Graph Aave MCP

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 4.2.1

Overview

This skill is a disclosed Aave data MCP server, with the main caveat that installation runs an unpinned third-party npm package outside the reviewed artifact.

Install only if you trust the npm package publisher and are comfortable giving the MCP server your Graph API key. Prefer pinning an exact reviewed version, avoiding global install where possible, and running it with only the environment variables and filesystem access it needs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unpinned Global Installation and Execution of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-28
Vulnerability Type: Unpinned third-party dependency installed globally and executed
Risk Level: Medium

bash

npm install -g graph-aave-mcp
graph-aave-mcp

Technical Analysis

The setup instructions install the latest available version of graph-aave-mcp from the npm registry into the global package scope and then execute it. The project does not specify an exact dependency version, provide a lockfile, require integrity verification, or include the package source for inspection.

Consequently, the code ultimately executed can differ from the code available when this skill was reviewed. npm installation may also execute package lifecycle scripts, while the installed server runs with the permissions of the invoking user. The required GRAPH_API_KEY is present in the server process environment and may be accessible to dependency runtime code.

The audit artifact contains only SKILL.md; therefore, the package implementation, lifecycle scripts, API-key handling, network behavior, local-resource access, and claimed durable findings store could not be verified.

Attack Path

1. An attacker compromises the npm publisher account, package, or one of its transitive dependencies, or publishes a malicious future release.
2. A user follows the documented npm install -g graph-aave-mcp instruction without selecting a previously reviewed version.
3. npm retrieves the attacker-controlled release and may execute its installation lifecycle scripts.
4. The user runs graph-aave-mcp, executing the package with the user's operating-system privileges.
5. Malicious code may read environment variables such as GRAPH_API_KEY, access files and network resources available to the user, or modify files in locations writable by that account.

Impact Assessment

Successful exploitation would provide code execution with the privileges of the user performing ...[truncated 624 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the command to an exact, reviewed package version rather than installing the latest release.
2. Avoid global installation. Declare the package in a local project manifest and commit the corresponding lockfile.
3. Verify the package archive using an expected integrity hash or a trusted signed-release mechanism before execution.
4. Review the selected release, its lifecycle scripts, and its complete transitive dependency tree.
5. Disable npm lifecycle scripts during installation where they are unnecessary, and explicitly review any scripts that must be enabled.
6. Run the MCP server under a dedicated, least-privileged account or sandbox with restricted filesystem and network access.
7. Expose only the required API key to the process and avoid inheriting unrelated credentials or sensitive environment variables.
8. Include the server source or a reproducible reference to the exact audited revision in the skill artifact.
9. Establish dependency monitoring and require a new security review before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.