Security audit

Refua

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Refua MCP setup guide with disclosed package installs and asset caching, though users should treat the unpinned dependencies and model downloads as supply-chain considerations.

Install and run this only in an isolated environment such as a virtualenv or container, preferably pin reviewed package versions, verify model asset sources where possible, and set cache directories deliberately if working in restricted or sensitive research environments.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:31
Finding: Unpinned Third-Party Python Dependencies Enable Supply-Chain Compromise
Content: View full analysis
Remediation: View remediation
refua-mcp== ``` 2. Generate and maintain a dependency lockfile that includes all transitive dependencies. 3. Require cryptographic hashes during installation, such as with a hash-pinned requirements file and: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Configure an explicit trusted package index or an internally controlled package mirror rather than relying on ambient `pip` configuration. 5. Verify the provenance, signatures, and checksums of downloaded model and molecular assets. 6. Perform installation and execution inside an isolated virtual environment or container under a dedicated, least-privileged account. 7. Prevent the MCP server process from accessing unrelated credentials, sensitive files, and unrestricted network destinations. 8. Establish a controlled dependency-update process that includes source review, vulnerability scanning, integrity verification, and functional testing before changing pinned versions. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Low

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The skill instructs operators to install the MCP server with an unpinned package version, which makes builds non-reproducible and can silently pull newer code than was originally reviewed. If the upstream package is compromised or introduces breaking or insecure behavior, users may install and run that code when starting the server.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The documentation states that Refua can automatically download model and molecule assets and describes default cache locations, but it does not clearly warn users that external assets will be fetched and stored on disk. This can create supply-chain, storage, and environment-management risk because operators may unknowingly allow network downloads and persistent writes in sensitive or restricted environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.