api-to-typemcp

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:41 AM UTC
• Version: 0.2.6

Overview

The skill is mostly transparent and gated, but needs Review because one replace-generation path can overwrite files outside the chosen output folder.

Before installing, prefer project-only generation into a newly created empty directory. Do not use --replace on a directory you did not create and inspect, especially if it may contain symlinks. Review any agent installation plan carefully because it can modify persistent MCP client configuration, and run npm verification in a container, VM, or host sandbox for untrusted inputs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/render.py:34

Finding

Nested Symlink Output Escape When Using --replace

Content

View full analysis

None: path = output_dir / rel path.parent.mkdir(parents=True, exist_ok=True) path.write_text(content, encoding="utf-8") written.append(rel) ``` ### Technical Analysis The output safety gate validates only the output directory itself. When `--replace` is enabled, the directory may already contain arbitrary files and nested directories. Existing child paths are not checked for symlinks before `mkdir()` or `write_text()` is called. Python path-based file operations normally follow symlinks. Consequently, an existing generated destination such as `src/index.ts`, or a parent such as `src`, can point outside the approved output directory. The renderer then writes generated content to the symlink target. This contradicts the documented containment claim that generation writes only inside the caller-created output directory. Exis ...[truncated 2008 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (84)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill presents itself as a generator for safe TypeMCP projects, yet it also supports installation-plan generation, portable MCP config export, and native config mutation for supported clients. That mismatch is security-relevant because writing agent configuration affects user environments beyond the generated project and may not be expected from the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill presents itself as a generator for safe TypeMCP projects, yet it also supports installation-plan generation, portable MCP config export, and native config mutation for supported clients. That mismatch is security-relevant because writing agent configuration affects user environments beyond the generated project and may not be expected from the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill presents itself as a generator for safe TypeMCP projects, yet it also supports installation-plan generation, portable MCP config export, and native config mutation for supported clients. That mismatch is security-relevant because writing agent configuration affects user environments beyond the generated project and may not be expected from the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

The skill presents itself as a generator for safe TypeMCP projects, yet it also supports installation-plan generation, portable MCP config export, and native config mutation for supported clients. That mismatch is security-relevant because writing agent configuration affects user environments beyond the generated project and may not be expected from the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The skill presents itself as a generator for safe TypeMCP projects, yet it also supports installation-plan generation, portable MCP config export, and native config mutation for supported clients. That mismatch is security-relevant because writing agent configuration affects user environments beyond the generated project and may not be expected from the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The skill presents itself as a generator for safe TypeMCP projects, yet it also supports installation-plan generation, portable MCP config export, and native config mutation for supported clients. That mismatch is security-relevant because writing agent configuration affects user environments beyond the generated project and may not be expected from the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill presents itself as a generator for safe TypeMCP projects, yet it also supports installation-plan generation, portable MCP config export, and native config mutation for supported clients. That mismatch is security-relevant because writing agent configuration affects user environments beyond the generated project and may not be expected from the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill presents itself as a generator for safe TypeMCP projects, yet it also supports installation-plan generation, portable MCP config export, and native config mutation for supported clients. That mismatch is security-relevant because writing agent configuration affects user environments beyond the generated project and may not be expected from the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill presents itself as a generator for safe TypeMCP projects, yet it also supports installation-plan generation, portable MCP config export, and native config mutation for supported clients. That mismatch is security-relevant because writing agent configuration affects user environments beyond the generated project and may not be expected from the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill presents itself as a generator for safe TypeMCP projects, yet it also supports installation-plan generation, portable MCP config export, and native config mutation for supported clients. That mismatch is security-relevant because writing agent configuration affects user environments beyond the generated project and may not be expected from the declared scope.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill presents itself as a generator for safe TypeMCP projects, yet it also supports installation-plan generation, portable MCP config export, and native config mutation for supported clients. That mismatch is security-relevant because writing agent configuration affects user environments beyond the generated project and may not be expected from the declared scope.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

nstalled skill-relative path. Set `SKILL_DIR` to the directory containing this `SKILL.md`; create a **controlled temporary output directory** yourself and keep

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify_generated.py (reported line 261)May include surrounding context.

python

"HOME": str(home),
            "TMPDIR": str(tmp),
            "npm_config_cache": str(npm_cache),
            "npm_config_userconfig": str(home / ".npmrc"),
            "npm_config_proxy": "",
            "npm_config_https_proxy": "",
            "npm_config_noproxy": "*",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/agent_clients.py (reported line 99)May include surrounding context.

python

```bash
npm install
cp .env.example .env   # set values — never commit .env
npm run build
npm start
```

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · templates/typescript-stdio/README.md.tmpl (reported line 14)May include surrounding context.

