what-brandon-thinks-chat-analyst

• Outcome: Review
• Latest audit: Sep 14, 2026 · 7:31 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a cautious chat-analysis workflow, but its optional MCP setup tells users to run unpinned code from GitHub with npx.

The text-only skill looks appropriate for cautious chat analysis. Treat the optional MCP as the part needing review: install it only if you trust the GitHub source, understand it will run local code, and are comfortable with the chat data you provide to that process. Prefer a pinned commit, audited release, checksum, or sandboxed setup before using the MCP with sensitive conversations.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60

Finding

Execution of an Unpinned Remote Payload Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60-70
Vulnerability Type: Mutable remote code retrieval and execution
Risk Level: High

Vulnerable Code

bash

Connect the stdio server with:

openclaw mcp add what-brandon-thinks \
  --command npx \
  --arg -y \
  --arg github:gpt-img-2/whatbrandonthinks-chat-mcp \
  --include 'build_chat_analysis_brief,score_interaction_signals,audit_chat_claim,get_what_brandon_thinks_resources'

Then run openclaw mcp doctor what-brandon-thinks --probe. If the installed release lacks the mcp command group, add npx -y github:gpt-img-2/whatbrandonthinks-chat-mcp as a Stdio server in MCP settings. The MCP is optional; never imply it ran when unavailable.

Technical Analysis

The installation instructions direct users to execute an MCP server fetched from a GitHub repository through npx. The GitHub dependency is not pinned to an immutable commit hash or a verified release artifact. Its effective payload can therefore change after this Skill has been reviewed.

The -y argument automatically accepts installation prompts, reducing the opportunity for the user to inspect the package and its dependency changes before execution. The fetched software executes with the privileges of the user running OpenClaw or configuring the MCP server.

The MCP implementation is not included in the audited project, so the assertions that it is read-only, does not upload transcripts, and does not access accounts cannot be independently verified from this artifact.

Attack Path

1. An attacker compromises the referenced GitHub repository, its maintainer account, or an upstream dependency used by the MCP project.
2. The attacker changes the repository's default branch or referenced package content to include a malicious installation hook or runtime payload.
3. A user follows the documented command or configures the fallback Stdio server.
4. npx -y retrieves and ex ...[truncated 1197 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP source to a reviewed immutable Git commit rather than the repository's mutable default branch.
2. Prefer a signed, versioned release artifact or package with a cryptographic integrity hash.
3. Remove -y so users can review installation prompts and dependency changes before execution.
4. Publish and audit a dependency lockfile, including transitive dependencies.
5. Vendor the reviewed MCP implementation into the audited distribution when feasible.
6. Document the exact files, environment variables, network endpoints, and data available to the MCP process.
7. Run the MCP under a sandboxed, least-privileged account with restricted filesystem and network access.
8. Add a verification procedure that checks the downloaded source or artifact against an expected commit and checksum before execution.
9. Re-audit the pinned MCP source and its dependencies before claiming that it is read-only or does not transmit transcripts.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to install and execute an MCP server directly from a GitHub reference via npx -y github:... without pinning to an immutable commit SHA or audited release version. That creates a supply-chain risk: if the upstream repo is updated, compromised, or force-retagged, future installs may execute different code than the skill author reviewed.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

- Free preview: https://whatbrandonthinks.org/free
- Safety and deletion: https://whatbrandonthinks.org/safety
- Privacy policy: https://whatbrandonthinks.org/privacy
- Raw Skill: https://whatbrandonthinks.org/skills/what-brandon-thinks-chat-analyst/SKILL.md
- MCP source: https://github.com/gpt-img-2/whatbrandonthinks-chat-mcp
- ClawHub listing: https://clawhub.ai/gpt-img-2/skills/what-brandon-thinks-chat-analyst