Bring Photo MCP

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:15 AM UTC
• Version: 1.0.2

Overview

This skill is a coherent Bring shopping-list integration, but users should be careful because it installs an external npm MCP server that receives Bring account credentials.

Install only if you trust the bring-photo-mcp npm package and are comfortable giving it Bring account credentials. Use a secret store, restrict BRING_ALLOWED_LISTS to only the lists you want writable, and prefer a reviewed pinned package version if available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Third-Party Executable Handles Sensitive Credentials and Image Paths

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-32; sensitive environment variables are declared at lines 13-17 and 21-26
Vulnerability Type: Unpinned and unverifiable third-party executable dependency
Risk Level: Medium

Vulnerable code snippet:

yaml

install:
  - kind: node
    package: bring-photo-mcp
    bins: [bring-photo-mcp]

Relevant sensitive inputs:

yaml

requires:
  env:
    - BRING_EMAIL
    - BRING_PASSWORD
    - BRING_DEFAULT_LIST
    - BRING_ALLOWED_LISTS

yaml

envVars:
  - name: BRING_EMAIL
    required: true
    description: Bring account email address.
  - name: BRING_PASSWORD
    required: true
    description: Bring account password; store only in a secret store.

Technical Analysis

The installation configuration resolves the bring-photo-mcp package without an exact version, integrity checksum, lockfile, repository reference, or documented publisher verification. The executable implementation is not included in the audited project, so its credential handling, network behavior, filesystem access, and list-operation logic cannot be independently verified.

The installed process is expected to operate with BRING_EMAIL and BRING_PASSWORD in its environment. The documented workflow can also pass approved local image paths to the MCP server. Consequently, an unexpectedly updated, compromised, or registry-substituted package would execute in a context containing sensitive account data and potentially accessible product images.

This is a supply-chain exposure rather than evidence that the currently published package is malicious. The reviewed file contains no direct malicious payload, obfuscation, persistence mechanism, or credential-exfiltration implementation.

Attack Path

1. An attacker compromises the package publisher account, package registry, or another component of the dependency-resolution process.
2. The ...[truncated 1217 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin bring-photo-mcp to a reviewed, exact package version rather than allowing unconstrained resolution.
2. Add a lockfile and verify the package with a cryptographic integrity hash during installation.
3. Document and validate the canonical registry, source repository, package publisher, and release-signing process.
4. Include or vendor the MCP server source so its credential, network, and filesystem behavior can be audited alongside the Skill.
5. Run the executable in a restricted environment with access only to the required environment variables, approved image files, and Bring service endpoints.
6. Prefer short-lived or revocable credentials where the service supports them, and continue storing secrets outside source-controlled files.
7. Apply outbound network allowlisting and read-only filesystem restrictions except for narrowly required paths.
8. Establish dependency monitoring and require security review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises a trigger phrase, "Add this to my shopping list," that is common in everyday conversation and not uniquely scoped to this skill. In an agent environment, this increases the chance of accidental invocation and unintended writes to a Bring! list, especially because the skill is capable of performing authenticated state-changing actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.