Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed MCP server for subgraph discovery with optional user-invoked Graph gateway queries, and I did not find evidence of hidden malicious behavior.
Install a pinned version, review dependency advisories before production use, and expose HTTP/SSE only on trusted networks. If you set THE_GRAPH_STUDIO_API_KEY or GATEWAY_API_KEY, reachable clients can invoke keyed query tools and spend that Graph gateway quota; leave the key unset for discovery-only public use.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
echo "GATEWAY_API_KEY=your-key-here" > .env
# Full crawl + classify (~11 min)
python registry.py
Referenced artifact was not completely inspected
This hash is hard-coded in `src/index.js` (`EXPECTED_DB_SHA256`). On every run,
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
// 1. Run the crawler to rebuild python/data/registry.db
// 2. shasum -a 256 python/data/registry.db
// 3. Paste the new hash here and bump package.json version
// 4. Update SKILL.md "Verifying the registry" section
const EXPECTED_DB_SHA256 =
"fbfd232e3148e56dbe817fc393230214ad73d6506d2e4af6394021fffd827e4c";
// Skip-verification escape hatch (set to "1" only if you're rebuilding the DB
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
EXPOSE 8080
HEALTHCHECK --interval=30s --timeout=5s --start-period=40s \
CMD node -e "fetch('http://127.0.0.1:'+(process.env.MCP_HTTP_PORT||8080)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
CMD ["node", "src/index.js", "--http-only"]
The README instructs users to run npx -y payql without pinning a version, which causes code to be fetched and executed from the registry at install time. If the package or a dependency is compromised, users and agents may execute attacker-controlled code unexpectedly.
The command npx subgraph-registry-mcp executes the latest published package version by default, creating a supply-chain risk. In an agent-oriented tool, this is more dangerous because automated environments may run the command non-interactively and trust README examples verbatim.
This unpinned npx subgraph-registry-mcp example has the same supply-chain exposure: users may execute whatever version is current in the package registry at the time of use. Because the project targets MCP/agent workflows, a compromised package could gain access to local files, environment variables, or connected tooling.
The README again promotes runtime execution of an unpinned npm package via npx, which is a classic package-substitution and compromised-release risk. The danger is elevated slightly by the server role: a malicious release could expose network services or exfiltrate registry/API credentials from the host.
This npx subgraph-registry-mcp --http-only example is another unpinned execution path that relies on the mutable latest package. In a security-sensitive context involving HTTP services and API keys, an attacker controlling a release could run arbitrary code on the host and interact with exposed endpoints.
The skill explicitly documents access to environment variables and network resources, but it does not declare any tool scope such as permissions or allowed-tools. In an agent runtime, this weakens policy enforcement and makes it easier for a consumer to invoke a skill with broader capabilities than expected, including outbound requests and access to API keys in the environment.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The package uses a caret range for @modelcontextprotocol/sdk, which allows installation of newer compatible releases that were not explicitly reviewed by the author. This creates a supply-chain risk and makes builds non-reproducible, especially relevant for an MCP server dependency that directly shapes tool transport and authentication behavior.
"author": "PaulieB14",
"license": "MIT",
"dependencies": {
"@modelcontextprotocol/sdk": "^1.29.0",
"@xenova/transformers": "^2.17.2",
"better-sqlite3": "^11.8.2",
"express": "^4.21.0"
The manifest does not pin @modelcontextprotocol/sdk, and known advisories exist for this package, so consumers cannot determine from the manifest whether installs are affected or patched. In an MCP server, SDK flaws can be more consequential because they may affect cross-client isolation, transport handling, or credential flows.
The @xenova/transformers dependency is specified with a caret range, so future installs may pull different code than was originally tested. For an AI-facing package that bundles model assets, this increases supply-chain exposure and reduces reproducibility.
"license": "MIT",
"dependencies": {
"@modelcontextprotocol/sdk": "^1.29.0",
"@xenova/transformers": "^2.17.2",
"better-sqlite3": "^11.8.2",
"express": "^4.21.0"
}
Using ^11.8.2 for better-sqlite3 permits automatic minor/patch upgrades, which can change native module behavior across environments. Because this package ships a local registry database, reproducible dependency resolution matters for integrity and stability.
"dependencies": {
"@modelcontextprotocol/sdk": "^1.29.0",
"@xenova/transformers": "^2.17.2",
"better-sqlite3": "^11.8.2",
"express": "^4.21.0"
}
}
The express dependency is not pinned to an exact version, so deployments may silently consume newer releases with different security characteristics. Since the package exposes HTTP modes, an unreviewed dependency update in the web stack can increase remote attack surface.
"@modelcontextprotocol/sdk": "^1.29.0",
"@xenova/transformers": "^2.17.2",
"better-sqlite3": "^11.8.2",
"express": "^4.21.0"
}
}
Express has known advisories, and because the manifest uses a range instead of an exact version, it is unclear whether deployed instances are vulnerable or patched. This matters more here because the package explicitly supports HTTP modes, making any web-framework weakness potentially reachable over the network.
Detected: suspicious.env_credential_access