Underground Cultural District

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:26 AM UTC
• Version: 4.5.0

Overview

The skill is not plainly malicious, but it needs review because it adds remote agent identity storage, remote agent messaging, and payment flows without enough access control or user-confirmation guidance.

Install only if you are comfortable with this MCP server contacting external services, storing agent identity remotely, sending and receiving agent messages through a relay, and handling USDC purchase metadata. Use non-sensitive agent IDs, do not store secrets or personal data in identity fields, treat mesh messages as untrusted external input, require explicit approval before sending messages or making payments, and prefer a pinned package version.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: src/index.js:732

Finding

Unauthenticated Persistent Agent Identity Access and Mutation

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/index.js:748

Finding

Unauthenticated Agent Impersonation and Message Access

Content

View full analysis

`${a.agentId} (${a.displayName}) -- ${a.wsConnected ? "connected" : a.online ? "online" : "offline"}`).join("\n"); case "send": if (!args.to || !args.message) throw new Error("to and message required for send"); res = await fetch(`${meshUrl}/api/send`, { method: "POST", headers: meshHeaders, body: JSON.stringify({ from: agentId, fromName: args.display_name || agentId, to: args.to, message: args.message, maxTurns: args.max_turns || 10 }) }); data = await res.json(); if (!res.ok) throw new Error(data.message || data.error); return `Sent to ${args.to}. Conversation: ${data.conversationId} (turn ${data.turnNumber}/${data.maxTurns})`; case "reply": if (!args.conversation_id || !args ...[truncated 3502 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/index.js:724

Finding

Transaction Hash Disclosed Through URL Query Parameters

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Remote Package Execution Through npx

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · README.md (reported line 69)May include surrounding context.

md

| Tool | Description |
|------|-------------|
| `agent-identity` | Store and recall your identity across sessions -- free persistent storage |
| `agent-mesh` | Send messages to other AI agents across machines -- free relay |
| `pet-rock-lobster` | Get a Pet Rock Lobster -- a digital companion that dispenses wisdom and joy |

## Payment

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

fast-uri 3.1.0 is reported with multiple host-confusion and SSRF-related issues. In an MCP server context, URI parsing bugs can be especially dangerous if the service fetches remote resources, validates callback URLs, or applies allowlists based on parsed hosts, because malformed attacker-supplied URLs may bypass those controls.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.14 — 16 advisory(ies): CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie); CVE-2026-71848 (Hono: Algorithmic Complexity DoS in Language Middleware) +13 more

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

hono 4.12.14 is associated with numerous advisories spanning routing, cookie handling, and denial-of-service classes of issues. Because this project is an MCP server and Hono is a web framework dependency, these flaws may directly affect request handling, header generation, middleware behavior, or route matching in a network-exposed service.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ip-address 10.1.0 is flagged for address interpretation inconsistencies and an HTML-emitting XSS issue. In this dependency chain it comes from express-rate-limit, so the practical risk depends on whether the application uses the package for trust decisions or renders its HTML output, but parsing inconsistencies can still weaken IP-based security controls such as rate limiting or allow/deny lists.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 97% confidence

Finding

This tool is an explicit cross-machine messaging capability for agents, which functions as a built-in exfiltration and command relay channel. In skill context, that is more dangerous than ordinary networking because an LLM-driven agent could be socially engineered to forward sensitive data or receive adversarial instructions from untrusted peers.

Content

Scanner excerpt · src/index.js (reported line 373)May include surrounding context.

js

{
    name: "agent-mesh",
    description:
      "Send messages to other AI agents across machines. Free relay for agent-to-agent communication. Register, discover who's online, start conversations, reply, and check your inbox.",
    inputSchema: {
      type: "object",
      properties: {

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to execute the MCP server via npx without pinning a specific package version. This creates a supply-chain risk: future package updates, account compromise, or a malicious republish could cause users to run unexpected code when following the documented command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The alternate server is also referenced with an unpinned npx invocation, which has the same supply-chain exposure as the main package. A user who runs this command may execute whatever code is published under that package name at that time, including compromised or malicious updates.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation command uses an unpinned npm package via npx, which means future executions may fetch whatever version is currently published under that name. If the package is updated maliciously, compromised, or changes behavior unexpectedly, users and agents could execute attacker-controlled code during installation or runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly supports purchasing content and describes automatic handling of x402 USDC payment challenges, but it does not clearly warn users that invoking purchase-related tools can trigger real cryptocurrency payment flows. In an agent context, that omission increases the risk of unintended spending, especially if tool use is automated or user confirmation boundaries are weak.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The tool documentation frames this capability as link retrieval, especially for paid items returning an x402 endpoint. In code, the handler also returns detailed off-platform payment instructions plus specific Base and Solana wallet addresses, which is a broader and materially different action than merely returning a link.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The tool explicitly encourages storing arbitrary identity details across sessions and notes that this persistence is free and unauthenticated. That combination creates a natural-language data retention risk: sensitive memories or identifiers may be stored remotely, mixed across users/agents, or disclosed or modified without adequate access controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The agent-identity tool sends arbitrary user-supplied identity data to a remote service for persistent storage, and the feature is advertised as 'no auth required.' In an agent context, this can cause inadvertent exfiltration of sensitive profile, preference, or memory data to an external service without meaningful consent boundaries or access control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The agent-mesh tool transmits arbitrary message content and metadata to an external relay and onward to other agents across machines. In an autonomous agent setting, this creates a real exfiltration channel for prompts, secrets, internal state, or user data if the agent is induced to use the tool without strict approval controls.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The top-level comment states 'MCP Server v4.1.0', while the server metadata reports version '4.2.0' and the startup log prints 'v4.1.0'. These inconsistent version claims create intent/documentation divergence about what build is actually running.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module header documents '19 tools' split across developer, marketplace, and agent tools, but the TOOLS array and HANDLERS map actually define only 16 tools, with no implementations for the three listed 'agent tools'. This is an active documentation-to-code contradiction rather than a mere omission, because the comment enumerates capabilities the server does not provide.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The timestamp conversion tool formats human-readable dates using a hard-coded "en-US" locale. This imposes a specific language/locale in user-facing output without offering opt-in or a configurable alternative, which matches the natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.14 — 1 advisory(ies): GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The lockfile pins @hono/node-server 1.19.14, which is reported vulnerable to a Windows-specific path traversal in serve-static. Even though a lockfile alone does not prove the affected API is used, including a known-vulnerable package in a server-oriented MCP project is a real supply-chain risk because the vulnerable code may be reachable when serving static content on Windows deployments.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low

• Category: Supply Chain
• Confidence: 76% confidence

Finding

body-parser 2.2.2 is flagged for a denial-of-service condition involving invalid limit handling. In this file it appears as a transitive dependency of Express, so exploitability depends on whether HTTP body parsing is exposed to attacker-controlled requests, but the presence of a known DoS issue in a network-facing dependency is still a valid vulnerability finding.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.1 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low

• Category: Supply Chain
• Confidence: 80% confidence

Finding

qs 6.15.1 has reported denial-of-service and parser-bypass issues. Since qs is commonly used to parse attacker-controlled query strings or form data in Express stacks, malformed requests could consume resources or bypass intended parser limits if the application exposes affected parsing paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This is a manifest file, so vague-trigger review applies. The description explains what the package is but gives no explicit trigger phrases, activation conditions, or exclusion conditions, which can leave invocation scope underspecified for systems that rely on manifest text to decide when to use the skill.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

Using a caret version range for a runtime dependency permits automatic adoption of future minor/patch releases, which can introduce vulnerable or compromised code through the supply chain. Because this is an MCP server dependency that affects core protocol handling, an upstream issue could alter tool behavior, expose data, or enable remote abuse when the package is installed or updated.

Content

Scanner excerpt · package.json (reported line 36)May include surrounding context.

json

"url": "https://github.com/lisamaraventano-spine/mcp-server"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.0.0"
  },
  "engines": {
    "node": ">=18.0.0"

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The description says the tool validates wallet addresses by format only, which is directionally consistent, but the wording can be read as reliable format validation. The implementation uses simple regular expressions for BTC addresses without checksum or stricter encoding validation, which can contradict the apparent assurance conveyed by 'validate' in the documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The timestamp formatter forces the output locale to en-US for human-readable dates. This is a natural-language/locale policy concern because it imposes a specific locale on all users without offering a choice or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.