ClawHub
Back to skill

Security audit

reMarkable MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate purpose, but it asks users to run an unpinned external server that can access private tablet documents and credentials, with limited privacy disclosure for cloud and OCR modes.

Review this skill before installing. Prefer USB mode when possible, avoid using cloud or OCR modes for sensitive notes unless you accept the third-party processing risk, and pin or verify the `remarkable-mcp` package before running it with tablet access or credentials.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Third-Party MCP Package Is Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:20-26
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

json
{
  "mcpServers": {
    "remarkable": {
      "command": "uvx",
      "args": ["remarkable-mcp", "--usb"]
    }
  }
}

The same unpinned remarkable-mcp package is also invoked by the SSH, cloud, and OCR configurations at SKILL.md:34-40, SKILL.md:45-54, and SKILL.md:60-69.

Technical Analysis

The configuration directs uvx to resolve and execute remarkable-mcp without specifying a reviewed package version, cryptographic hash, signature, or verified source. Consequently, the code ultimately executed may change after this Skill has been reviewed.

The dependency is security-sensitive because its intended role gives it access to private tablet documents. Depending on the selected configuration, it may also receive SSH access, a reMarkable cloud token, or a Google Vision API key. The project contains no implementation of remarkable-mcp, so the external package's behavior could not be audited from the supplied artifact.

This is a supply-chain exposure rather than evidence that the current package is malicious.

Attack Path

  1. An attacker compromises the remarkable-mcp package, its publisher account, or the package distribution channel.
  2. The attacker publishes a malicious version under the package name resolved by uvx.
  3. A user starts the MCP server using the documented configuration.
  4. uvx resolves and executes the uncontrolled package version.
  5. The malicious package runs with the permissions of the MCP process and can attempt to access tablet content, process-visible credentials, available network resources, and any other resources exposed to that process.

Impact Assessment

Successful exploitation could expose private documents and credentials supplied to the MCP server, including a reMarkab ...[truncated 482 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin remarkable-mcp to a specifically reviewed version rather than resolving the latest available release.
  • Use a trusted package registry and explicitly document the package's official publisher and source repository.
  • Enforce integrity verification through hashes, signed artifacts, or a locked dependency manifest where supported.
  • Review each dependency update before changing the pinned version.
  • Run the MCP server in a sandbox with minimal filesystem, network, USB-device, and process access.
  • Supply only the credentials required for the selected mode, scope them narrowly, and rotate them if package compromise is suspected.
  • Avoid exposing unrelated environment variables or host credentials to the MCP process.
  • Apply equivalent pinning and isolation to the USB, SSH, cloud, and OCR configurations.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents cloud access using a reMarkable token and OCR using a Google Vision API key, but it does not clearly warn that document contents may be transmitted to third-party services or remote infrastructure. In a note-taking context, users may expose sensitive handwritten notes, PDFs, annotations, or personal documents without understanding the privacy implications, which makes the omission security-relevant even if the feature itself is legitimate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.