Security audit

TheCorporation.ai Form and Operate

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing corporate operations, but it relies on an unpinned third-party CLI for legal, financial, identity, signing, and agent actions that can materially affect a company.

Install only if you trust TheCorporation CLI and are comfortable letting it handle corporate formation, governance, equity, payment, payroll, tax, signing, and agent workflows. Prefer a pinned and reviewed CLI version, run it in a least-privileged or isolated environment, verify local or cloud mode before use, and require human review before signing documents, issuing equity, filing taxes, sending payments, changing API URLs, or activating agents.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:5
Finding: Unpinned Third-Party npm CLI Execution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (73)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill manifest and content repeatedly instruct use of npx corp without any version pinning. Because npx resolves the latest package at runtime, a compromised upstream package, malicious republish, or breaking update could execute arbitrary code on the host when the skill is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill description activates on many common corporate tasks and directs users toward unpinned npx corp usage. Unpinned runtime package execution creates a supply-chain execution path where arbitrary code from the latest published package may run in sensitive environments handling legal, financial, and identity data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill description triggers on a very broad range of common corporate and administrative tasks, which can cause the skill to activate in contexts where users did not intend to run specialized governance/finance tooling. That broad routing increases the chance that an agent proposes or executes sensitive CLI workflows, including the unpinned package, inappropriately or with insufficient user confirmation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The Quick Start begins with an unpinned npx corp setup, which is likely to be copy-pasted and executed directly. In a setup step, this is particularly risky because it often runs before users establish trust boundaries and may configure auth, storage, or network endpoints while executing unverified package code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Referencing npx corp as the primary CLI without version pinning encourages dynamic retrieval of executable code each time the command is used. This increases the attack surface for supply-chain compromise and makes behavior non-reproducible across users and time.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The local mode recommendation still relies on unpinned npx corp commands. Even though the described hosting mode is local, the package acquisition step remains remote and can execute attacker-controlled code before any 'local only' guarantees apply.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The advanced server example starts an unpinned CLI process as a server. A compromised package could expose a malicious local service, alter request handling, or persist on the host, increasing the consequences beyond a one-off command execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Using unpinned npx corp config set in setup flows enables a compromised package to modify configuration, including API endpoints, in ways that can redirect future traffic or data to attacker-controlled infrastructure. This is especially dangerous because config changes can persist after the initial command exits.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Even a seemingly read-only verification command like npx corp context is still arbitrary package execution when unpinned. Users may incorrectly assume status/context commands are harmless and execute them without scrutiny, broadening exploitation opportunities.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The reference-resolution helper command is unpinned and likely to be used interactively across many workflows. This normalizes repeated execution of mutable upstream code in environments containing sensitive corporate references and identifiers.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The one-shot formation command is a high-sensitivity workflow involving names, emails, addresses, incorporator status, and legal entity creation. Executing it through an unpinned package exposes both code-execution risk and sensitive corporate/PII handling to any upstream compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The staged formation commands are also unpinned, and they handle sensitive founder identity and ownership information. Because these are likely copy-pasted verbatim, a compromised package could alter documents, exfiltrate founder data, or manipulate corporate records during formation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Setting active_entity_id through an unpinned CLI can enable malicious code to tamper with operator context or silently switch the target entity for subsequent commands. In governance and finance tooling, context manipulation can lead to actions being applied to the wrong legal entity.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Governance body creation via unpinned npx introduces supply-chain risk into legal-governance operations. A compromised package could create incorrect bodies, tamper with metadata, or stage later fraudulent approvals.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Seat assignment is sensitive because it affects voting structure and authority. An unpinned package could misassign holders or capture contact references, leading to governance integrity issues in addition to code-execution risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The meeting convene step is unpinned and handles agenda text that may reflect confidential decisions. Dynamic package resolution here risks both arbitrary execution and exposure or manipulation of upcoming board actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The agenda listing command itself is less impactful than write operations, but it still executes unpinned code and may reveal confidential governance matters if compromised. Users may underestimate this because it appears informational.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Written-consent workflows are legally significant approval mechanisms. Using an unpinned package to generate or manage them could let a malicious upstream package alter approval text, capture sensitive board decisions, or fabricate downstream references.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Cap-table instrument creation is unpinned and directly affects securities records. A compromised package could manipulate authorized units, pricing, or terms, causing legal, financial, and compliance harm beyond the initial code-execution vector.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Equity issuance via unpinned npx is especially dangerous because it combines arbitrary package execution with high-impact state changes affecting ownership. A malicious or changed upstream package could misissue shares, alter recipients, or exfiltrate equity data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: SAFE issuance is a financing action involving investor identity and monetary terms. Executing it through an unpinned package exposes sensitive financing data and could result in manipulated investment documents or terms if the package is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: 409A valuation creation through an unpinned package is risky because valuations influence option pricing and tax compliance. A malicious package could alter enterprise value or methodology inputs, creating downstream compliance and fiduciary issues.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Submitting a valuation with an unpinned CLI risks tampering with workflow state or leaking sensitive valuation information. While narrower than creation or approval, it still executes mutable external code in a regulated context.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Approval of a valuation using an unpinned package can subvert a legally and tax-relevant approval chain. A compromised package may attach the wrong resolution, falsify approval state, or leak sensitive board approval information.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Transfer operations affect ownership records and can have legal consequences. An unpinned package creates both code execution risk and the possibility of silent manipulation of transfer direction, quantity, or rights.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.