Scholar Sidekick (MCP)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent Scholar Sidekick MCP usage guide, with a disclosed supply-chain caution around an unpinned npx server command.

Before installing, connect this only if you intend to use Scholar Sidekick's external MCP/API service. Prefer a pinned package version such as `scholar-sidekick-mcp@<reviewed-version>`, keep the RAPIDAPI_KEY limited to this server, and run the MCP server in a least-privilege environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned Third-Party MCP Package Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:40
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code Snippet:

markdown

1. **The MCP server is connected.** These tools appear in your toolset only after the host connects the `scholar-sidekick-mcp` server — Claude Desktop: extension/connector settings; Claude Code: `.mcp.json` or `claude mcp add`; LobeHub: install the matching **MCP plugin**, not just this skill; raw MCP clients: `npx scholar-sidekick-mcp` as the server command.

Technical Analysis

The documented raw-client setup runs scholar-sidekick-mcp through npx without specifying an exact version or integrity value. Consequently, the package retrieved and executed can change after this skill has been reviewed. The repository contains no dependency lockfile or copy of the MCP server source through which the executed artifact could be verified.

This creates a supply-chain risk: if the package, its publishing account, or one of its transitive dependencies is compromised, a future invocation could execute attacker-controlled code. The risk is partially mitigated by the skill's explicit instruction not to install or launch the server silently; exploitation requires an operator to follow the documented external setup guidance.

Attack Path

1. An attacker compromises the npm package, its publisher account, or a dependency and publishes a malicious release.
2. An operator follows the documented setup command, npx scholar-sidekick-mcp, without an exact version.
3. npx resolves and executes the currently available package rather than a previously reviewed, immutable release.
4. The malicious package executes with the privileges of the user running the MCP host.
5. It may inspect data and credentials available to that process, including the configured RAPIDAPI_KEY, and may perform actions permitted by the host operating-system account.

...[truncated 488 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unversioned command with an exact, reviewed package version, such as npx scholar-sidekick-mcp@X.Y.Z.
2. Prefer a locked local installation with a committed lockfile so direct and transitive dependency versions remain reproducible.
3. Publish and verify package integrity hashes, provenance attestations, and release signatures where supported.
4. Review each version before upgrading, and use automated dependency and malware scanning in the release process.
5. Run the MCP server with least privilege in an isolated environment, exposing only the required API key, filesystem paths, and network destinations.
6. Document the server's required environment, filesystem, and network access so operators can apply appropriate sandboxing and secret-management controls.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill instructs users to run npx scholar-sidekick-mcp without pinning a specific package version. This creates a supply-chain risk because future package updates, dependency compromises, or a typo-squatted replacement could change what gets executed at install/runtime, reducing reproducibility and potentially enabling arbitrary code execution in the MCP host setup path.

Content

No source excerpt is available for this finding.