XferOps Forge

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:14 AM UTC
• Version: 1.0.5

Overview

The skill is a coherent Forge MCP guide, but it runs an unpinned npm MCP server with a Forge token and includes broad board-admin actions, so users should review it before installing.

Before installing, pin `@xferops/forge-mcp` to a reviewed version, use a least-privilege Forge token, and treat the board-admin skill as high-impact because it can delete projects or columns and add team members.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: forge-setup/SKILL.md:12

Finding

Unpinned npm Package Execution

Content

View full analysis

Vulnerability Details

File Location: forge-setup/SKILL.md, lines 12–14 and 23–25
Vulnerability Type: Supply-chain exposure through an unpinned npm dependency
Risk Level: Medium

Vulnerable Code

Installation command at lines 12–14:

bash

npx -y @xferops/forge-mcp

MCP client configuration at lines 23–25:

json

"command": "npx",
"args": ["-y", "@xferops/forge-mcp"],
"env": {

Technical Analysis

The installation instructions and persistent MCP configuration execute @xferops/forge-mcp without specifying an exact package version or integrity constraint. Consequently, npx resolves a mutable package release from the npm registry. The -y option suppresses the installation confirmation.

No evidence indicates that the named package or publisher is currently malicious. However, this configuration creates a supply-chain trust boundary in which the code executed during setup or MCP startup can change after the skill has been reviewed. A compromised npm publisher account, registry namespace, or future package release could introduce arbitrary code that would execute under the MCP client user's account.

The configured process also receives FORGE_TOKEN in its environment. Therefore, a malicious package version could read and disclose that credential in addition to performing other actions available to the local user.

Attack Path

1. An attacker compromises the npm publisher account, package publication process, or another relevant supply-chain component for @xferops/forge-mcp.
2. The attacker publishes a malicious version that becomes the version resolved by the unpinned package specification.
3. A user runs the documented npx -y @xferops/forge-mcp command, or the MCP client starts the configured command.
4. npx retrieves and executes the malicious release without an interactive confirmation.
5. The malicious package runs with the MCP client user's permissions.
6. It can read process environment variables, including ...[truncated 827 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to an exact, reviewed version in both locations:

   bash

   npx -y @xferops/forge-mcp@1.2.3
   

   json

   "command": "npx",
   "args": ["-y", "@xferops/forge-mcp@1.2.3"]
   

2. Prefer installing the package through a committed lockfile and invoking the verified local binary rather than retrieving a mutable registry version during every startup.

3. Verify package integrity using npm lockfile integrity metadata and enforce package provenance or trusted-publisher controls in CI and deployment workflows.

4. Review and test new versions before updating the pin. Use an automated dependency-update process that requires security review and approval.

5. Restrict the Forge token to the minimum API permissions required by the MCP server, rotate it if package compromise is suspected, and avoid exposing unrelated secrets to the MCP process.

6. Where operationally feasible, run the MCP server in a sandbox or isolated account with limited filesystem, network, and environment-variable access.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill instructs users to run an unpinned package directly via npx, which fetches and executes the latest published version at runtime. If the package is updated maliciously, compromised in the supply chain, or changed incompatibly, the agent environment could execute attacker-controlled code during setup or later MCP server launches.

Content

No source excerpt is available for this finding.