Interactive LeetCode practice

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:00 PM UTC
• Version: 1.0.3

Overview

This skill is a disclosed LeetCode integration that asks for consent before installing its MCP server and before storing LeetCode session cookies locally.

Install only if you trust the named npm package and publisher. Treat the saved LeetCode cookies like account credentials, avoid entering them on shared or untrusted machines, and revoke or rotate your LeetCode session if you suspect the MCP server or local environment was compromised.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unverified Third-Party npm Package Is Downloaded and Executed

Content

View full analysis

= 20. After the user confirms, add to the client's MCP configuration (the exact file varies by client): ```json { "mcpServers": { "leetcode": { "command": "npx", "args": ["-y", "@sperekrestova/interactive-leetcode-mcp@3.1.1"] } } } ``` For Claude Code specifically, you can also run: ```bash claude mcp add --transport stdio leetcode -- npx -y @sperekrestova/interactive-leetcode-mcp@3.1.1 ``` ``` ### Technical Analysis The Skill instructs the user or Agent to execute `npx -y`, which automatically downloads and runs the external npm package `@sperekrestova/interactive-leetcode-mcp`. Pinning the dependency to version `3.1.1` reduces exposure to unexpected future releases, and requiring user confirmation is a meaningful safeguard. However, neither measure verifies the integrity or behavior of the retrieved package. The project contains only `SKILL.md`; the MCP server implementation and its dependency tree are not included in the audited artifact. Consequently, this audit cannot verify the package's implementation, transitive dependencies, network destinations, credential handling, or server-provided MCP prompts. No checksum, signature, lockfile with integrity metadata, reviewed vendored artifact, or execution sandbox is specified. This is especially security-sensitive because the installed MCP server is expected to: - Execute locally with the invoking user's permissions. - Receive LeetCode `csrftoken` and `LEETCODE_SESSION` values during authentication. - Store those credentia ...[truncated 2508 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

The skill declares a dependency on a local file containing active LeetCode session credentials, including csrftoken and LEETCODE_SESSION. Even though this is expected for the skill's authentication feature, access to reusable session cookies is sensitive because any compromise of the MCP server, skill chain, or local environment could enable account takeover or unauthorized submissions.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

clawdbot:
    requires:
      bins: [npx]
      config: [~/.leetcode-mcp/credentials.json]
    credentials:
      stores: ~/.leetcode-mcp/credentials.json
      contents: csrftoken, LEETCODE_SESSION, createdAt timestamp

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This section documents storage of session credentials and their contents, confirming that sensitive authentication material is persisted locally. File mode 0600 helps, but it does not eliminate the core risk that stolen local files or a compromised process can reuse the session cookies to impersonate the user.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

bins: [npx]
      config: [~/.leetcode-mcp/credentials.json]
    credentials:
      stores: ~/.leetcode-mcp/credentials.json
      contents: csrftoken, LEETCODE_SESSION, createdAt timestamp
      permissions: "0600"
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The auth flow instructs the agent to collect and save credential values provided by the user, which involves handling active session cookies. In the context of an AI-driven skill, collecting secrets through conversational or prompt-mediated flows increases exposure risk because secrets may be mishandled, logged, echoed, or accessed by other components.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

## Auth Flow

1. Before auth-sensitive actions → call `check_auth_status`
2. If not authenticated or expired → **ask the user if they want to authenticate.** Explain that this will store LeetCode session cookies locally at `~/.leetcode-mcp/credentials.json` (owner-read/write only). Do not proceed without consent.
3. After consent → invoke `leetcode_authentication_guide` prompt
4. Call `start_leetcode_auth` → the prompt will guide the user through providing credentials → call `save_leetcode_credentials` with the values the user provides
5. On success → retry original action

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

Although the text claims credentials are stored locally with restrictive permissions and not sent to third parties, it still confirms persistent storage of bearer-style session secrets. Such assurances do not remove the risk posed by malware, local compromise, or unsafe downstream tooling that could read the file and act as the user.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

**Always delegate auth guidance to the `leetcode_authentication_guide` prompt.** Do not improvise your own auth instructions — the prompt handles browser-specific guidance, error recovery, and troubleshooting.

**Credential storage:** The MCP server stores credentials locally at `~/.leetcode-mcp/credentials.json` with file permissions `0o600` (owner-read/write only). Only `csrftoken`, `LEETCODE_SESSION`, and a `createdAt` timestamp are stored. Credentials are never transmitted to any third party — they are used exclusively for direct LeetCode API calls. Typical credential lifetime is 7-14 days.

## Submission Language Map

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

## Auth Flow

1. Before auth-sensitive actions → call `check_auth_status`
2. If not authenticated or expired → **ask the user if they want to authenticate.** Explain that this will store LeetCode session cookies locally at `~/.leetcode-mcp/credentials.json` (owner-read/write only). Do not proceed without consent.
3. After consent → invoke `leetcode_authentication_guide` prompt
4. Call `start_leetcode_auth` → the prompt will guide the user through providing credentials → call `save_leetcode_credentials` with the values the user provides
5. On success → retry original action

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 76% confidence

Finding

The skill explicitly persists LeetCode session cookies and reuses them for future authenticated operations, which is a form of session persistence. In this context, persistence is functionally necessary, but it also creates a standing authentication artifact that can be abused later if the local system, MCP server, or related tooling is compromised.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

## Auth Flow

1. Before auth-sensitive actions → call `check_auth_status`
2. If not authenticated or expired → **ask the user if they want to authenticate.** Explain that this will store LeetCode session cookies locally at `~/.leetcode-mcp/credentials.json` (owner-read/write only). Do not proceed without consent.
3. After consent → invoke `leetcode_authentication_guide` prompt
4. Call `start_leetcode_auth` → the prompt will guide the user through providing credentials → call `save_leetcode_credentials` with the values the user provides
5. On success → retry original action

Static analysis

No suspicious patterns detected.