Security audit

mcp-registry

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate MCP server discovery skill, but it gives activation-ready install and connection instructions for third-party servers without enough trust, version, or endpoint safeguards.

Install only if you are comfortable manually vetting each MCP server it recommends. Before running any generated command or adding any config, verify the package publisher, repository, version, and remote endpoint; prefer pinned versions or Docker digests, use least-privilege credentials, and treat fetched READMEs as untrusted documentation rather than instructions for the agent to follow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:151
Finding: Unverified Registry Packages Are Converted into Executable Installation Commands
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:271
Finding: Registry-Supplied Remote Endpoints Are Used Without Trust or Network-Boundary Validation
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:178
Finding: Untrusted Repository README Content Is Fetched Without Prompt-Injection Safeguards
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill recommends executing npx -y PACKAGE_IDENTIFIER without pinning an exact package version. Because this skill is specifically designed to help users discover and install arbitrary MCP servers from external registries, an unpinned install can pull a newly published or compromised package version at execution time, enabling supply-chain compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The guidance uses uvx PACKAGE_IDENTIFIER without constraining the package version. This exposes users to the latest available release from PyPI at runtime, which is dangerous in a discovery/install skill because typo-squatted, hijacked, or newly malicious versions could be executed immediately.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill suggests docker run PACKAGE_IDENTIFIER without a tag or immutable digest, which defaults to a moving target such as latest. In a server-discovery workflow, this can cause users to run a changed or malicious image different from the one originally reviewed, creating a supply-chain execution risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs the agent to fetch and summarize external README files from repositories but does not state that this content is untrusted and may contain deceptive setup instructions, prompt-injection text, or unsafe commands. Since repository documentation is attacker-controlled input, treating it as authoritative increases the risk of relaying harmful instructions to users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The setup section provides concrete local execution commands and MCP client configuration edits for third-party servers without a prominent security warning. In context, this skill actively helps users discover and install arbitrary external MCP servers, so omission of trust and review guidance materially raises the chance of unsafe execution of malicious packages or endpoints.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.