Full Potential Intelligence

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:45 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent remote MCP integration, but its setup automatically runs an unpinned npm package and its external data-sharing behavior is under-disclosed.

Review this skill before installing. Use it only if you are comfortable sending queries and submitted reports to fullpotential.ai, avoid entering secrets or confidential material, and prefer a pinned, audited `mcp-remote` version run in a constrained environment with minimal exposed credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–23
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

json

{
  "mcpServers": {
    "full-potential-intelligence": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://fullpotential.ai/mcp", "--transport", "sse-only"]
    }
  }
}

Technical Analysis

The documented MCP configuration invokes npx with -y and identifies mcp-remote without an exact version or integrity constraint. Consequently, npx can automatically retrieve and execute whichever package version the npm registry resolves at invocation time, without requesting confirmation.

The effective executable can therefore change after the Skill has been reviewed. A compromise of the package publisher account, npm package, or transitive dependency chain could cause users following this configuration to execute attacker-controlled code. The audit found no evidence that the current package is malicious; the vulnerability is the unsafe, mutable dependency-execution mechanism.

Attack Path

1. An attacker compromises the mcp-remote package publisher, a relevant registry distribution path, or a dependency included by the package.
2. The attacker publishes a malicious version that is selected by npm when no version is specified.
3. A user installs or starts the MCP server using the configuration in SKILL.md.
4. npx -y retrieves the newly resolved package without interactive approval.
5. The downloaded package executes locally with the permissions and environment of the process launching the MCP server.
6. Malicious package code can access resources available to that user and process.

Impact Assessment

Successful exploitation permits arbitrary code execution under the account that launches npx. Depending on the host's configuration, accessible resources may include project files, user-readable files, environment variables, API credentials, a ...[truncated 343 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unversioned package reference with an exact, audited version, for example mcp-remote@X.Y.Z; do not use a range or floating tag.
2. Verify the selected package version, publisher provenance, release signatures where available, and expected registry integrity metadata before deployment.
3. Manage the MCP client as a locked project dependency using a committed lockfile rather than downloading a mutable package whenever the server starts.
4. Audit and lock transitive dependencies, and use automated dependency monitoring to detect compromised or vulnerable releases.
5. Avoid -y in interactive installation workflows so unexpected downloads are not silently approved.
6. Run the MCP client in a sandbox or container with a dedicated unprivileged identity, a minimal environment, read-only filesystem access where practical, and narrowly scoped outbound network access.
7. Do not expose unrelated API keys, tokens, or sensitive environment variables to the MCP process.
8. Review and deliberately approve package upgrades before changing the pinned version and lockfile.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to connect to a remote MCP server via npx mcp-remote https://fullpotential.ai/mcp but does not disclose that prompts, tool arguments, and potentially sensitive context will be transmitted to an external network service. This creates a real data exposure risk because users may invoke the skill assuming it is local or privacy-preserving when it is not.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The write-capable tools register_agent and contribute_intelligence are presented as normal features without warning that user-supplied content is submitted to an external service. That omission is dangerous because users may provide identifying, proprietary, or otherwise sensitive information without informed consent, especially since one tool explicitly submits field reports.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.