Stashdog

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:54 PM UTC
• Version: 1.0.0

Overview

This appears to be a real inventory MCP connector, but it needs review because it grants authenticated remote edit/delete access and relies on auto-downloaded proxy code with limited safety guidance.

Install only if you trust the StashDog service and are comfortable giving it OAuth-backed access to your inventory data. Treat edit_item and delete_item as destructive operations and confirm item IDs before using them. Prefer pinning mcp-remote to a reviewed version or running it in a least-privileged environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned npm Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–32
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

json

{
  "mcpServers": {
    "stashdog": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://gmchczeyburroiyzefie.supabase.co/functions/v1/mcp-server/mcp"
      ]
    }
  }
}

Technical Analysis

The recommended configuration runs npx -y mcp-remote without specifying an exact package version or verifying package integrity. npx may download the package and its transitive dependencies from the configured npm registry at invocation time, while -y suppresses the installation confirmation.

Consequently, the code executed by users can differ from the code that was available when this skill was audited. If the package, one of its dependencies, its maintainer account, or the registry resolution path is compromised, a malicious release could execute arbitrary code on the local system. The project contains no lockfile, checksum, signature-verification procedure, or other mechanism that constrains the fetched payload to a reviewed artifact.

Attack Path

1. An attacker compromises the mcp-remote npm package, a transitive dependency, a publisher account, or the package-resolution path.
2. The attacker publishes or causes resolution to a malicious package version.
3. A user adopts the documented MCP configuration.
4. The MCP client invokes npx -y mcp-remote without an exact version constraint or interactive confirmation.
5. npx downloads and executes the attacker-controlled package with the privileges of the invoking user.
6. The malicious process can access resources available to that user and may subsequently launch additional actions.

Impact Assessment

Successful exploitation provides code execution with the privileges of the user running the MCP client. Depending on that user's environment and permissions, the malicious package could acces ...[truncated 375 chars]

Remediation

View remediation

Remediation Suggestions

• Pin mcp-remote to an audited exact version rather than resolving the latest available release, for example by using an exact package@version specification.
• Remove -y where practical so an unexpected installation is not accepted automatically.
• Prefer installing the dependency through a managed project with a committed lockfile and lockfile integrity metadata.
• Verify the package's official publisher, repository, provenance, and release signatures or attestations before deployment.
• Use an internal registry mirror or approved package allowlist for production environments.
• Run the MCP proxy under a dedicated, least-privileged account or sandbox with restricted filesystem, environment-variable, credential, and network access.
• Establish a controlled update process in which new versions and transitive dependency changes are reviewed before rollout.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest and description claim the skill supports only list, search, and add actions, but the documented MCP server also exposes get, edit, and delete operations. This mismatch can mislead users or downstream agents into granting trust to a skill they believe is limited-scope, while it actually enables broader read/write and destructive actions against inventory data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises edit and delete operations, plus add, without any cautionary guidance, confirmation step, or safety note. In an agent context, undocumented destructive or modifying actions increase the chance of unintended inventory changes or deletions, especially if a user assumes the skill is read-mostly based on its description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill instructs users to authenticate via OAuth to a remote third-party inventory service but provides no notice about what account data, inventory contents, or metadata may be shared with that service. This is primarily a transparency and privacy-risk issue: users or agents may connect to an external system without understanding the data exposure involved.

Content

No source excerpt is available for this finding.