Sonar ASO

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for Sonar ASO data, but it tells agents to run an unpinned npm MCP package that can execute changing third-party code.

Install only if you are comfortable using Sonar with a `SONAR_API_KEY`. Prefer direct API calls or a pinned, reviewed MCP server version, and run any MCP server with only the Sonar key in its environment, not unrelated credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:106

Finding

Unpinned Third-Party Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 106
Vulnerability Type: Unsafe execution of an unpinned npm dependency
Risk Level: Medium

Vulnerable Code

text

If the agent host supports MCP, the same tools are available natively: `npx -y @sonarapp/mcp` (stdio) or hosted at `https://trysonar.app/mcp` (streamable HTTP, `Authorization: Bearer aso_...`). Docs: https://trysonar.app/docs/mcp

Technical Analysis

The documented command uses npx -y to retrieve and execute @sonarapp/mcp without pinning an exact reviewed version or verifying package integrity. The -y option suppresses the interactive installation confirmation. Consequently, the code executed on a future invocation may differ from the code that existed when this Skill was audited.

An npm package can execute JavaScript through its command-line entry point and may also invoke installation lifecycle scripts. Such code runs with the privileges of the user or agent process. Unless the environment is explicitly sanitized, the process may inherit SONAR_API_KEY and other credentials or sensitive environment variables.

This is a supply-chain risk rather than evidence that the currently published package is malicious.

Attack Path

1. An attacker compromises the npm package, its publisher account, or another component of its publication channel.
2. The attacker publishes a malicious version of @sonarapp/mcp.
3. An agent or operator follows the Skill instruction and runs npx -y @sonarapp/mcp.
4. Because no exact version or integrity value is specified, npm resolves and downloads the attacker-controlled release.
5. npx executes the package without requesting confirmation.
6. The malicious package runs under the invoking account and can access inherited environment variables, local files permitted to that account, and available network resources.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the privileges of the user ...[truncated 462 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to an exact, reviewed version rather than resolving the latest available release:

   bash

   npx --yes @sonarapp/mcp@X.Y.Z
   

2. Use a committed lockfile and npm integrity metadata where the host integration permits a local installation.
3. Review the pinned package, its transitive dependencies, command-line entry point, and lifecycle scripts before approval.
4. Update dependencies through a controlled process that includes source review, automated vulnerability scanning, and integrity verification.
5. Run the MCP server in a sandbox or container with a read-only filesystem where feasible, restricted outbound networking, and no access to unrelated host resources.
6. Provide a minimal environment containing only the credential required for the operation; do not pass unrelated secrets to the child process.
7. Use a narrowly scoped API key, enforce usage limits where supported, monitor credit consumption, and rotate the key if package compromise is suspected.
8. Consider replacing on-demand package execution with a preinstalled, internally reviewed artifact from a trusted registry or repository.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description says to use the skill when asked about broad topics like "ASO," "competitor apps," or "app reviews analysis," without clear boundaries or exclusion conditions. These triggers are expansive enough to overlap with many general app marketing or product-analysis requests, which could cause the skill to activate outside a narrowly defined Sonar API use case.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to run an MCP server via npx -y @sonarapp/mcp without pinning an exact package version. This creates a supply-chain risk because the latest published package version will be fetched and executed at runtime, allowing a compromised or malicious update to execute code in the agent environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.