text

```bash
npm install
cp .env.example .env   # set values — never commit .env
npm run build
npm start
```

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · tests/fixtures/api-reference.md (reported line 33)May include surrounding context.

md

### Delete Pet

    DELETE /pets/{petId}

Deletes a pet by ID.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_agent_clients.py (reported line 19)May include surrounding context.

python

self.home = self.root / "home"; self.home.mkdir()
        self.project = self.root / "server"; (self.project / "dist").mkdir(parents=True)
        (self.project / "dist/index.js").write_text("// built\n")
        (self.project / ".env").write_text("TOKEN=real-secret\n")
        (self.home / ".codex").mkdir(); (self.home / ".codex/config.toml").write_text("model='x'\n")
    def tearDown(self) -> None: self.tmp.cleanup()
    def test_spec_is_built_contained_and_secret_free(self) -> None:

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_engine_cli.py (reported line 56)May include surrounding context.

python

(project / "dist/index.js").write_text("// built", encoding="utf-8")
            home = root / "home"; (home / ".cursor").mkdir(parents=True)
            config = home / ".cursor/mcp.json"; config.write_text('{"mcpServers":{}}\n', encoding="utf-8")
            state = root / "state"; env = {**os.environ, "TYPE_MCP_APPROVAL_STATE_DIR": str(state)}
            common = ["--project", str(project), "--home", str(home), "--targets", "cursor", "--server-name", "petstore-mcp"]
            preview = subprocess.run([sys.executable, str(ENTRYPOINT), "install-plan", *common], text=True, capture_output=True, env=env, check=False)
            self.assertEqual(preview.returncode, 0, preview.stderr)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · tests/test_manifest.py (reported line 115)May include surrounding context.

python

"paths": {"/pets": {"get": {"operationId": "getPets", "responses": {"200": {"description": "ok"}}}}},
        }
        with tempfile.TemporaryDirectory() as directory:
            path = Path(directory) / "spec?api_key=descriptor-secret.json"
            path.write_text(json.dumps(document), encoding="utf-8")
            result = subprocess.run(
                [sys.executable, str(ENTRYPOINT), "manifest", "--file", str(path), "--json"],

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_engine_cli.py (reported line 90)May include surrounding context.

python

def run_cli(args: list[str], cwd: Path | None = None, env_extra: dict[str, str] | None = None) -> subprocess.CompletedProcess[str]:
    env = os.environ.copy()
    env["PYTHONIOENCODING"] = "utf-8"
    if env_extra:
        env.update(env_extra)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_generated_project_e2e.py (reported line 37)May include surrounding context.

python

def run_cli(args: list[str], cwd: Path | None = None, env_extra: dict[str, str] | None = None) -> subprocess.CompletedProcess[str]:
    env = os.environ.copy()
    env["PYTHONIOENCODING"] = "utf-8"
    if env_extra:
        env.update(env_extra)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_generated_project_static.py (reported line 29)May include surrounding context.

python

def run_cli(args: list[str], cwd: Path | None = None, env_extra: dict[str, str] | None = None) -> subprocess.CompletedProcess[str]:
    env = os.environ.copy()
    env["PYTHONIOENCODING"] = "utf-8"
    if env_extra:
        env.update(env_extra)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_output_safety.py (reported line 20)May include surrounding context.

python

def run_cli(args: list[str], cwd: Path | None = None, env_extra: dict[str, str] | None = None) -> subprocess.CompletedProcess[str]:
    env = os.environ.copy()
    env["PYTHONIOENCODING"] = "utf-8"
    if env_extra:
        env.update(env_extra)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

Copying the full parent process environment into a child process can unintentionally forward secrets such as API keys, tokens, or CI credentials to the tested CLI. In a code generator skill that processes potentially adversarial API inputs, this broad inheritance is more concerning because any bug in the generator or its dependencies could expose or misuse those credentials.

Content

Scanner excerpt · tests/test_render.py (reported line 23)May include surrounding context.

python

def run_cli(args: list[str], env_extra: dict[str, str] | None = None) -> subprocess.CompletedProcess[str]:
    env = os.environ.copy()
    env["PYTHONIOENCODING"] = "utf-8"
    if env_extra:
        env.update(env_extra)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares significant capabilities in its documentation and workflow, including environment access, filesystem reads/writes, shell execution, and npm/network-dependent verification, but it does not expose an explicit tool-scope or permission boundary in the skill metadata. This increases the risk that an agent or reviewer underestimates what the skill can do, especially because optional install/apply flows mutate user configuration outside the project directory.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_policy.py:13

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: tests/fixtures/petstore.openapi.json:4

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: tests/test_manifest.py:115