MCP Workflow

• Analyzed: May 11, 2026, 4:23 AM
• Findings: 1
• Version: 1.0.0
• Hash: 973e629650ab64f7cfa911db50b1d701c51cb75985af1ae8e9f1e1b18a15c2f1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a Local File Inclusion (LFI) vulnerability in `scripts/mcp-server.js`. The `ReadResourceRequestSchema` handler for `file://` URIs directly uses the path provided in the URI without any path sanitization, allowing an attacker or compromised agent to read arbitrary files on the filesystem (e.g., `file:///etc/passwd`). While the skill's workflow execution is currently mocked, this LFI vulnerability presents a significant risk for data exfiltration.