ops-mcp-server

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:44 AM UTC
• Version: 1.0.3

Overview

This skill is an ops integration that discloses SOP execution, but it also claims read-only behavior while documenting commands that can change infrastructure.

Review carefully before installing. Use only with a vetted, pinned `mcporter` version, least-privilege MCP credentials, and explicit approval before every SOP execution; treat the SOPS path as infrastructure-changing, not read-only observability.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:50

Finding

Unpinned Third-Party CLI Is Downloaded and Executed Through npx

Content

View full analysis

Remediation

View remediation

... ``` 2. Verify the package's publisher, registry origin, and release provenance before recommending it. 3. Use a lockfile and npm integrity metadata where installation is managed as part of a project. 4. Prefer a locally installed, reviewed dependency invoked with `npm exec --offline` or an equivalent mechanism that does not silently retrieve changing code. 5. Document the expected package checksum or signed release verification process. 6. Avoid recommending global installation because it expands the duration and scope of exposure. 7. Configure CI to detect unpinned `npx`, `npm install`, and equivalent dependency executions in documentation and scripts. 8. Run the CLI with a dedicated low-privilege account and expose only the minimum MCP credentials required for the task. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:114

Finding

Write-Capable SOP Execution Contradicts the Declared Read-Only Security Boundary

Content

View full analysis

parameters='{...}' ``` ``` The same Skill declares a conflicting read-only boundary: ```text ## What This Skill is NOT For - Direct infrastructure changes (use dedicated automation tooling) - Real-time alerting (investigation only, not a monitoring agent) - Writing to or modifying operational data (all access is read-only) ``` The associated examples include disruptive infrastructure operations: ```bash # Step 3: Execute npx mcporter call ops-mcp-server execute-sops-from-ops \ sops_id="pod-restart" parameters='{"namespace":"kube-system","pod_name":"calico-node-abc123"}' ``` ```bash # Scale down npx mcporter call ops-mcp-server execute-sops-from-ops \ sops_id="scale-deployment" parameters='{"namespace":"kube-system","deployment":"coredns","replicas":0}' # Migrate database npx mcporter call ops-mcp-server execute-sops-from-ops \ sops_id="db-migrate" parameters='{"database":"kube-system"}' # Scale up npx mcporter call ops-mcp-server execute-sops-from-ops \ sops_id="scale-deployment" parameters='{"namespace":"kube-system","deployment":"coredns","replicas":3}' ``` ```bash # Scale up deployment npx mcporter call ops-mcp-server execute-sops-from-ops \ sops_id="scale-deployment" parameters='{"namespace":"kube-system","deployment":"coredns","replicas":20}' # Increase resources npx mcporter call ops-mcp-server execute-sops-from-ops \ sops_id="increase-resources" parameters='{"namespace":"kube-system","deployment":"coredns","cpu":"2000m","memory":"4Gi"}' ``` ### Technical Analysis The Skill combines observabi ...[truncated 3131 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (122)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises executing operational procedures but provides no clear safety warning, confirmation requirement, or statement that those procedures may alter live systems. In an incident-response context, users may assume these are harmless lookups and inadvertently initiate disruptive actions against production infrastructure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document states that 'all access is read-only' while earlier instructing users to execute SOP procedures via execute-sops-from-ops. This contradiction can mislead operators or higher-level agents into assuming the skill is non-impactful, when it may trigger state-changing operational actions such as restarts or remediation workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx mcporter without a pinned version allows execution of whatever package version is currently resolved from the registry at runtime. In an ops-focused skill that can access observability systems and execute SOPs, a compromised or malicious upstream package could gain powerful access or influence operator actions, making the supply-chain risk more significant than in a low-privilege context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest frames the skill as an observability and procedure interface, while later disclaiming direct infrastructure changes even though it exposes operational procedure execution. This mismatch can cause incorrect trust decisions by users or orchestration systems that classify the skill as mostly investigative rather than potentially action-capable.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad operational terms like logs, metrics, events, incident, cluster, and pod, which can cause the skill to activate in many routine conversations. Because this skill includes an SOP execution capability, overbroad activation increases the chance that an agent routes a request into a context where impactful tools are available without the user's explicit intent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to run npx mcporter without pinning a specific package version. Because npx resolves and executes code from the registry dynamically, a compromised latest release, typo-squatted dependency path, or unexpected upstream update could cause arbitrary code execution on the operator's machine during setup or use.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This setup step again relies on unpinned npx mcporter, which executes whatever version is current at runtime. In an ops-focused skill likely used by privileged operators, this increases supply-chain risk because the command may run with access to local credentials, config files, or production endpoints.