Graph Limitless MCP

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:17 AM UTC
• Version: 1.1.0

Overview

This skill is a coherent read-only Limitless analytics integration, with disclosed external API use and no artifact evidence of hidden storage, persistence, or destructive behavior.

Install only if you trust the npm package and the two disclosed endpoints. Prefer pinning the package version, use a narrowly scoped or revocable Graph API key, and disable the skill if you do not want your agent to run Limitless analytics queries automatically.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:68

Finding

Unpinned Third-Party Package Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 68
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

GRAPH_API_KEY=your-key npx graph-limitless-mcp

Technical Analysis

The documented installation command executes the third-party graph-limitless-mcp npm package through npx without specifying an exact version or verifying package integrity. If the package is not already available locally, npx may retrieve it from the configured npm registry and execute package lifecycle or runtime code immediately.

Because the dependency is unpinned, the code executed by users can differ from the version that was reviewed. A compromised npm publisher account, malicious future release, registry compromise, or package ownership transfer could therefore introduce arbitrary code without requiring any modification to this skill file.

The command also provides GRAPH_API_KEY to the child process. Any compromised package code would be able to read that credential from its environment.

Attack Path

1. An attacker compromises the npm package, its publisher account, or its distribution channel.
2. The attacker publishes a modified release under the existing graph-limitless-mcp package name.
3. A user follows the command in SKILL.md.
4. Because no exact version or integrity value is specified, npx resolves and downloads the attacker-controlled release.
5. Package lifecycle or application code executes locally with the invoking user's permissions.
6. The malicious code reads GRAPH_API_KEY from the environment and may access other resources available to the user.
7. The code may exfiltrate credentials or modify accessible files and data.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user running npx. The accessible scope may include the supplied Graph API key, other inherited environm ...[truncated 310 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to an exact reviewed version, for example npx graph-limitless-mcp@1.1.0, rather than relying on the registry-selected version.
• Prefer installation through a committed lockfile using a deterministic package-manager workflow such as npm ci.
• Verify package provenance and integrity before execution, including registry metadata, release signatures or attestations where available, and package integrity hashes.
• Disable or carefully review dependency lifecycle scripts where operationally possible.
• Run the package in a sandbox or container with minimal filesystem access and restricted network access.
• Supply only the required environment variable and avoid exposing unrelated credentials to the process.
• Use a narrowly scoped, revocable API key and rotate it if package compromise is suspected.
• Document the exact source revision corresponding to the pinned npm release so users can compare the distributed artifact with the public source.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The install command uses npx graph-limitless-mcp without pinning an exact package version, so users may execute whatever code is currently published under that package name at install/run time. In an agent skill context, this creates a supply-chain risk: a compromised maintainer account, malicious new release, or dependency hijack could cause arbitrary code execution on the local machine with access to environment variables such as GRAPH_API_KEY.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states it may be invoked autonomously whenever the agent detects a 'prediction market question about Limitless,' which is a broad trigger that can match routine conversation rather than an explicit user request to use external tools. This can cause unprompted transmission of user prompts or derived queries to external services (gateway.thegraph.com and api.limitless.exchange), expanding data exposure and increasing the chance of unnecessary tool execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.