MCP Server Setup Kit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:57 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent MCP setup guide, but it asks users to run mutable third-party server packages with powerful tokens and encourages live write actions without enough safeguards.

Review before installing. Use test workspaces and repositories first, pin exact MCP server versions from trusted publishers, grant the narrowest token scopes possible, avoid running npx -y or uvx against unreviewed packages, and do not connect production Slack, Notion, GitHub, or Linear access unless you are comfortable with the agent reading and modifying those systems.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:44

Finding

Unpinned Third-Party MCP Packages Are Downloaded and Executed

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

text

**Token scopes needed:** `repo`, `read:user`, `read:org`
**Generate at:** github.com → Settings → Developer Settings → Personal Access Tokens

**5-Minute Connect test prompts:**
1. `"List my open GitHub issues across all repos"`

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to execute MCP servers directly from npm via npx -y without pinning a package version. This allows the fetched code to change over time and creates a supply-chain risk where a compromised or malicious new release could be executed automatically with access to the user's local environment and configured tokens.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

uvx mcp-server-{toolname} fetches and runs a Python package without an explicit version, introducing the same mutable dependency risk on the Python side. If a package release is hijacked or replaced, users may execute attacker-controlled code during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This verification command still executes unpinned remote code from npm, so even the 'test before config' step can run an unexpected or compromised package version. Because users are encouraged to run it as part of setup, it normalizes executing mutable third-party code before any trust review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

These sections encourage write-capable tests such as creating pages and pushing code but do not explicitly warn users that the prompts can modify live external services. In a setup skill connected to production collaboration tools, omission of a clear write-action warning increases the chance of unintended data changes, spam, or repository modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Slack and multi-tool examples explicitly instruct sending messages and performing cross-tool actions in live workspaces without a strong caution or confirmation step. Because the skill promotes broad connected access across Slack, GitHub, Notion, and Linear, a single prompt could cause visible, organization-wide changes or disclosures if run against production environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The troubleshooting flow repeats the same unsafe pattern by telling users to run an unpinned MCP server package. Repetition across install, verify, and troubleshooting steps increases exposure and makes accidental execution of a malicious update more likely.

Content

No source excerpt is available for this finding.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The pip install mcp-server-{toolname} instruction installs an unpinned dependency, which can resolve to different code over time and may pull in compromised transitive packages. While installation alone may not immediately execute all package functionality, it still creates a supply-chain exposure in a security-sensitive integration workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.