MCP Colombia

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:30 PM UTC
• Version: 1.0.9

Overview

This skill is mostly coherent for a Colombia services MCP hub, but it asks users to run a mutable remote npm package and includes identity/reputation tracking with limited privacy controls described.

Review this before installing. Pin the npm package to a specific reviewed version, run it with least privilege, and only provide Soulprint or job-application data if you are comfortable with external validation, identity-linked reputation tracking, and possible sharing with job-search or application services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:48
• Finding: Unpinned Third-Party npm Package Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 48–61 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```json { "mcpServers": { "colombia": { "command": "npx", "args": ["-y", "mcp-colombia-hub"] } } } ``` ```bash npx -y mcp-colombia-hub ``` ### Technical Analysis The documented installation and execution commands retrieve and run `mcp-colombia-hub` without specifying an exact package version or verifying an integrity hash. Although the document states that the expected version is `1.3.0`, neither execution command enforces that version. The `-y` option automatically accepts the package installation prompt. Consequently, invoking the command may download and execute whichever package version the npm registry resolves at that time. The effective executable payload can therefore change after this Skill has been reviewed. This creates a supply-chain trust boundary between the audited Skill documentation and the remotely distributed npm package. A malicious package release, compromised maintainer account, registry compromise, or unauthorized modification of a future release could introduce arbitrary executable code. ### Attack Path 1. An attacker compromises the npm publisher account, package release process, or another relevant supply-chain component. 2. The attacker publishes a malicious version of `mcp-colombia-hub`. 3. A user installs or starts the MCP server using `npx -y mcp-colombia-hub`. 4. npm resolves and downloads the attacker-controlled package because no exact version is pinned. 5. `npx` executes the package entry point without an interactive confirmation prompt. 6. The malicious package runs with the operating-system privileges and environment access of the MCP client or invoking user. ### Impact Assessment Successful exploitation can result in arbitrary local code execution under the account running `npx`. Depending on that account's permissions and ...[truncated 411 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the package to an exact, reviewed version in every documented command: ```json { "mcpServers": { "colombia": { "command": "npx", "args": ["mcp-colombia-hub@1.3.0"] } } } ``` ```bash npx mcp-colombia-hub@1.3.0 ``` 2. Remove `-y` where practical so installation does not silently proceed without user confirmation. 3. Prefer a committed lockfile and a controlled installation workflow over resolving dependencies dynamically during each launch. 4. Verify npm package integrity and provenance before execution, including package signatures or attestations where available. 5. Review the actual source and transitive dependency tree of the pinned release. The current project contains only documentation and therefore does not permit verification of the remotely executed implementation. 6. Run the MCP server in a sandbox or restricted account with minimal filesystem, environment-variable, credential, and network access. 7. Establish a deliberate update process in which each new version is reviewed before changing the pinned version. ]]>

other

Warning

• Location: SKILL.md:170
• Finding: External Identity Disclosure and Automatic Reputation Tracking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 170–218 **Vulnerability Type**: `other: External identity disclosure and reputation tracking` **Risk Level**: Medium ### Vulnerable Code ```typescript // In MCP capabilities (Claude Desktop) { "x-soulprint-token": "<your SPT token>" } ``` ```text ### `soulprint_status` — Check identity & on-chain reputation Check if a user has a valid Soulprint identity. Queries the live validator node for on-chain data. Parameters: none (reads from x-soulprint-token capability) Returns: status — "active" | "no_token" | "invalid" did — decentralized identity score — trust score (0–100) node_info — live data from validator node node_reputation — on-chain reputation premium_access — which tools are unlocked Validator node: https://soulprint-node-production.up.railway.app ``` ```text Tools with score requirements: - Standard tools: score ≥ 0 (open access) - `trabajo_aplicar` (job applications): score ≥ **40** — requires basic identity verification ``` ```text Bot reputation is tracked automatically — good tool usage earns +1 attestations. ``` ### Technical Analysis The Skill instructs users to place a Soulprint identity token in MCP capabilities. The MCP server reads that token and queries an externally hosted validator node. The returned information includes a decentralized identifier, trust score, node information, and on-chain reputation. The documentation also states that reputation is tracked automatically and that successful tool use produces attestations. Persistent identity and reputation changes are materially different from transient product, travel, finance, or job searches. However, the Skill does not document explicit per-attestation consent, transmitted request fields, retention periods, log handling, token redaction, revocation procedures, or a mechanism to disable automatic tracking. Because the project contains no server implementati ...[truncated 1636 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make Soulprint integration disabled by default and enable it only through explicit, informed user consent. 2. Restrict identity verification to operations that genuinely require it; do not process identity tokens for ordinary shopping, travel, or financial comparison tools. 3. Require separate, explicit consent before creating each persistent reputation attestation. 4. Provide a setting that completely disables reputation tracking without disabling unrelated MCP functionality. 5. Document exactly which fields are sent to the validator, which metadata is logged, the retention period, the legal processing basis, and whether attestations are stored on-chain. 6. Never log or expose the raw SPT token. Apply token redaction to application logs, diagnostics, errors, and telemetry. 7. Use narrowly scoped, short-lived tokens where the external identity system supports them. 8. Provide token revocation and credential-rotation instructions. 9. Minimize validator requests and avoid sending unrelated job-search, financial, travel, or product-query data. 10. Clearly distinguish read-only reputation checks from state-changing attestation operations in both documentation and user interfaces. 11. Publish or bundle the relevant server implementation so its token handling, outbound requests, logging behavior, and consent controls can be independently audited. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The skill instructs users to run an unpinned package via `npx -y mcp-colombia-hub`, which always fetches the latest published version at execution time. If the npm package is compromised, typo-squatted, or a malicious update is pushed, users may execute attacker-controlled code immediately in their local environment.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill describes passing an `x-soulprint-token` and querying a live validator node for identity and on-chain reputation, but does not clearly warn users that identity-linked data may be transmitted to a third-party service. Because this skill handles verification for sensitive operations and exposes DID, score, and node data, users may unknowingly disclose persistent identity information with privacy and profiling consequences.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The `trabajo_aplicar` feature accepts `cv_url`, salary expectations, message content, and returns verified candidate identity data, while directing users to external job portals. Without an explicit warning, users may provide sensitive employment and identity information that is then exposed to third-party search providers and application sites, creating privacy, profiling, and potential social-engineering risk.

Static analysis

No suspicious patterns detected.