mcp-company-search

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:26 AM UTC
• Version: 1.0.0

Overview

The skill appears to do the advertised company-search task, but its install instructions are inconsistent and execute an unpinned npm package, so users should review it carefully before installing.

Install only after confirming the intended npm package owner and pinning a reviewed version. Treat company names and jurisdictions you search as data sent to Nautdev's API, expect possible L402 metered charges, and run the MCP server with restricted filesystem, environment, and network access where practical.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:15

Finding

Unpinned and Inconsistently Named npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: README.md:15-24; SKILL.md:20-30
Vulnerability Type: Insecure package execution and supply-chain ambiguity
Risk Level: Medium

Vulnerable Code

README.md:15-24:

json

{
  "mcpServers": {
    "company-search": {
      "command": "npx",
      "args": ["-y", "@blue-trianon/mcp-company-search"],
      "env": {
        "NAUTDEV_BASE_URL": "https://api.nautdev.com"
      }
    }
  }
}

SKILL.md:20-30:

json

{
  "mcpServers": {
    "company-search": {
      "command": "npx",
      "args": ["-y", "@vbotholemu/mcp-company-search"],
      "env": {
        "L402_API_BASE_URL": "https://api.nautdev.com"
      }
    }
  }
}

The package manifest identifies the project as @vbotholemu/mcp-company-search, while the README instructs users to execute @blue-trianon/mcp-company-search. Neither command pins a package version or integrity digest.

Technical Analysis

npx -y automatically downloads and executes the package selected by the npm registry without asking the user for confirmation. Because no version is specified, npm resolves the current distribution tag, normally latest, each time the command is installed or executed in a fresh environment.

The conflicting package scopes create ambiguity about which publisher and package are authoritative:

• package.json and SKILL.md identify @vbotholemu/mcp-company-search.
• README.md directs users to @blue-trianon/mcp-company-search.

Consequently, reviewed source code in this repository does not reliably identify the code that users will execute. If either referenced package is compromised, transferred, incorrectly published, or controlled by an unintended publisher, a future package version can run arbitrary JavaScript under the invoking user's account. npm lifecycle scripts may also execute during installation, before the MCP entry point itself starts.

Th ...[truncated 1769 chars]

Remediation

View remediation

Remediation Suggestions

1. Establish one canonical npm package name and use it consistently in package.json, README.md, and SKILL.md.

2. Verify ownership of the canonical npm scope and enable multi-factor authentication and provenance-backed publishing for maintainers.

3. Pin the documented package to a reviewed immutable version, for example:

   json

   {
     "command": "npx",
     "args": ["-y", "@vbotholemu/mcp-company-search@1.0.0"]
   }
   

4. Prefer a controlled installation step using a lockfile and integrity-verified artifacts rather than downloading executable code automatically whenever the MCP server starts.

5. Publish checksums, npm provenance attestations, or signed release metadata so users can verify that the installed artifact corresponds to the reviewed source.

6. Add CI checks that reject inconsistent package names across documentation and metadata.

7. Review package lifecycle scripts and transitive dependencies before each release, and use exact or tightly controlled dependency versions where practical.

8. Run the MCP server under a restricted account or sandbox with minimal filesystem access, a filtered environment, and limited outbound network permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a concrete business-search capability using an external API, but the provided code chunk is effectively empty and does not implement any of that behavior. Because the actual code shows no relevant functionality at all, the description does not accurately represent the supplied code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README states that the tool searches corporate registries via the L402 API and mentions pricing later, but it does not clearly warn users up front that their search terms will be transmitted to a third-party service and may trigger metered charges. In a due-diligence/compliance context, company names and search targets can be sensitive business intelligence, so lack of explicit disclosure can lead to unintended data exposure and unexpected billing.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares environment and network capabilities but does not constrain tool scope with explicit permissions or allowed-tools. This weakens least-privilege controls and can let the skill invoke broader functionality than users expect, especially when combined with an externally fetched MCP package.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill runs an npm package through npx without pinning an exact immutable version, which creates a supply-chain risk. A later package update, account compromise, or dependency hijack could cause arbitrary code to be executed on the user's machine when the skill is installed or run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code makes HTTP requests to an external API and includes user-supplied company search parameters in those requests. While this is central to the tool's purpose, there is no confirmation prompt or explicit user-facing disclosure in the code path that search terms are sent to a remote service.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency uses a caret range instead of an exact pinned version, which allows different installs over time to resolve to newer releases. This weakens build reproducibility and can unintentionally pull in a vulnerable or breaking version through the normal package resolution process.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json

"author": "Blue-Trianon-Ventures",
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "zod": "^3.23.0"
  },
  "devDependencies": {

Unverifiable Dependency: @modelcontextprotocol/sdk has 3 known advisory(ies) (CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport); CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The manifest allows a floating @modelcontextprotocol/sdk version while known advisories exist for some releases, so consumers may install an affected version without realizing it. This is more concerning here because the skill is an MCP-integrated networked tool, making SDK flaws such as cross-client data leakage, ReDoS, or missing DNS rebinding protections more relevant to real deployment risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using a non-exact semver range for zod means installs are not fully reproducible and may fetch newer versions than originally tested. In supply-chain terms, that increases exposure to accidental vulnerable upgrades or malicious package compromise within the allowed range.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "zod": "^3.23.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",

Unverifiable Dependency: zod has 1 known advisory(ies) (CVE-2023-4316 (Zod denial of service vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

Because zod is not pinned, installations may resolve to a version affected by the known Zod DoS advisory. If schema validation is performed on attacker-controlled input, a vulnerable parser could be abused for resource exhaustion, though the manifest alone does not prove exploitability.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 30)May include surrounding context.

json

"zod": "^3.23.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json

},
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}