mcp-aviation-weather

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:35 AM UTC
• Version: 1.0.0

Overview

The skill appears to provide aviation weather tools, but its install instructions and documentation are inconsistent and can run unpinned npm code with unclear paid-request controls.

Review this before installing. Confirm which npm package is authoritative, pin an exact audited version, and understand the L402 pricing and any spending limits before allowing an agent to call the tools repeatedly. Prefer running it in a restricted environment with only the required network access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:22

Finding

Unpinned npm Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:22-23
Vulnerability Type: Unpinned remote dependency execution
Risk Level: High

Vulnerable Code

json

"command": "npx",
"args": ["-y", "@vbotholemu/mcp-aviation-weather"]

Technical Analysis

The documented MCP configuration invokes npx with the -y option and a package name that has no exact version constraint. Consequently, npm can download and execute the registry version resolved at invocation time without requesting user confirmation.

The effective executable is the package's published dist/index.js. That artifact is not included in the audited project, so its equivalence to the reviewed src/index.ts implementation cannot be established. The package identity is also inconsistent: SKILL.md and package.json reference @vbotholemu/mcp-aviation-weather, while README.md instructs users to execute @blue-trianon/mcp-aviation-weather. This ambiguity increases the possibility of installing an unintended or unverified package.

This creates a supply-chain trust boundary in which code can change after the skill has been reviewed. A malicious package release, registry account compromise, package-name mistake, or ownership transfer could cause arbitrary attacker-controlled JavaScript to run when the MCP server starts.

Attack Path

1. An attacker compromises the referenced npm package, its publisher account, or another package selected because of the documented identity mismatch.
2. The attacker publishes a malicious package version whose executable or installation lifecycle behavior contains an arbitrary payload.
3. A user applies the configuration from SKILL.md.
4. The MCP client executes npx -y @vbotholemu/mcp-aviation-weather.
5. npx resolves and downloads the current registry package without interactive approval.
6. npm or npx runs the package-controlled code with the privileges and environment of the MCP host process.

...[truncated 590 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the invoked package to an audited exact version, for example:

   json

   "command": "npx",
   "args": ["-y", "@vbotholemu/mcp-aviation-weather@1.0.0"]
   

2. Reconcile the package name across SKILL.md, README.md, and package.json so all installation instructions identify the same verified publisher and package.
3. Include a lockfile and use deterministic installation procedures such as npm ci where the deployment model permits it.
4. Verify npm provenance, publisher identity, package integrity hashes, and signatures before deployment.
5. Ensure the reviewed build output is reproducible and confirm that the published dist/index.js matches the audited source.
6. Prefer installing and approving the dependency separately instead of allowing the MCP client to retrieve executable code automatically at startup.
7. Run the MCP server in a restricted account or sandbox with minimal filesystem, environment-variable, process-execution, and network permissions.
8. Disable or tightly control npm lifecycle scripts during trusted installation workflows where they are unnecessary.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a functional aviation weather skill, but the provided code does not implement any observable capability at all. It neither accesses an L402 API nor processes METAR/TAF data or nearby stations. This is a material description-to-code mismatch because the code is effectively empty relative to the declared primary purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README mentions that requests are metered via L402 micropayments, but it does not clearly warn users at the tool usage level that invoking the exposed MCP tools may automatically incur real charges. In an MCP context, tools can be called by agents or users repeatedly during normal workflows, so insufficient disclosure can lead to unexpected financial spend and unintentional abuse of paid endpoints.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares executable/network-relevant capabilities via an MCP server configuration and environment requirements, but it does not define any explicit permission or allowed-tools scope. This creates an avoidable trust gap: consumers cannot clearly constrain what the skill is allowed to invoke, increasing the chance of unintended network access or broader execution than expected.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill executes a package through npx -y @vbotholemu/mcp-aviation-weather without pinning an exact immutable version. This exposes users to supply-chain risk: a future malicious or compromised package release could be fetched and executed automatically, leading to arbitrary code execution in the host environment.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json

"author": "Blue-Trianon-Ventures",
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "zod": "^3.23.0"
  },
  "devDependencies": {

Unverifiable Dependency: @modelcontextprotocol/sdk has 3 known advisory(ies) (CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport); CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

The manifest allows a floating @modelcontextprotocol/sdk version while that package family has known advisories, making it impossible to verify from this file whether installs resolve to a safe release. In an MCP skill, the SDK is central to protocol and transport handling, so exposure to issues like cross-client data leakage, ReDoS, or missing DNS rebinding protections can materially affect confidentiality and availability if an affected version is installed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "zod": "^3.23.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",

Unverifiable Dependency: zod has 1 known advisory(ies) (CVE-2023-4316 (Zod denial of service vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 79% confidence

Finding

The zod dependency is not pinned, and the package has a known denial-of-service advisory in some versions, so the manifest does not let reviewers determine whether installations are safe. Because schema validators often process attacker-controlled input, an affected resolved version could enable resource exhaustion through crafted payloads.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 30)May include surrounding context.

json

"zod": "^3.23.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json

},
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}