Mealmastery

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:10 PM UTC
• Version: 1.0.1

Overview

The skill’s meal-planning behavior is coherent, but it runs an unpinned npm MCP server with the user’s API key, so users should review the supply-chain risk before installing.

Install only if you are comfortable running MealMastery’s npm MCP server locally with your MealMastery API key. Prefer a pinned, reviewed package version or a sandboxed/containerized MCP runtime, use a revocable scoped API key if available, and review checkout previews carefully before confirming real grocery-cart actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:20

Finding

Unpinned Third-Party Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-22 and 40-45
Vulnerability Type: Unpinned executable dependency and supply-chain exposure
Risk Level: High

Vulnerable code (lines 20-22):

yaml

install:
  - kind: node
    package: "@mealmastery/mcp-server"

Vulnerable code (lines 40-45):

json

"command": "npx",
"args": ["-y", "@mealmastery/mcp-server"],
"env": {
  "MEALMASTERY_API_KEY": "${MEALMASTERY_API_KEY}"
}

Technical Analysis

The configuration invokes npx -y with no exact package version or integrity constraint. Consequently, execution can resolve to the package version currently supplied by the npm registry rather than to an immutable artifact reviewed with this Skill. The -y option also suppresses the normal installation confirmation.

The downloaded package executes locally and receives MEALMASTERY_API_KEY in its environment. Its source is not included in the audited project, so this audit cannot verify its credential handling, network destinations, command execution, or access to local resources. A compromised package release, publisher account, or dependency-resolution path could therefore substitute malicious executable code after this Skill has been reviewed.

Remote processing of meal preferences, allergy information, grocery lists, subscription state, and checkout requests is consistent with the declared hosted service. The documentation also requires a dry run and explicit confirmation before checkout. The confirmed issue is not the service's necessary network communication itself, but the mutable and automatically executed package used to implement it.

Attack Path

1. An attacker compromises the npm publisher account, package publication process, registry resolution, or another relevant supply-chain component.
2. The attacker publishes or causes resolution to a malicious version of @mealmastery/mcp-server.
3. A user starts the conf ...[truncated 1276 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @mealmastery/mcp-server to a reviewed, exact version rather than relying on the registry's current version.
2. Install through a committed lockfile and enforce package integrity verification during installation.
3. Avoid launching the dependency through an automatically approving npx -y flow. Use a controlled installation stage followed by execution of the verified local artifact.
4. Verify package provenance and signatures where supported, monitor publisher and package changes, and require security review before upgrades.
5. Run the MCP server in a sandbox or container with narrowly restricted filesystem, process, and outbound-network access.
6. Supply a narrowly scoped, revocable API token and avoid exposing unrelated secrets to the process environment.
7. Restrict outbound traffic to documented MealMastery endpoints if operationally feasible.
8. Publish or vendor the reviewed server implementation so its credential handling and network behavior can be independently audited.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

## Setup

1. Create a free account at [mealmastery.ai](https://www.mealmastery.ai)
2. Go to **Settings > Developer API** and create an API key
3. Set the key in your environment:

Static analysis

No suspicious patterns detected.