Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious because its setup instructions use an unpinned MCP package and its activation scope is broad; no malicious behavior was reported, but one reference could not be resolved.
Consider installing only if you trust the package source and are comfortable with the unpinned installation risk and broad activation scope. The scan did not report malicious behavior, but its evidence is incomplete because one referenced local path could not be resolved.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The documented MCP command uses npx -y constellate-mcp without an exact version, allowing package resolution to select an unreviewed release. A compromised publisher account or malicious release could execute code with the local tool process's permissions; automatic confirmation removes an installation checkpoint.
The alternative-client instructions repeat the same unpinned, automatically accepted package execution. This is another occurrence of the same supply-chain weakness, not a separate exploit mechanism, and it exposes other MCP clients to execution of an unreviewed release.
The unconditional activation language directs the agent to consult shared material for virtually every substantial task and error, without defining relevance, authorization, or trust boundaries. This unnecessarily broadens exposure to potentially adversarial retrieved instructions; signatures and reputation do not establish that content is safe to follow, although the stated local reads reduce direct query-disclosure concerns.
