CMDB Compass

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:12 PM UTC
• Version: 1.0.6

Overview

This skill is purpose-aligned for ServiceNow CMDB governance, but it installs an unaudited moving PyPI package that will receive ServiceNow credentials and can perform high-impact CMDB writes.

Review the PyPI package and its dependencies before installing, prefer a pinned and hash-verified version, and use a dedicated least-privilege ServiceNow account. Treat write operations as production changes: require dry runs, explicit human approval, change control, and tested rollback before allowing an agent to merge, retire, bulk update, or repair CMDB records.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/install-mcp.sh:32

Finding

Unpinned Third-Party Package Is Downloaded and Installed from PyPI

Content

View full analysis

Vulnerability Details

File Location: scripts/install-mcp.sh, lines 32–34
Vulnerability Type: Supply-chain risk caused by an unpinned external dependency
Risk Level: Medium

bash

# Install from PyPI
echo "Running: pip install cmdb-compass"
$PYTHON -m pip install --upgrade cmdb-compass

Technical Analysis

The installation script downloads and installs the latest available cmdb-compass package from PyPI without pinning an audited version or verifying an integrity hash. The --upgrade option further ensures that installation may select a newer release whose contents differ from the version originally reviewed.

The downloaded package is not included in this project artifact. Consequently, its package installation hooks, transitive dependencies, runtime network behavior, credential handling, and ServiceNow operations cannot be verified through this audit. Python packages and their dependencies may execute code during installation or when the installed MCP module is launched.

This is a supply-chain exposure rather than evidence that the current PyPI package is malicious. Exploitation would require compromise of the package, its maintainer account, the package distribution channel, or one of its unresolved dependencies.

Attack Path

1. A threat actor compromises the cmdb-compass PyPI project, a maintainer account, the distribution path, or a dependency selected during installation.
2. The actor publishes a malicious or modified package release.
3. Skill installation invokes scripts/install-mcp.sh through the executable installation declaration in SKILL.md.
4. The command pip install --upgrade cmdb-compass retrieves the current package release and dependencies without a version lock or hash validation.
5. Malicious code executes during package installation or later when the MCP client starts python -m servicenow_mcp.server.
6. At runtime, the server is configured to receive SERVICENOW_INSTANCE_URL, SERVICENOW_USERNAME ...[truncated 922 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin cmdb-compass to a specific, audited version instead of selecting the latest release:

   bash

   "$PYTHON" -m pip install "cmdb-compass==<audited-version>"
   

2. Use a lock file containing hashes for the package and every transitive dependency, then require hash verification:

   bash

   "$PYTHON" -m pip install --require-hashes -r requirements.lock
   

3. Remove --upgrade so repeated installations cannot silently replace the reviewed version with a newer release.
4. Build and publish reproducible artifacts, document their expected SHA-256 hashes, and verify signatures or attestations before installation.
5. Prefer including the auditable MCP server source in the reviewed project or installing from a cryptographically pinned source revision.
6. Run the MCP server in an isolated virtual environment or container under a dedicated, unprivileged operating-system account.
7. Provision a dedicated ServiceNow account with only the minimum roles and table permissions needed for the intended CMDB operations.
8. Review and lock transitive dependencies, monitor package ownership and release changes, and repeat the security audit before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents a fully functional CMDB governance skill with substantive ServiceNow CMDB capabilities. However, the supplied code chunk does not implement any of those behaviors; it only installs a Python package and provides local configuration instructions for connecting to ServiceNow. This is a materially different primary purpose for the code shown. While an install script can be a supporting component of such a skill, this chunk alone does not accurately represent the declared operational functionality, so the description does not match the actual behavior of the supplied code.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description says the skill can 'Audit, remediate, and govern your CMDB from any AI agent,' but it does not define specific trigger phrases, invocation boundaries, or exclusion conditions. In a manifest/markdown context, this broad natural-language description can contribute to unintended invocation because it lacks clear scope constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation advertises destructive CMDB write operations such as merging duplicates, retiring stale CIs, bulk field updates, and relationship healing without an explicit warning about operational risk, approval requirements, or failure modes. In an agent-driven environment, this can normalize high-impact actions and increase the chance that users or agents perform production changes without understanding blast radius, despite the mention of rollback and audit trail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.