Clicks Protocol

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:40 AM UTC
• Version: 1.2.7

Overview

The skill is mostly a disclosed read-only query helper, but it also directs users to unpinned npm/MCP packages that can run unreviewed code and may expose state-changing protocol tools.

Before installing, use the bundled read-only script for simple queries when possible. If you use the SDK or local MCP server, pin exact package versions, review the package and its permissions, and expose only read-only tools to agent loops. Do not connect a signer or enable operator tools unless a human explicitly approves each transaction.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:90

Finding

Unpinned Third-Party npm Packages Create a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:90 and SKILL.md:121
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

npm install @clicks-protocol/sdk

bash

npx @clicks-protocol/mcp-server

Technical Analysis

The documentation instructs users to install or execute npm packages without specifying exact versions. Package resolution therefore occurs at execution time and may retrieve code that differs from the version intended or previously reviewed.

The npx command is particularly sensitive because it may download and immediately execute the currently resolved package. Similarly, npm install may execute package lifecycle scripts unless they are explicitly disabled. The effective third-party code and its lifecycle scripts are absent from this project, so they were outside the audited code boundary.

This is a supply-chain weakness rather than evidence that the named packages are currently malicious.

Attack Path

1. An attacker compromises the npm publisher account, package, or a dependency in its dependency tree.
2. The attacker publishes a malicious version that becomes the version selected by the unpinned command.
3. A user follows the documented npm install or npx instruction.
4. npm downloads the attacker-controlled release.
5. Malicious lifecycle or runtime code executes with the permissions of the invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. Depending on that account's permissions and environment, malicious package code could read accessible files and environment variables, modify project files, establish network connections, or alter application behavior. No privilege escalation beyond the invoking user's existing permissions is demonstrated by the audited files.

Remediation

View remediation

Remediation Suggestions

• Pin each package to an exact, reviewed version, for example @clicks-protocol/sdk@X.Y.Z.
• Install the MCP server as a lockfile-pinned local dependency and invoke its local binary instead of allowing npx to resolve the latest release dynamically.
• Commit and enforce a package lockfile with integrity hashes.
• Use npm ci in automated or reproducible environments.
• Use --ignore-scripts when package lifecycle scripts are not required.
• Review package provenance, maintainers, published artifacts, dependency trees, and lifecycle scripts before approving version updates.
• Apply automated dependency scanning and require explicit review for lockfile changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises shell-based usage via curl/jq and bundled scripts, but it does not declare an explicit tool scope such as allowed shell commands or permissions. In agent environments, missing scope boundaries can let the runtime grant broader shell access than the skill actually needs, increasing the chance of command abuse, unexpected network access, or unsafe composition with other instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using npx @clicks-protocol/mcp-server without a pinned version causes the latest package version to be fetched and executed at runtime. If the package is compromised, replaced with a malicious release, or simply changes behavior, an agent could execute unreviewed code and potentially expose secrets, perform unintended network actions, or enable state-changing tooling despite the skill's read-only framing.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/clicks.sh (reported line 2)May include surrounding context.

sh

#!/usr/bin/env bash
# Clicks Protocol — Query tool (zero dependencies, just curl + jq)
# Uses the HTTP MCP Server at mcp.clicksprotocol.xyz

set -euo pipefail

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This shell script sends command arguments such as wallet addresses and amounts to a remote MCP endpoint via HTTP POST, but the command paths for agent-info, simulate, and referral do not display any disclosure at execution time. Although the file header names the remote server and the info/help text describes the script generally, users invoking these data-bearing commands are not explicitly warned that their inputs will be transmitted off-host.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.