Humanpages

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:36 AM UTC
• Version: 1.1.0

Overview

The skill is coherent for hiring people, but it runs an unpinned external MCP package and handles sensitive profile and payment workflows without clear confirmation guardrails.

Review this skill before installing. Use a pinned, reviewed version of the Human Pages MCP server, run it with only the needed environment variables, and require clear user approval before fetching full profiles, creating job offers, sending or recording payments, starting streams, or leaving reviews.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: bin/start-mcp.sh:3

Finding

Unpinned npm Package Is Downloaded and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: bin/start-mcp.sh, line 3; also documented in SKILL.md, line 24
Vulnerability Type: Insecure third-party dependency execution
Risk Level: High

Vulnerable Code

bin/start-mcp.sh:1-3:

bash

#!/usr/bin/env bash
# Starts the Human Pages MCP server via npx
exec npx -y humanpages

Related setup instruction in SKILL.md:24:

text

mcporter config add humanpages --command "npx -y humanpages"

Technical Analysis

The skill invokes npx -y humanpages without specifying an exact package version or validating a cryptographic integrity hash. If the package is not already available in a suitable local cache, npx can retrieve it from the configured npm registry and immediately execute it. The -y option suppresses the installation confirmation.

As a result, the files reviewed in this project do not fully determine the code that runs. A future package release, compromised publisher account, malicious registry response, dependency compromise, or poisoned npm configuration could cause different code to execute without any modification to this repository.

This is primarily an insecure dependency and supply-chain issue. It also creates a remote payload retrieval and execution channel because mutable external code is fetched at invocation time.

Attack Path

1. An attacker compromises the humanpages npm publisher, its release process, a transitive dependency, or a registry/network path trusted by the local npm configuration.
2. The attacker publishes or serves a malicious version of the package.
3. A user invokes bin/start-mcp.sh or follows the command documented in SKILL.md.
4. npx -y humanpages obtains the remotely supplied package without asking the user to approve the installation.
5. npm lifecycle code or the package entry point executes with the privileges and environment of the invoking process.
6. The malicious code can access resources available to that process, potentially in ...[truncated 983 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the floating package reference with an exact, reviewed version, for example:

   bash

   exec npx -y --package humanpages@X.Y.Z humanpages
   

   Confirm the correct executable syntax for the selected package before deployment.

2. Prefer installing dependencies during a controlled build or deployment phase rather than downloading them when the skill is invoked.

3. Commit a lockfile generated by a supported package manager and enforce lockfile-only or frozen-lockfile installation.

4. Verify package provenance and integrity. Pin expected registry metadata and integrity hashes where the deployment system supports doing so.

5. Explicitly configure and validate the trusted npm registry. Do not inherit arbitrary user-controlled registry settings in security-sensitive deployments.

6. Audit the pinned package, its lifecycle scripts, and its complete transitive dependency graph before release. Use automated dependency and provenance checks in CI.

7. Run the MCP server in a restricted environment with:

   • Only the required environment variables.
   • Minimal filesystem access.
   • No unnecessary host credentials.
   • Restricted outbound network access.
   • A dedicated, unprivileged operating-system account or container.

8. Require deliberate review and version updates rather than automatically accepting the newest registry release.

9. Update both bin/start-mcp.sh and the setup command in SKILL.md so documentation cannot reintroduce the unsafe floating invocation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to install/run an MCP server via npx -y humanpages without pinning a specific package version or integrity. That creates a supply-chain risk: a newly published, compromised, or typosquatted package version could be executed automatically and would have access to the agent key and the ability to influence searches, hiring, and payment-related workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill guides the agent to retrieve full human profiles containing contact info, wallet addresses, fiat payment methods, and social links, and to initiate payment flows, but it does not require an explicit user confirmation or warning before these sensitive actions. In an agent context, this increases the chance of privacy exposure, mistaken disclosure, or unintended financial actions, especially because the skill is specifically designed for hiring real people and moving funds.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using exec npx -y humanpages without pinning an exact package version causes execution of whatever package version is currently resolved from the registry at runtime. This creates a supply-chain risk: a malicious or compromised upstream release, dependency hijack, or unexpected update could lead to arbitrary code execution when the skill starts.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.