Mobb Vulnerabilities Fixer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:09 AM UTC
• Version: 0.1.2

Overview

This skill is purpose-aligned for Mobb vulnerability scanning, but users should review it because scans can upload repository code and monitoring may apply fixes automatically when auto-fix is enabled.

Install only if you are comfortable sending selected repository files to Mobb for analysis and with the MCP service's configured auto-fix behavior. Before use, confirm what files will be scanned, remove secrets or regulated data, prefer cached or summary-only workflows when possible, and keep auto-fix disabled unless you explicitly want unattended code changes.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:24

Finding

Repository Source Code May Be Uploaded Without Explicit Informed Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:24-38; supporting behavior documented in references/mcp-scan-fix.md:32-36
Vulnerability Type: Unconsented Source Code Disclosure
Risk Level: Medium

Vulnerable Code Snippet

SKILL.md:24-38:

markdown

4. Execute MCP scan-and-fix.
Invoke the MCP tool `scan_and_fix_vulnerabilities` with the repository path. Use optional parameters only when the user explicitly asks.

Required parameter:
- `path`: absolute path to the repository root

Optional parameters:
- `offset`: pagination offset for additional fixes
- `limit`: maximum number of fixes to return (default is 3)
- `maxFiles`: scan up to N recently changed files (default is 10); setting this triggers a fresh scan
- `rescan`: force a full rescan; only when user explicitly asks
- `scanRecentlyChangedFiles`: when true and no git changes are found, scan recently changed files from history

5. Apply returned fixes only with explicit user consent.
If the tool returns patches, summarize what will change and ask the user to confirm before applying.

references/mcp-scan-fix.md:32-36:

markdown

### Rescan and Caching

- The service caches a fix report ID for ~2 hours.
- If a valid cached report exists and `rescan` is false, fetch fixes without rescanning.
- `rescan: true` forces a new scan and upload.
- Supplying `maxFiles` also forces a new scan.

Technical Analysis

The default workflow directs the agent to invoke an external Mobb MCP scanning service against a local repository. The reference documentation confirms that a fresh scan includes an upload. Depending on repository state and supplied options, selected changed or recently modified files can therefore leave the local environment.

The instructions require explicit consent before applying generated patches, but they do not require equivalent informed consent before uploading source files. They also do not require the ...[truncated 1555 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a mandatory consent checkpoint before any operation capable of starting a fresh scan or uploading files.
2. Clearly state that Mobb is an external processor and that selected repository files may be transmitted to it.
3. Enumerate the files selected for upload and obtain approval for that exact file set.
4. Explain whether cached results can be used without another upload and distinguish cached retrieval from a fresh scan.
5. Warn users to remove or redact credentials, personal information, regulated records, and other sensitive content before approval.
6. Require renewed consent whenever rescan, maxFiles, scanRecentlyChangedFiles, or repository-state changes expand or alter the upload set.
7. Preserve the existing, separate consent requirement before applying patches.
8. Where supported, document data retention, tenant endpoint configuration, transport protections, and an approved local-only alternative for repositories that cannot be externally processed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mobb-auth.md (reported line 6)May include surrounding context.

md

## API Key Basics

- A Mobb account is required to authenticate and generate API keys.
- Create an API key in the Mobb web app: Settings → Access Tokens → Add API Key. Copy it immediately; it is shown only once.
- The user should configure authentication on their machine (for example, by setting `API_KEY` before launching MCP). Do not read or request environment variables directly.
- If authentication is missing or invalid, MCP triggers a browser-based login flow to authorize access.
- Optional: set `API_URL` and `WEB_APP_URL` for non-default tenant endpoints.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The monitoring workflow explicitly states that fixes may be applied automatically, but this safety-critical behavior is only disclosed deep in the workflow section rather than clearly upfront in the skill description or with a mandatory consent gate. In a code-modifying security tool, automatic patch application can cause unintended repository changes, break builds, or alter sensitive code paths without sufficiently informed user approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill documentation states that scans may upload repository contents and that fixes may be applied automatically, but it does not require an explicit user warning or consent step before those actions occur. In a security-focused skill operating on local code, silent transmission of source code and unattended modification of files can expose sensitive data and cause unintended repository changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.