Spine's Underground

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:51 AM UTC
• Version: 1.1.0

Overview

The skill is coherent, but it tells users to run a mutable third-party MCP package for crypto purchases without pinning the reviewed code.

Review this carefully before installing. Prefer a pinned, reviewed package version and run the MCP server with minimal filesystem, environment, network, and wallet access. For any purchase, independently confirm the chain, token, recipient, amount, and transaction details before signing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–20
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

json

"command": "npx",
"args": ["@underground-cultural-district/spines-underground"]

Technical Analysis

The documented MCP configuration invokes a third-party npm package through npx without specifying an exact version or integrity digest. As a result, the package version resolved at execution time may change after this Skill has been reviewed.

Because the project contains only documentation and does not include the package implementation, lockfile, or integrity metadata, the executable behavior of the MCP server cannot be verified from the audited artifact. A compromised publisher account, malicious package release, or compromised transitive dependency could introduce arbitrary executable behavior. This is particularly sensitive because the package advertises cryptocurrency purchase and payment-verification functionality.

Attack Path

1. An attacker compromises the npm publisher account, package distribution channel, or an applicable dependency.
2. The attacker publishes a malicious release under @underground-cultural-district/spines-underground.
3. A user applies the configuration documented in SKILL.md.
4. npx resolves and downloads the mutable package release because no exact version is pinned.
5. The malicious package executes with the permissions and environment available to the MCP process.
6. The package may access exposed environment variables or local resources, manipulate API interactions, or alter payment-related behavior, subject to the process's effective permissions.

Impact Assessment

Successful exploitation could permit arbitrary code execution within the security context of the user running the MCP server. The attainable scope depends on sandboxing and process permissions, but may include:

• Reading or modifying files accessible to the process.
• Accessing ...[truncated 502 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a reviewed, exact version rather than relying on an implicitly resolved release:

   json

   "command": "npx",
   "args": [
     "--yes",
     "@underground-cultural-district/spines-underground@X.Y.Z"
   ]
   

2. Use a package lockfile and verify npm integrity metadata. For stronger assurance, pin the artifact by a trusted digest in a controlled installation workflow.
3. Include or link to the exact reviewed source corresponding to the pinned release, enabling verification of payment handling, network requests, and data access.
4. Install dependencies in advance with a reproducible deployment process instead of downloading executable code when the MCP server starts.
5. Monitor the package and its transitive dependencies for ownership changes, compromised releases, known vulnerabilities, and unexpected installation scripts.
6. Run the MCP server in a sandbox with minimal filesystem, environment-variable, network, and wallet permissions.
7. Keep wallet signing isolated from the package. Require explicit user confirmation of the chain, token, recipient address, amount, and transaction data before signing any payment.
8. Permit outbound connections only to documented and validated endpoints where operationally feasible.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.