Bind Protocol MCP Server Use

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:21 PM UTC
• Version: 2.0.0

Overview

The skill is coherent for Bind Protocol workflows, but it asks users to run an unpinned external MCP package with a sensitive Bind agent key and mutation-capable tools.

Review before installing. Use a tightly scoped Bind agent key, avoid broad policy-authoring or sharing permissions unless needed, pin or locally vendor the MCP package before use, and rotate the key if you later suspect package compromise. The artifact itself does not show malicious behavior, but the mutable install path deserves caution.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party MCP Package Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15-18 and SKILL.md:64-69
Vulnerability Type: Unpinned npm dependency executed through npx
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: node
    package: "@bind-protocol/mcp-server"
    bins: []

json

{
  "mcpServers": {
    "bind": {
      "command": "npx",
      "args": ["@bind-protocol/mcp-server"],
      "env": {
        "BIND_API_KEY": "${BIND_API_KEY}"
      }
    }
  }
}

Technical Analysis

The Skill directs users to install and execute @bind-protocol/mcp-server without specifying an exact version or package integrity value. Consequently, npx may retrieve and run a package release that differs from the version originally reviewed.

The package implementation is not included in the audited project, so its behavior cannot be independently verified from this artifact. Because the process is explicitly given BIND_API_KEY, a malicious or compromised future package release could read that credential. Code executed by npx would also inherit the operating-system privileges and environmental access of the user running the MCP client.

This is an unsafe supply-chain configuration rather than evidence that the current upstream package is malicious.

Attack Path

1. An attacker compromises the upstream npm package, its publisher account, or its release pipeline.
2. The attacker publishes a malicious version of @bind-protocol/mcp-server.
3. A user starts the MCP server using the documented unversioned npx command.
4. npx resolves, downloads, and executes the malicious release.
5. The package reads the supplied BIND_API_KEY or accesses other resources available to the current user.
6. The payload may exfiltrate credentials, manipulate API requests, or execute additional commands under the user's account.

Impact Assessment

Successful exploitation could expose the Bind agent API key and allow operations authorized by that key, including acce ...[truncated 451 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version in both the installation metadata and MCP configuration, for example:

   yaml

   package: "@bind-protocol/mcp-server@2.0.0"
   

   json

   "args": ["@bind-protocol/mcp-server@2.0.0"]
   

2. Use a committed lockfile and deterministic installation process where the hosting platform supports them.

3. Verify package integrity with npm integrity metadata or a trusted artifact digest.

4. Review package source and release provenance before each upgrade rather than automatically accepting new releases.

5. Run the MCP server in a sandbox with restricted filesystem and network access.

6. Scope BIND_API_KEY to only the tools required for the intended workflow, apply low rate limits, and rotate the key if dependency compromise is suspected.

7. Restrict BIND_API_URL to an approved HTTPS endpoint to prevent sensitive API traffic from being redirected to an untrusted server.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill installs and runs the MCP server via npx using an unpinned package reference (@bind-protocol/mcp-server) rather than a fixed version. This creates a supply-chain risk: a future malicious or compromised package release could be fetched and executed automatically in the user's environment, especially since the tool is configured to receive BIND_API_KEY in its environment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

| Tool | What it does |
|------|-------------|
| `bind_parse_credential` | Decode a VC-JWT into header + payload + signature without verification |
| `bind_verify_credential` | Full verification: parse, fetch issuer JWKS, verify ES256 signature, check expiration. Does NOT check revocation. |
| `bind_hash_credential` | SHA-256 hash a VC-JWT. Use the hash with `bind_check_revocation`. |

Static analysis

No suspicious patterns detected.