KaspaCom LFG MCP

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:49 AM UTC
• Version: 0.1.0

Overview

This skill is coherent for KaspaCom launchpad access, but it gives agents direct financial trading examples and a global package install without enough safety scoping.

Review this before installing if you will connect a wallet or let an agent run commands. Prefer read-only launch discovery, pin and verify the npm package version, avoid elevated/global installs where possible, and require explicit confirmation before any buy or sell command is run.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–13
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet

markdown

## Install
```bash
npm i -g @kaspacom/defi-mcp

text

### Technical Analysis

The installation instruction retrieves the current release of `@kaspacom/defi-mcp` without specifying an exact version, lockfile, integrity hash, or other provenance verification. Consequently, the installed code can change after the Skill has been reviewed.

npm packages may define lifecycle scripts that execute during installation. If the package, publisher account, or release pipeline is compromised, following this instruction could execute attacker-controlled code with the privileges of the user running npm. The global installation option (`-g`) also exposes the installed executable system-wide for that user's environment and may overwrite or take precedence over an existing command with the same name.

The audit found no evidence that the named package is currently malicious. The vulnerability is the mutable, unverified dependency installation process and its resulting supply-chain exposure.

### Attack Path

1. An attacker compromises the npm publisher account, package release pipeline, or another component involved in distributing `@kaspacom/defi-mcp`.
2. The attacker publishes a modified release containing a malicious npm lifecycle script or CLI implementation.
3. A user follows the documented `npm i -g @kaspacom/defi-mcp` instruction.
4. npm resolves the mutable current release because no exact version or integrity value is specified.
5. Malicious lifecycle code can execute during installation, or malicious behavior can execute when the globally installed CLI is later invoked.
6. The payload operates with the installing user's privileges and can access resources available to that account.

### Impact Assessment

Successful exploitation could permit 
...[truncated 640 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to an exact reviewed version, for example @kaspacom/defi-mcp@X.Y.Z, rather than resolving a mutable latest release.
• Publish the expected package provenance, official registry location, source repository, and integrity digest so users can verify the artifact before installation.
• Prefer a project-local installation governed by a committed lockfile instead of global installation.
• Use npm provenance and signature verification where supported, and review package ownership and release history before upgrades.
• Evaluate installation with lifecycle scripts disabled, such as npm install --ignore-scripts, when package functionality permits it.
• Run the CLI as an unprivileged, isolated account or inside a constrained container, with no unnecessary access to wallets, secrets, or sensitive files.
• Establish a controlled update process in which each new dependency release is reviewed before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description contains broad trigger conditions such as launch lookups, token buys/sells, bonding curve activity, and general AI-agent access to KaspaCom LFG. This can cause the skill to activate for loosely related requests and route an agent toward financial operations without clear user intent boundaries, increasing the chance of unintended high-risk actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill includes direct buy and sell command examples for launch tokens but provides no warning that these commands can move real assets, incur irreversible losses, or interact with highly risky launchpad tokens. In an agent-assistance context, executable-looking transaction examples without cautions or confirmation requirements materially increase the risk of accidental or unsafe financial transactions.

Content

No source excerpt is available for this finding.