Security audit

IteraTools API

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent IteraTools integration, but it asks users to run an unpinned local MCP package and exposes broad paid, messaging, code, browser, and productivity actions without much scoping guidance.

Review this skill before installing. Prefer the remote MCP endpoint or a pinned, reviewed `mcp-iteratools` package version, use a limited IteraTools API key, avoid exposing unrelated environment variables, and require explicit approval for paid calls, message sending, code execution, browser automation, GitHub/Google changes, and any use of sensitive data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:28
Finding: Unpinned npm Package Execution Through npx
Content: View full analysis
Remediation: View remediation
``` 2. Prefer installing the package in a dedicated project with an exact version and a committed lockfile, then invoke the lockfile-resolved local executable. 3. Verify the package's registry provenance and integrity metadata before execution. Where supported, enforce approved package hashes or signatures in deployment tooling. 4. Disable automatic upgrades. Review new releases and their dependency changes before updating the pinned version. 5. Run the MCP client with least privilege in an isolated account, container, or sandbox. Restrict filesystem and network access to what the integration requires. 6. Provide the API key only to the isolated MCP process. Do not expose unrelated credentials through inherited environment variables, and rotate the key if package compromise is suspected. 7. Document the exact reviewed package version and required permissions so users can make an informed trust decision. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The manifest and installation guidance reference an MCP server package without version pinning, normalizing unsafe supply-chain behavior across the skill. Because this skill bridges to a remote multi-tool service with sensitive actions, compromise of the package can lead to credential theft, arbitrary command execution, or misuse of connected services.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to run npx mcp-iteratools without pinning an exact package version, which allows whatever version is currently published to npm to be fetched and executed. If the package is compromised, typosquatted, or a malicious update is released, users may execute attacker-controlled code locally with their own privileges.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This quick-start command invokes an unpinned npm package via npx, causing live code download and execution from the registry at runtime. In a skill that exposes broad capabilities including browser automation, messaging, scraping, and code execution, a compromised package could immediately yield significant local or downstream abuse.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The API-key example again instructs execution of npx mcp-iteratools without a version pin, combining secret material in the environment with execution of mutable third-party code. A malicious package update could steal the IteraTools API key or perform arbitrary actions using the user's credentials and local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill advertises powerful remote actions—browser automation, scraping, messaging, code execution, GitHub and Google integrations, WhatsApp/SMS/email—without clearly warning users that the skill can trigger sensitive external side effects and process confidential data. This omission increases the chance of unsafe use, over-broad authorization, or accidental high-impact actions by agents or users who may treat it as a generic utility.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.