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using unpinned npx mcporter for authentication can expose especially sensitive material if a malicious or compromised package version is served. Since this step may handle bearer tokens or auth flows, the blast radius is larger than a generic package execution risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The verification command also executes unpinned remote package code through npx. Repetition across multiple steps normalizes unsafe practice and makes accidental execution of an unreviewed upstream version more likely in operational environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to invoke mcporter through npx without pinning an exact package version. This can cause users to fetch and execute whatever version is current at invocation time, creating a supply-chain risk if a malicious or compromised release is published or if behavior changes unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This example uses npx mcporter without a pinned version, so the command may download and execute an unreviewed latest package version. In an ops-focused skill, users may run these commands in sensitive environments, increasing the risk from package compromise or unexpected version drift.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command example encourages direct execution of mcporter via npx without version pinning. That exposes users to supply-chain compromise and non-reproducible behavior because the resolved package can change over time.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This sample command repeats the unpinned npx mcporter pattern, which can result in execution of a newly published or compromised package version. Because the skill interfaces with observability and operational tooling, accidental execution of hostile code could affect privileged operator workstations or automation contexts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The unpinned npx mcporter invocation allows runtime resolution of the package version, making the example susceptible to supply-chain attacks and silent behavior changes. In this operational context, users may trust and copy-paste commands directly, so the documentation meaningfully increases exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The documentation instructs users to run npx mcporter without pinning an exact package version, which can cause execution of whatever version npm resolves at runtime. If the package is updated maliciously, compromised upstream, or unexpectedly changed, users may run unreviewed code in their environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This example uses npx mcporter without an explicit version, so command execution depends on the latest or otherwise resolved registry state at the time the user runs it. That creates a supply-chain risk where a malicious or breaking package release could be executed directly from documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Running npx mcporter unpinned allows remote package resolution at execution time, which is unsafe for security-sensitive operational tooling. In this skill's context, the tool queries observability and operational systems, so executing an unexpected package version could expose credentials or alter operations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The unversioned npx mcporter reference introduces a package substitution/update risk because npm will fetch and execute a package based on current registry state. Users may assume the command is stable and trusted, but documentation-driven execution makes this an effective supply-chain attack vector.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This documentation example executes mcporter through npx without version pinning, which means users could run an unintended package version or a compromised release. Because the skill targets ops workflows, the resulting code execution could affect access to cluster and monitoring data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

An unpinned npx invocation is a genuine supply-chain weakness because it delegates trust to live package resolution. In a runbook/example file, this is especially risky since operators are likely to copy and paste commands directly during incidents, reducing scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The example relies on npx mcporter with no pinned version, exposing users to execution of unreviewed code from the npm ecosystem. This is dangerous in an ops-focused skill because the tool may have access to sensitive telemetry, credentials, or automation pathways.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This npx mcporter usage is a true issue because the package identity/version is not fixed, allowing registry-side changes to alter what code runs. Documentation examples are high-leverage because many users will execute them as written.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command uses unpinned npx, which creates a realistic supply-chain execution risk if mcporter or a dependency is compromised. Given this skill's integration with observability and operational procedures, compromise could extend beyond local execution into sensitive infrastructure access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

By omitting a version, the example trusts the package registry at runtime and may execute a different artifact than intended. This is a true vulnerability pattern because it enables upstream tampering or accidental breaking changes to affect users immediately.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This command is vulnerable to package drift or compromise because npx mcporter is not version-pinned. In incident-response and observability contexts, users may run it under elevated privileges or with sensitive environment variables, increasing the blast radius.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.