Plati MCP Search

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:00 PM UTC
• Version: 0.1.6

Overview

The skill is a coherent Plati price-search helper, but it asks users to globally install and run an unpinned third-party MCP server whose code is not included for review.

Review this before installing: the skill itself is just Markdown, but following it runs a third-party npm MCP server on your machine. Prefer a pinned, verified version, check the package source and publisher, avoid global installation when possible, and run it with limited filesystem and credential access. Also expect the final output template to be Russian unless adapted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Globally Installed Third-Party MCP Server

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7–11
Vulnerability Type: Unpinned third-party executable and supply-chain exposure
Risk Level: Medium

Vulnerable Code

text

Prerequisite: install the MCP server package:

`npm i -g plati-mcp-server`

Configure an MCP server named `plati-scraper` in your local OpenClaw/Claude config:

`command: plati-mcp-server`

Technical Analysis

The skill instructs users to install plati-mcp-server globally from the npm registry without specifying an exact version, lockfile, integrity hash, verified repository, or publisher identity. Consequently, the package content installed at deployment time can differ from the content reviewed when the skill was published.

npm packages may execute lifecycle scripts during installation. After installation, this package is also launched as an MCP server and exposed to the agent as a trusted local tool. Its implementation is not included in the audited project, so its installation-time and runtime behavior cannot be verified from SKILL.md.

This is a supply-chain weakness rather than evidence that the named package is currently malicious.

Attack Path

1. An attacker compromises the package publisher, registry account, or package distribution process, or causes users to resolve an unsafe release.
2. The attacker publishes a malicious version under the package name used by the skill.
3. A user follows the unpinned command npm i -g plati-mcp-server.
4. npm retrieves the current package version and may run package-controlled lifecycle scripts with the installing user's privileges.
5. The user configures and launches the installed executable as an MCP server.
6. Malicious installation or runtime logic can then act with the user's permissions or return attacker-controlled tool results to the agent.

Impact Assessment

Successful exploitation could execute code with the privileges of the user performing the installation or running the MCP server. ...[truncated 515 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact reviewed version, for example plati-mcp-server@X.Y.Z, rather than installing the latest release implicitly.
2. Document the package's official publisher, registry location, and source repository so users can verify provenance.
3. Provide and verify an integrity digest for the approved package artifact.
4. Prefer a project-local installation governed by a committed lockfile over a global installation.
5. Review the package source and npm lifecycle scripts before recommending installation.
6. Disable lifecycle scripts during installation with --ignore-scripts if they are not required; otherwise, explicitly document and audit every required script.
7. Run the MCP server under a dedicated least-privileged account or sandbox with restricted filesystem, credential, and network access.
8. Define an update-review process so dependency upgrades are audited before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill mandates Russian-only final output regardless of the user's language or locale, which can override user expectations and reduce transparency about the results. In a purchasing/comparison workflow, forcing a language without consent can mislead or exclude users, especially when prices, seller terms, or links need to be clearly understood before acting.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.