T08 · Insecure Dependencies
Error
- Location
SKILL.md:20- Finding
External Executable Installed Without Enforced Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Mcpsec
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed MCP configuration scanner, but its binary install path can install an external executable without enforced checksum validation before that executable reads sensitive MCP configs.
Review carefully before installing. Avoid the automated binary install command as written; verify the release archive against a pinned checksum with sha256sum -c before extracting, or build from audited source. Prefer a user-local install path over /usr/local/bin, and run the scanner with least privilege or in an isolated environment because MCP configs may contain API keys and tokens.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (9)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The metadata says to verify the checksum before running, but the provided command only prints the archive hash with sha256sum and never compares it to a trusted pinned value. This can mislead users into believing integrity verification occurred, allowing a tampered or substituted binary to be extracted and installed.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 91% confidence
- Finding
The chained command downloads files, computes a hash without validating it, extracts an archive, and installs the resulting binary in one uninterrupted sequence. This is dangerous because users may execute the whole chain blindly, and any compromise in the fetched artifact leads directly to local code installation with no enforced trust checkpoint.
- Content
md "id": "binary", "kind": "shell", "label": "Install mcpsec (pre-built binary, Linux/macOS) — verify checksum before running", "cmd": "curl -L https://github.com/pfrederiksen/mcpsec/releases/download/v1.0.0/checksums.txt && curl -L https://github.com/pfrederiksen/mcpsec/releases/download/v1.0.0/mcpsec_1.0.0_linux_amd64.tar.gz -o /tmp/mcpsec.tar.gz && sha256sum /tmp/mcpsec.tar.gz && tar -xzf /tmp/mcpsec.tar.gz -C /tmp/ && mv /tmp/mcpsec /usr/local/bin/mcpsec", }, ], },
MCP Config Access
High
- Category
- Agent Snooping
- Confidence
- 90% confidence
- Finding
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
- Content
md For stronger guarantees, build from source: `git clone https://github.com/pfrederiksen/mcpsec && cd mcpsec && make build` ### Sensitive data access MCP config files may contain API keys and tokens. The scanner reads them to detect hardcoded secrets (MCP04) but does not write, transmit, or log them. The wrapper script (`scan.py`) makes no network calls. The binary makes no network calls per its source, but this skill cannot enforce the binary's runtime behavior — review the source or run in an isolated environment if you require certainty. ### Network behavior
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares shell-based install and execution capabilities but does not constrain tool scope with explicit permissions or allowed-tools metadata. In an agent ecosystem, missing scope boundaries increases the chance the skill can invoke broader shell actions than its stated read-only purpose implies, especially because installation commands include fetch and filesystem modification steps.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The embedded install workflow downloads an external binary and installs it into a system path, which exceeds the stated read-only scanning purpose of the skill. This creates unnecessary supply-chain and privilege risk because users may treat the skill as passive auditing content while it actually prescribes network retrieval and local binary installation.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The documentation instructs users to use sudo to move a built binary into /usr/local/bin, requiring elevated privileges. If the binary or build chain is compromised, root-assisted installation magnifies impact and persistence, and the privilege elevation is not strictly necessary for all environments.
- Content
Build from source (strongest supply chain guarantee)
git clone https://github.com/pfrederiksen/mcpsec && cd mcpsec && make build sudo mv mcpsec /usr/local/bin/
text ## What It Scans
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python returned as non-zero exit codes rather than raised. """ try: result = subprocess.run( cmd, capture_output=True, text=True,
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
The install command fetches external content from GitHub, which introduces normal supply-chain risk for any binary acquisition workflow. Although external fetching is expected for installation, it remains a real security concern because the fetched artifact is then extracted and installed locally.
- Content
md "id": "binary", "kind": "shell", "label": "Install mcpsec (pre-built binary, Linux/macOS) — verify checksum before running", "cmd": "curl -L https://github.com/pfrederiksen/mcpsec/releases/download/v1.0.0/checksums.txt && curl -L https://github.com/pfrederiksen/mcpsec/releases/download/v1.0.0/mcpsec_1.0.0_linux_amd64.tar.gz -o /tmp/mcpsec.tar.gz && sha256sum /tmp/mcpsec.tar.gz && tar -xzf /tmp/mcpsec.tar.gz -C /tmp/ && mv /tmp/mcpsec /usr/local/bin/mcpsec", }, ], },
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
The install command fetches external content from GitHub, which introduces normal supply-chain risk for any binary acquisition workflow. Although external fetching is expected for installation, it remains a real security concern because the fetched artifact is then extracted and installed locally.
- Content
md "id": "binary", "kind": "shell", "label": "Install mcpsec (pre-built binary, Linux/macOS) — verify checksum before running", "cmd": "curl -L https://github.com/pfrederiksen/mcpsec/releases/download/v1.0.0/checksums.txt && curl -L https://github.com/pfrederiksen/mcpsec/releases/download/v1.0.0/mcpsec_1.0.0_linux_amd64.tar.gz -o /tmp/mcpsec.tar.gz && sha256sum /tmp/mcpsec.tar.gz && tar -xzf /tmp/mcpsec.tar.gz -C /tmp/ && mv /tmp/mcpsec /usr/local/bin/mcpsec", }, ], },
Static analysis
No suspicious patterns detected.