mcp-llm-inference

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:37 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a remote LLM connector, but its installation and privacy/payment claims need review before use.

Review this before installing. Only use it if you are comfortable sending prompts and conversation history to the remote API, and do not send secrets, regulated data, proprietary context, or hidden system instructions. Prefer a pinned, verified package version with one consistent package name, a lockfile, and clear provider documentation for privacy, logging, retention, pricing, and L402 payment handling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25–26
Vulnerability Type: Supply-chain risk caused by automatic execution of an unpinned package
Risk Level: Medium

Vulnerable Code

json

"command": "npx",
"args": ["-y", "@vbotholemu/mcp-llm-inference"],

A related configuration in README.md, lines 22–23, references a different package identity:

json

"command": "npx",
"args": ["-y", "@blue-trianon/mcp-llm-inference"],

Technical Analysis

The documented configuration invokes npx with -y, which suppresses confirmation and downloads and executes the package selected by the registry. Because no exact package version is specified, later invocations can execute a release that was not part of this audit.

The package identity is also inconsistent: SKILL.md and package.json identify @vbotholemu/mcp-llm-inference, while README.md instructs users to execute @blue-trianon/mcp-llm-inference. This ambiguity increases the chance that users execute an unintended, unreviewed, abandoned, or compromised package.

The project's runtime dependencies also use caret ranges rather than exact versions, and no lockfile was present in the audited artifact. Those conditions further weaken build reproducibility, although the directly exploitable configuration is the unpinned npx -y invocation.

Attack Path

1. An attacker compromises the publisher account or registry package referenced by the configuration, or gains control of the conflicting package identity.
2. The attacker publishes a malicious release under that package name.
3. A user adds the documented MCP configuration or restarts an environment that resolves the package again.
4. npx -y retrieves the registry-selected release without an interactive confirmation.
5. Node.js executes the downloaded package with the privileges and environment of the MCP host process.
6. Malicious package code can then access resources ...[truncated 675 chars]

Remediation

View remediation

Remediation Suggestions

1. Use one verified package identity consistently across SKILL.md, README.md, and package.json.

2. Pin the exact audited release in all execution examples, for example:

   json

   "command": "npx",
   "args": ["-y", "@vbotholemu/mcp-llm-inference@1.0.0"]
   

3. Prefer installing from a lockfile and invoking the locally installed executable instead of downloading code when the MCP server starts.

4. Commit a package-manager lockfile and use reproducible installation commands such as npm ci.

5. Pin security-sensitive dependencies to reviewed versions and use automated dependency scanning and controlled update review.

6. Verify publisher ownership, package provenance, release signatures or attestations, and registry integrity before deployment.

7. Run the MCP server with least privilege, a restricted environment, limited filesystem access, and constrained outbound networking to reduce the impact of a supply-chain compromise.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims anonymity, micropayment handling, and no-KYC/API-key access, but the visible configuration only shows a plain client to a fixed remote API endpoint with no verifiable payment or privacy guarantees. This can mislead users into sending sensitive prompts under false assumptions about anonymity, trust boundaries, or payment flow.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

The skill claims anonymity, micropayment handling, and no-KYC/API-key access, but the visible configuration only shows a plain client to a fixed remote API endpoint with no verifiable payment or privacy guarantees. This can mislead users into sending sensitive prompts under false assumptions about anonymity, trust boundaries, or payment flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs users to send prompts and multi-turn chat history to a remote L402 API, but it does not clearly warn that potentially sensitive data will leave the local environment and be processed by a third party. In an agent context, prompts may contain secrets, proprietary data, or user conversations, so the lack of an explicit privacy/data-handling warning increases the risk of unintended disclosure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares network and environment-based capabilities via an MCP server configuration but does not explicitly scope or document permissions such as allowed tools or network expectations. This weakens reviewability and can cause agents or users to invoke a remote service without clear security boundaries, especially since prompts and context may be sent off-host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill runs an npm package through npx without pinning an exact version, which creates a supply-chain risk because future package updates could introduce malicious or vulnerable code at install/run time. Since this package is fetched dynamically and then given network capability, compromise could lead to data exfiltration or arbitrary behavior in the agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill encourages use for chat completion and text generation but does not warn that prompts, message history, and possibly sensitive agent context are transmitted to a remote third-party LLM service. This omission increases the risk of accidental disclosure of secrets, personal data, or proprietary information by users who may assume processing is local or privacy-preserving.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The chat tool forwards user-provided messages, including system, user, and assistant content, to a third-party remote API at BASE_URL. In an agent skill context, prompts and conversation history may contain sensitive data, and the code provides no built-in disclosure, consent mechanism, redaction, or policy gating before exfiltrating that data off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The generate tool sends arbitrary prompt text directly to a remote /api/v1/llm/generate endpoint, which creates a data-exfiltration path for anything passed by an agent or user. Because this skill is specifically designed to broker external LLM access anonymously, the surrounding context increases the likelihood that operators may use it without realizing prompts leave the local trust boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The chat tool sends user-supplied messages, including system and user content, to a remote third-party API without any built-in disclosure, consent, or guardrail indicating that sensitive prompts will leave the local agent environment. In an MCP skill context, agents may forward secrets, internal instructions, or personal data through this tool, creating a meaningful privacy and data-handling risk even though the network call is the intended feature.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generate tool transmits arbitrary prompt text to a remote API with no built-in warning that the input is being shared externally. Because this skill is specifically designed to provide anonymous third-party LLM access, users or calling agents may incorrectly assume local processing and unintentionally disclose confidential data, making the lack of disclosure more dangerous in context.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency uses a caret range instead of an exact pinned version, which makes builds non-reproducible and can silently pull in newly published releases. In a security-sensitive MCP skill that brokers LLM access and payments, this increases supply-chain risk because upstream package changes or compromised releases could alter runtime behavior without a manifest change.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json

"author": "Blue-Trianon-Ventures",
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "zod": "^3.23.0"
  },
  "devDependencies": {

Unverifiable Dependency: @modelcontextprotocol/sdk has 3 known advisory(ies) (CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport); CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The manifest leaves @modelcontextprotocol/sdk unpinned even though the package has multiple known advisories, so it is impossible to verify from this file whether installation will select a safe release. Because this skill is an MCP-integrated LLM inference tool, SDK flaws affecting cross-client isolation, DNS rebinding, or ReDoS could be especially relevant to network-exposed agent workflows.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The zod dependency is specified with a caret range, so installations may resolve to different versions over time. This weakens reproducibility and leaves the project exposed to accidental adoption of vulnerable or malicious upstream releases.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "zod": "^3.23.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",

Unverifiable Dependency: zod has 1 known advisory(ies) (CVE-2023-4316 (Zod denial of service vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The zod dependency is unpinned despite a known advisory history, so the manifest does not guarantee that installations avoid affected versions. If vulnerable versions are resolved, maliciously crafted input could trigger denial-of-service conditions in validation-heavy code paths.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 30)May include surrounding context.

json

"zod": "^3.23.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json

},
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}