AIGroup Finnhub MCP

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:18 AM UTC
• Version: 0.1.1

Overview

The skill’s Finnhub market-research purpose is coherent, but it needs review because it can route prompts to an external MCP server automatically and documents launching that server through an unpinned npm package.

Review the MCP package source and publisher before installing, prefer a pinned and audited package version, run the MCP server with minimal filesystem and environment access, and be aware that market-related prompts may invoke the external tool automatically.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/capabilities.md:35

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: references/capabilities.md, line 35
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

- Local launch pattern in this workspace: `npx aigroup-finnhub-mcp`

Technical Analysis

The documented launch command uses npx without an exact package version, lockfile, integrity hash, or trusted-registry restriction. If the package is not already installed locally, npx may retrieve the current version of aigroup-finnhub-mcp from the configured npm registry and execute it.

This creates a mutable supply-chain boundary: the code executed at runtime can differ from the code that existed when this Skill was audited. A compromised package release, publisher account, registry, or dependency could therefore introduce arbitrary executable behavior without requiring any modification to the reviewed project.

The external MCP implementation is not bundled in this repository, so its internal behavior could not be audited. In addition, agents/openai.yaml enables implicit invocation, which may increase how readily the external dependency is activated.

Attack Path

1. An attacker compromises the npm package, its publisher account, one of its transitive dependencies, or the registry resolution path.
2. The attacker publishes a malicious or backdoored release under the package name.
3. The workspace follows the documented npx aigroup-finnhub-mcp launch pattern.
4. npx resolves and downloads the mutable package version from the configured registry.
5. The malicious package executes in the local Agent environment through the MCP stdio transport.
6. The payload acts with the permissions and environmental access inherited from the process that launched it.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the Agent or user process launching npx. Depending on the runtime environment, this may expose acces ...[truncated 406 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP package to a specific, reviewed version rather than resolving the latest available release.
2. Install it during a controlled build or setup phase using a committed lockfile instead of downloading it during Skill invocation.
3. Enforce package integrity verification through lockfile integrity metadata or independently verified checksums.
4. Configure npm to use an approved registry and disable unexpected registry overrides.
5. Audit both the selected package release and its transitive dependencies before deployment.
6. Run the MCP process in a sandbox with minimal filesystem, environment-variable, credential, and network access.
7. Avoid passing unrelated secrets into the MCP process environment.
8. Consider setting allow_implicit_invocation to false unless automatic activation is operationally necessary.
9. Establish a controlled dependency-update process requiring security review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill enables implicit invocation, allowing the agent to call the MCP server without an explicit user request, while the activation guidance is broad market-research language rather than a tightly constrained trigger. This increases the chance of unnecessary or unintended access to external market/news tooling, which can expose user context to the tool and create overreach in situations where the user did not clearly consent to tool use.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The capability document instructs launching the MCP server via npx aigroup-finnhub-mcp without pinning an exact package version. This allows whatever version is current in the registry at execution time to be fetched and run, creating a supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly. In the context of an agent skill, this is more dangerous because the command is presented as the standard local launch path and may be executed by users or automation with little scrutiny.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.