Fload

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:23 PM UTC
• Version: 0.1.0

Overview

The skill matches its Fload analytics purpose, but it needs review because it runs unpinned npm/MCP code with an API key and includes review-reply approval/deletion tools without clear confirmation guardrails.

Install only if you trust the Fload publisher and can pin or verify the MCP package version. Use a narrowly scoped FLOAD_API_KEY, rotate it if exposed, and require explicit approval before any approve_action or reject_action that could publish or delete review replies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: AGENTS.md:13

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: AGENTS.md, lines 13-14 and line 25
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

json

"command": "npx",
"args": ["-y", "@fload-ai/mcp"],

bash

npx skills add fload-ai/mcp --skill fload

Technical Analysis

The documented installation commands execute remotely resolved npm package content without pinning an exact package version or enforcing an integrity hash. Consequently, the code executed by users can differ from the version that was originally reviewed.

The -y option automatically accepts the package installation prompt, reducing the opportunity for users to inspect the resolved package and version before execution. The MCP server is also configured to receive the FLOAD_API_KEY environment variable. If the package or one of its transitive dependencies is compromised, attacker-controlled code could execute with the invoking user's operating-system privileges and read that credential from the process environment.

The second installation command has the same supply-chain weakness because npx resolves and executes an unpinned package used to install the skill.

Attack Path

1. An attacker compromises the @fload-ai/mcp package, a relevant transitive dependency, or the associated package-publishing account.
2. The attacker publishes a malicious release under the package name referenced by the documentation.
3. A user follows the documented setup instructions without specifying an audited version.
4. npx resolves the current package release and executes its installation or startup code.
5. The malicious package executes with the permissions of the user who launched npx.
6. When run as the configured MCP server, the package can access FLOAD_API_KEY from its environment and may exfiltrate it or use it to access data available to that credential.

This path depends on a package supply-chain ...[truncated 760 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @fload-ai/mcp to a specific, reviewed version in every installation and runtime example rather than relying on the latest registry release.
2. Pin the package that provides the skills command as well, and avoid ambiguous package resolution through an unversioned npx invocation.
3. Install dependencies through a committed lockfile and use deterministic installation commands such as npm ci.
4. Verify package integrity using trusted registry integrity metadata, published checksums, or signed release provenance.
5. Remove automatic confirmation with -y from security-sensitive setup instructions where practical, allowing users to review the resolved package and version.
6. Prefer installing and reviewing the package before supplying FLOAD_API_KEY; do not expose production credentials during installation.
7. Use a narrowly scoped API key with only the permissions required by the MCP server. Store it in an appropriate secret manager, rotate it regularly, and revoke it immediately if package compromise is suspected.
8. Run the MCP server in a restricted environment with limited filesystem access, network access, and operating-system privileges.
9. Establish dependency monitoring and a controlled upgrade process so newer package versions are reviewed before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation instruction uses npx skills add fload-ai/mcp --skill fload without pinning a specific package version. This makes the installed code non-reproducible and creates supply-chain risk: a later malicious or compromised release of the package could be fetched and executed by users at install time. In this context, the risk is meaningful because the skill is specifically instructing users to install and run external tooling that can access analytics and business data via API keys.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documents the ability to approve or reject pending review actions, including deletion, but provides no explicit guardrails requiring fresh user confirmation before taking those actions. In an agent setting, this increases the risk of unintended state-changing operations being executed from ambiguous or indirect user requests, especially because review replies affect public customer communications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.