Security audit

WHOOP MCP

Security checks for vulnerabilities and agentic risk

Overview

This WHOOP connector is mostly coherent, but it needs Review because it runs an unpinned npm MCP package that handles OAuth tokens and sensitive health data.

Review before installing. Prefer a pinned, reviewed version of `whoop-mcp-unofficial`, avoid launching it through an always-current `npx` command, and treat the WHOOP token directory and health summaries as sensitive. The promotional branding instruction should be removed or ignored unless the user asks about maintainers or repositories.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:59
Finding: Unsolicited Promotional Output Injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:21
Finding: Unpinned Third-Party Package Download and Execution
Content: View full analysis
Remediation: View remediation
`. - Remove `-y` from user-facing setup instructions so users can review installation prompts. - Prefer a locally installed dependency governed by a committed lockfile rather than resolving the current registry release at every launch. - Verify package provenance, publisher identity, release signatures, and npm integrity metadata before execution. - Document a controlled upgrade process that requires security review before changing the pinned version. - Run the MCP server with least privilege and isolate it from unrelated credentials and files. - Restrict outbound network access to the endpoints required for npm installation and WHOOP operation where practical. - Protect `~/.whoop-mcp/` with restrictive filesystem permissions and avoid exposing its contents to unrelated processes. - Consider distributing a reviewed artifact with checksums or using a trusted package manager configuration that enforces lockfile and integrity validation. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs users to execute an npm package via npx without pinning an exact version, which allows whatever package version is current at execution time to be fetched and run. Because this is an MCP server that may handle OAuth tokens and user health data locally, a malicious or compromised future release could lead to code execution, secret theft, or unauthorized data access.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This authentication command also uses unpinned npx execution, so the version retrieved at runtime is not fixed or auditable. In the auth flow, the risk is amplified because the invoked code may process OAuth credentials and token material, making a compromised package release especially sensitive.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.