Security audit

RuRussian MCP

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Russian tutoring integration that uses API keys, payment checkout, network calls, and local learner memory, with privacy and payment cautions but no evidence of hidden or malicious behavior.

Install only if you want an agent-connected RuRussian tutor that can use a RuRussian API key, send learner text/email to the RuRussian backend, create checkout sessions, and keep local learning history. Use a dedicated API key, do not grant unattended payment authority, confirm plan and account before checkout, and delete or relocate the local memory file if learner history should not persist.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 78% confidence
Finding: The skill advertises only tutoring functionality, but the metadata and documented workflows imply access to environment variables, network communication, and local file operations without declaring permissions or clearly warning the operator. This creates a transparency and least-privilege problem: users may authorize a seemingly harmless tutor skill that can also persist data locally and communicate with remote services using sensitive credentials.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: This is a genuine description-behavior mismatch: the skill is presented as a Russian tutor, but the documented behavior and static analysis indicate persistence of learner data, profile storage under the user's home directory, purchase and payment-session handling, and remote backend calls. When a skill handles identity, stored learner progress, and commerce workflows beyond its simple educational description, users and deployers may underestimate the privacy and security exposure.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The purchase confirmation flow extracts and returns sensitive credentials from backend responses using keys such as api_key, key, or token, and treats possession of that value as confirmation. Returning API keys/tokens through a tutoring skill increases the chance of secret exposure to downstream components, logs, or users, enabling account takeover or unauthorized API use if mishandled.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README advertises tools that can initiate purchases and update persistent learning memory, but it does not clearly warn operators that these actions may create external side effects such as checkout sessions, purchase confirmation, or data writes. In an agent-executed MCP context, unclear side-effect boundaries are dangerous because an autonomous client may invoke these tools without explicit human approval, leading to unintended transactions or persistent state changes.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The skill explicitly supports learner email collection and purchase flows, but it does not provide a clear privacy notice, retention policy, or explanation of how learner identifiers and transaction-related data are stored, transmitted, and protected. This raises privacy and compliance risk, especially because educational data tied to an email address can become persistent personal data.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide tells users to store a live API key directly in a user config file but does not warn that this file contains a secret or recommend protections such as filesystem permissions, secret stores, or environment-variable injection. If the config file is copied, committed, logged, or exposed on a shared system, the key could be stolen and used to access the RuRussian backend as the bot.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The service persists learner profile data, including activity history, mistakes, vocabulary, topics, and an email-derived learner identifier, to local storage without any notice, consent flow, retention control, or privacy guardrails visible in this file. In a tutoring skill, this creates a real privacy risk because potentially sensitive behavioral and educational data is silently accumulated and linked to a user identity.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The code retrieves the active learner's email from memory and sends it to an external backend in `generate_reading_passage` without any visible consent check, minimization, or disclosure in this path. Even if the backend is trusted, transmitting personally identifiable information unnecessarily increases privacy risk and can expose user identity through logs, analytics, or downstream processing.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The purchase confirmation flow can automatically authenticate the session using an API key returned by the backend when auto_authenticate is enabled by default. This creates an implicit trust boundary crossing: a payment-confirmation action also mutates authentication state, which can surprise callers and enable unintended account/session binding if the wrong session_id is supplied or backend responses are mishandled.

Static analysis

No suspicious patterns detected.