mcp-charter-planner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:42 AM UTC
• Version: 1.0.0

Overview

The charter-planning tool itself is straightforward, but its install instructions can run mutable npm packages and the docs name two different package identities.

Review before installing. Prefer a verified, exact package version or a local audited build, and resolve the @vbotholemu versus @velocibot package-name inconsistency before running it. Treat generated sailing guidance as planning support only and verify routes, weather, charter-company restrictions, and safety decisions with qualified local sources.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Remote Package Execution and Inconsistent Package Identity

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-25, README.md:18-24, package.json:2
Vulnerability Type: Unpinned third-party package execution and package identity mismatch
Risk Level: Medium

Vulnerable Code

SKILL.md:20-25:

json

{
  "mcpServers": {
    "charter-planner": {
      "command": "npx",
      "args": ["-y", "@vbotholemu/mcp-charter-planner"]
    }
  }
}

README.md:18-24:

json

{
  "mcpServers": {
    "charter-planner": {
      "command": "npx",
      "args": ["-y", "@velocibot/mcp-charter-planner"]
    }
  }
}

package.json:2:

json

"name": "@vbotholemu/mcp-charter-planner",

Technical Analysis

The documented configuration executes an npm registry package through npx -y without pinning an exact version or verifying package integrity. Consequently, the code executed on a user's system is the package version currently resolved by npm, rather than a fixed artifact corresponding to the audited source.

The -y option suppresses the package-installation confirmation prompt. If the package is absent from the local cache, npx may download it and immediately execute its declared binary. Any future package release, compromised maintainer account, or malicious registry artifact can therefore change the effective executable after this source has been reviewed.

There is also an identity inconsistency: SKILL.md and package.json identify the package as @vbotholemu/mcp-charter-planner, while README.md instructs users to execute @velocibot/mcp-charter-planner. These are distinct npm package identities. A user following the README may execute a package that does not correspond to the reviewed project.

No malicious behavior was found in the reviewed TypeScript implementation itself. The risk arises from the mutable and inconsistent external installation instructions.

Attack Path

1. An attacker publishes or gains co ...[truncated 1466 chars]

Remediation

View remediation

Remediation Suggestions

1. Choose one verified npm package identity and use it consistently in SKILL.md, README.md, and package.json.
2. Pin the package to an exact reviewed version, for example:

   json

   {
     "command": "npx",
     "args": ["--yes", "@vbotholemu/mcp-charter-planner@1.0.0"]
   }
   

3. Prefer installing from a lockfile-controlled deployment or a verified local artifact rather than resolving a mutable package every time the MCP server starts.
4. Publish and verify package provenance, checksums, and registry ownership. Where supported, enforce npm provenance attestations and integrity validation.
5. Avoid automatic confirmation suppression when package retrieval is unexpected. Clearly inform users that npx may download and execute external code.
6. Run the MCP server as a dedicated, least-privileged user without unnecessary credentials, sensitive environment variables, or write access to important files.
7. Add release controls such as mandatory multifactor authentication, protected publishing workflows, dependency review, and automated package-content comparison against the audited source.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Yes, this is a mismatch. The description claims a full-featured BVI sailing charter planning skill, but the provided code chunk contains no substantive behavior at all beyond an empty module declaration. There is no evidence of itinerary planning, weather usage, provisioning support, tailoring by experience level, or any other declared travel-related functionality. The actual code does not support the declared primary purpose.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill launches an MCP server via npx -y @vbotholemu/mcp-charter-planner without pinning an exact package version. This creates a supply-chain risk: a future malicious or compromised package release could be fetched and executed automatically at runtime, and -y removes an interactive safety check, increasing the chance of silent execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly suggests a night sail ('Consider a night sail from Anegada back to Virgin Gorda') in a recreational itinerary-planning context without an adjacent safety warning, prerequisite checks, or a caution that night passages substantially increase navigational risk. Because this tool targets charter vacation planning for users with varying experience, the omission can normalize hazardous boating behavior and lead users to undertake a higher-risk passage without proper training, charts, weather review, or local guidance.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency uses a caret range instead of an exact pinned version, which makes builds non-reproducible and can silently pull in newly published releases. In an MCP skill, dependency drift is meaningful because upstream SDK changes can affect transport, auth, and client/server isolation behavior without review.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"author": "velocibot",
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "zod": "^3.23.0"
  },
  "devDependencies": {

Unverifiable Dependency: @modelcontextprotocol/sdk has 3 known advisory(ies) (CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport); CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest references @modelcontextprotocol/sdk with a non-exact version while known advisories exist for this package, so the resolved installation could include a vulnerable release without visibility from the manifest alone. This is more concerning in an MCP skill because the SDK sits on the trust boundary for model-to-tool communication, where data leakage, DNS rebinding, or ReDoS issues can directly affect connected clients or hosts.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The zod package is specified with a version range, so different installations may resolve to different code over time. That increases supply-chain and stability risk, especially for a tool that may parse untrusted user input through validation logic.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "zod": "^3.23.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",

Unverifiable Dependency: zod has 1 known advisory(ies) (CVE-2023-4316 (Zod denial of service vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 80% confidence

Finding

zod has a known advisory history and the manifest does not pin an exact version, so it is unclear whether deployment resolves to an affected build. Because validation libraries often process attacker-controlled input, a vulnerable version could expose denial-of-service conditions through crafted payloads.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json

"zod": "^3.23.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 32)May include surrounding context.

json

},
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}