AutoSend MCP

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:13 PM UTC
• Version: 0.1.3

Overview

This is a coherent AutoSend MCP connector with disclosed OAuth setup, but users should protect its local tokens and be cautious with the unpinned mcporter install.

Install only if you trust the mcporter package and the AutoSend MCP service for your account. Treat ~/.mcporter/autosend/tokens.json like a password: keep it out of repositories, logs, shared folders, and insecure backups, restrict local file access where possible, and revoke or re-authenticate if you suspect exposure. Because the skill exposes create, update, and delete operations for email assets, review agent actions before allowing changes to campaigns or templates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–51
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

### 1. Install mcporter

npm install -g mcporter

The skill metadata also declares the same dependency without a version constraint:

yaml

requires:
  bins:
    - mcporter
install:
  - kind: node
    package: mcporter
    bins: [mcporter]

Technical Analysis

The installation command retrieves the current mcporter package release from npm without specifying an exact reviewed version or verifying its integrity. The metadata declaration likewise omits a version.

Consequently, the effective code installed when a user activates the skill can differ from the code available when the skill was audited. npm package installation may execute package lifecycle scripts, while subsequent use executes the installed package with the user's permissions. Global installation also makes the mutable dependency available throughout the user's environment.

This is a supply-chain exposure rather than evidence that the currently published package is malicious. Exploitation requires compromise of the package, its publisher account, or the relevant package-distribution path.

Attack Path

1. An attacker compromises the mcporter npm package, its publisher account, or its distribution path.
2. The attacker publishes a malicious release under the same package name.
3. A user follows the skill instructions and runs npm install -g mcporter, which resolves the unpinned malicious release.
4. Malicious code executes through installation lifecycle behavior or when the installed CLI is invoked.
5. The code runs with the installing user's privileges and may access that user's files and credentials, including AutoSend OAuth tokens stored at ~/.mcporter/autosend/tokens.json.

Impact Assessment

Successful exploitation could provide arb ...[truncated 530 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin mcporter to a reviewed exact version in both the installation command and skill metadata, for example:

   bash

   npm install -g mcporter@<reviewed-exact-version>
   

2. Where the skill framework supports it, add an exact version constraint and integrity digest to the dependency declaration.
3. Prefer a project-local installation backed by a committed lockfile over global installation.
4. Install only from the expected official registry and verify package provenance, publisher identity, signatures or attestations, and integrity metadata.
5. Review new dependency versions before updating the pin, including package lifecycle scripts and transitive dependency changes.
6. Run the tool with least privilege and restrict access to ~/.mcporter/autosend/tokens.json using appropriate filesystem permissions. Never perform the installation as an elevated user unless explicitly required and independently justified.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

mcporter config add autosend https://mcp.autosend.com/ --auth oauth

text

Or manually create `config/mcporter.json`:
```json
{
  "mcpServers": {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs users to store OAuth access and refresh tokens in a predictable local file path, but it provides no warning that these are sensitive credentials or guidance on protecting them. If the host is shared, backed up insecurely, or the file permissions are too broad, an attacker who obtains the token file could reuse the tokens to access the AutoSend account and perform email-related actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.