.js`, set an explicit working directory, verify the target file's identity, or ensure that the target belongs to the installed skill package. Relative script paths are ordinarily interpreted against the spawned process's effective working directory. If that directory differs from the expected repository root, Node.js may execute a different `dist/index.js`. This risk is material because the audited artifact does not contain the referenced `dist/index.js`. Therefore, successful operation necessarily depends on content outside the reviewed package or on a particular external working-directory layout. An attacker able to place files in the effective working directory could substitute the expected MCP server with attacker-controlled JavaScript. The use of an argument array prevents the `port` value from being interpolated into the command line, so the reviewed code does not demonstrate shell-command injection through `port`. The vulnerability is instead the unresolved and unverified executable script path. ### Attack Path 1. An attacker identifies or influences the working directory used when the skill invokes the `connect` tool. 2. The attacker creates a `dist` directory in that location and writes a malicious `dist/index.js`. 3. A user or agent invokes `connect`. 4. The skill executes `node dist/index.js` witho ...[truncated 1007 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep