Security audit

MCP Colombia

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for a Colombia services MCP hub, but it asks users to run a mutable remote npm package and includes identity/reputation tracking with limited privacy controls described.

Review this before installing. Pin the npm package to a specific reviewed version, run it with least privilege, and only provide Soulprint or job-application data if you are comfortable with external validation, identity-linked reputation tracking, and possible sharing with job-search or application services.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:48
Finding: Unpinned Third-Party npm Package Execution
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:170
Finding: External Identity Disclosure and Automatic Reputation Tracking
Content: View full analysis
" } ``` ```text ### `soulprint_status` — Check identity & on-chain reputation Check if a user has a valid Soulprint identity. Queries the live validator node for on-chain data. Parameters: none (reads from x-soulprint-token capability) Returns: status — "active" | "no_token" | "invalid" did — decentralized identity score — trust score (0–100) node_info — live data from validator node node_reputation — on-chain reputation premium_access — which tools are unlocked Validator node: https://soulprint-node-production.up.railway.app ``` ```text Tools with score requirements: - Standard tools: score ≥ 0 (open access) - `trabajo_aplicar` (job applications): score ≥ **40** — requires basic identity verification ``` ```text Bot reputation is tracked automatically — good tool usage earns +1 attestations. ``` ### Technical Analysis The Skill instructs users to place a Soulprint identity token in MCP capabilities. The MCP server reads that token and queries an externally hosted validator node. The returned information includes a decentralized identifier, trust score, node information, and on-chain reputation. The documentation also states that reputation is tracked automatically and that successful tool use produces attestations. Persistent identity and reputation changes are materially different from transient product, travel, finance, or job searches. However, the Skill does not document explicit per-attestation consent, transmitted request fields, retention periods, log handling, token redaction, revocation procedures, or a mechanism to disable automatic tracking. Because the project contains no server implementati ...[truncated 1636 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The skill instructs users to run an unpinned package via npx -y mcp-colombia-hub, which always fetches the latest published version at execution time. If the npm package is compromised, typo-squatted, or a malicious update is pushed, users may execute attacker-controlled code immediately in their local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill describes passing an x-soulprint-token and querying a live validator node for identity and on-chain reputation, but does not clearly warn users that identity-linked data may be transmitted to a third-party service. Because this skill handles verification for sensitive operations and exposes DID, score, and node data, users may unknowingly disclose persistent identity information with privacy and profiling consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trabajo_aplicar feature accepts cv_url, salary expectations, message content, and returns verified candidate identity data, while directing users to external job portals. Without an explicit warning, users may provide sensitive employment and identity information that is then exposed to third-party search providers and application sites, creating privacy, profiling, and potential social-engineering risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.