Frinkiac - Search, browse, and generate memes from The Simpsons, Futurama, Rick and Morty, and 30 Rock scenes

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:17 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed TV screenshot and meme tool with a visible MCP setup, though users should be aware it runs an unpinned npm package through npx.

Install only if you are comfortable running the referenced npm MCP package locally. For lower risk, pin `@ryantenney/frinkiac-mcp` to a specific reviewed version and run it with least privilege.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26–27
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

json

"command": "npx",
"args": ["-y", "@ryantenney/frinkiac-mcp"]

Technical Analysis

The documented MCP configuration invokes npx with an unversioned npm package name. Because no exact version is specified, npm can resolve a newer package release each time the command is run. The -y option automatically accepts the installation prompt, allowing the resolved package to be downloaded and executed without interactive confirmation.

This creates a supply-chain risk because the code ultimately executed can change after the skill has been reviewed. Exploitation would require compromise or malicious control of the referenced npm package, its publisher account, or the relevant package-distribution path. The audit did not establish that the package is currently malicious.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or another relevant supply-chain component.
2. The attacker publishes a malicious version under @ryantenney/frinkiac-mcp.
3. A user applies the documented MCP configuration and starts the server.
4. npx -y resolves and downloads the mutable package version without prompting for approval.
5. The malicious package executes locally with the permissions of the user running the MCP server.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the MCP server user's account. Depending on that account's privileges and environment, the malicious dependency could access files, environment variables, credentials available to the process, and network resources, or modify data writable by that user. The configuration itself does not request elevated privileges, so the direct impact is bounded by the invoking user's permissions.

Remediation

View remediation

Remediation Suggestions

• Pin the package to an audited exact version, such as @ryantenney/frinkiac-mcp@x.y.z, rather than relying on mutable version resolution.
• Verify the selected package version, publisher identity, repository, and release provenance before deployment.
• Use a lockfile and npm integrity metadata where the MCP deployment mechanism supports them.
• Prefer installing the reviewed version through a controlled dependency-management process instead of downloading it implicitly at each startup.
• Remove -y where practical so unexpected installation or resolution changes require explicit approval.
• Run the MCP server with least privilege, restrict its filesystem and network access, and avoid exposing unnecessary secrets through environment variables.
• Monitor dependency advisories and review upgrades before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.