mcp-marine-weather

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:29 AM UTC
• Version: 1.0.0

Overview

The skill appears to provide the promised NOAA marine-weather MCP tool, but its documented setup runs an unpinned third-party package through npx, so users should review the package source and version before installing.

Install only after pinning the npx command to a reviewed exact package version and confirming the package identity. The weather functionality itself is narrow and NOAA-focused, but the current setup gives the npm registry-selected package normal local code execution authority.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Package Download and Execution Through npx

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Yes, this is a mismatch. The declared description promises a functioning marine weather integration using NOAA's api.weather.gov, but the provided code chunk contains no such logic. It is essentially an empty declaration file and does not demonstrate any of the stated capabilities, resources, or behavior. Based on the supplied code alone, the actual behavior does not match the declared purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes an MCP server via npx, which inherently enables outbound network access and may expose environment data, yet the manifest declares no permissions or allowed-tools scope. This weakens least-privilege controls and makes it harder for operators or automated policy systems to understand and constrain what the skill can do at runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The setup uses npx -y @vbotholemu/mcp-marine-weather without pinning an exact package version. This creates a supply-chain risk because future package updates—or a compromised published version—could execute different code than the reviewed skill, including arbitrary malicious behavior at install/run time.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency uses a caret range (^1.12.1), which allows automatic installation of newer minor/patch releases. This weakens build reproducibility and can unexpectedly introduce vulnerable or malicious upstream changes through the supply chain, especially for a network-facing MCP SDK dependency.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json

"author": "velocibot",
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "zod": "^3.23.0"
  },
  "devDependencies": {

Unverifiable Dependency: @modelcontextprotocol/sdk has 3 known advisory(ies) (CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport); CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The manifest references @modelcontextprotocol/sdk with a non-exact version while known advisories exist for that package, so the actual installed version may be affected and cannot be verified from this file alone. In an MCP skill, the SDK is a core runtime component handling protocol and transport behavior, which makes known issues such as data leakage, ReDoS, or DNS rebinding more relevant than in a non-networked package.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The zod dependency is specified with a caret range, so different installs may resolve to different package versions over time. While common in JavaScript projects, this creates avoidable supply-chain and reproducibility risk if an upstream release introduces a security issue or regression.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.1",
    "zod": "^3.23.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",

Unverifiable Dependency: zod has 1 known advisory(ies) (CVE-2023-4316 (Zod denial of service vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

zod has a known DoS advisory, and because the manifest uses a version range instead of an exact version, it is not possible to confirm whether deployed installations are patched. Since this skill likely validates external NOAA-derived or user-supplied inputs, a vulnerable parser could make malformed input a denial-of-service vector, though the overall impact is limited by the simple weather-tool context.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 30)May include surrounding context.

json

"zod": "^3.23.0"
  },
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json

},
  "devDependencies": {
    "typescript": "^5.7.0",
    "@types/node": "^22.0.0"
  }
}