Assimilate MCP

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:52 PM UTC
• Version: 1.0.0

Overview

The skill appears purpose-aligned for controlling Assimilate software, but it asks users to run an unpinned npm MCP server and exposes high-impact edit/render operations without clear safety boundaries.

Review this before installing in a production environment. Pin assimilate-mcp to a reviewed version where possible, run it with least privilege, protect ASSIMILATE_KEY, and require explicit confirmation before importing media, changing grades, configuring outputs, or starting renders.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned npm Package Downloaded and Executed via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5, 22-24, 31-43, and 48-50
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

The package installation metadata does not specify an exact version:

yaml

metadata: {"clawdbot":{"emoji":"🎨","requires":{"bins":["npx"]},"install":[{"id":"node","kind":"node","package":"assimilate-mcp","bins":["assimilate-mcp"],"label":"Install assimilate-mcp"}]}}

The documented MCPorter setup downloads and executes the package without a version pin:

bash

mcporter config add assimilate --command npx --args '["-y", "assimilate-mcp"]'
mcporter list assimilate

The Claude Desktop configuration has the same behavior:

json

{
  "mcpServers": {
    "assimilate": {
      "command": "npx",
      "args": ["-y", "assimilate-mcp"]
    }
  }
}

The Claude Code setup also executes the unpinned package:

bash

claude mcp add assimilate -- npx -y assimilate-mcp

Technical Analysis

The setup instructions invoke npx -y assimilate-mcp without an exact package version or integrity constraint. Consequently, npm resolves the package version available under the relevant registry and distribution tag at installation or execution time. The -y option suppresses the normal confirmation prompt.

The audited artifact contains only documentation and metadata; it does not include the npm package source, a lockfile, or integrity hashes. Therefore, the code ultimately executed by these commands is outside the reviewed artifact and can change independently after this skill has been audited.

This creates a supply-chain vulnerability: compromise of the package publisher account, npm package, release process, transitive dependencies, or registry resolution could cause users to execute attacker-controlled code. No evidence in the audited files proves that the current package is malicious; the findin ...[truncated 1645 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific, reviewed version in every installation and execution example, such as:

   bash

   npx -y assimilate-mcp@1.0.0
   

   Apply the same version pin to the installation metadata, MCPorter arguments, Claude Desktop configuration, and Claude Code command.

2. Prefer installing dependencies through a committed lockfile rather than dynamically resolving the latest registry release at runtime.

3. Verify npm integrity metadata and retain approved package hashes or provenance information as part of the release process.

4. Remove -y where practical so unexpected downloads are not automatically approved.

5. Review the package source, lifecycle scripts, bundled files, and transitive dependency tree before approving each upgrade.

6. Execute the MCP server under a dedicated, least-privileged account with restricted filesystem access, limited environment variables, and network access only to the required Assimilate endpoint.

7. Avoid exposing authorization keys through broadly inherited process environments. Use a scoped secret mechanism and rotate the key if package compromise is suspected.

8. Establish an explicit dependency-update process in which version changes are reviewed, tested, and security-scanned before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to launch an MCP server via npx -y assimilate-mcp without pinning an exact package version. That creates a supply-chain risk: every install or first-run may resolve to the latest published package, allowing unexpected code changes or a compromised release to be executed automatically. In an MCP context this is more dangerous because the server exposes broad file/project/render capabilities and will often run with the user's local privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises and normalizes state-changing operations such as creating projects/groups/shots, importing media, changing grades, configuring outputs, and starting renders, but does not explicitly warn users that these actions can modify active sessions or consume compute/storage. In this domain, unintended edits or renders can disrupt ongoing post-production work, overwrite project state, or trigger costly processing, especially when driven through a natural-language assistant that may act on ambiguous prompts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.