Security audit

St Ent Mcp Install

Security checks for vulnerabilities and agentic risk

Overview

The skill is clear about installing a 699pic MCP server, but its example installer can pull changed remote code and run it with the user's API key after only a loose review check.

Review the exact upstream commit before installing, pin the checkout to that commit, and avoid running the example script as-is on a normal workstation. Use a container or VM, a least-privilege SERVICE_API_KEY, and avoid administrator privileges; also replace fixed /tmp log paths with a private temporary directory.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install-example.sh:35
Finding: Mutable Remote Repository Is Executed After an Unbound Manual Review
Content: View full analysis
/tmp/st-ent-mcp-smoke.out 2>/tmp/st-ent-mcp-smoke.err & ``` ### Technical Analysis The script clones the current state of a remote repository, or updates an existing checkout with `git pull --ff-only`, and then executes `mcp/server.js`. The preceding `ST_ENT_MCP_REVIEWED=1` check is only a Boolean assertion and is not cryptographically or logically bound to a specific Git commit. Consequently, the revision executed by the script can differ from the revision that was manually audited. A branch update can occur between review and execution, and every later invocation against an existing checkout automatically pulls new code before running it. HTTPS protects the connection in transit but does not ensure that the retrieved revision is the one previously reviewed. This creates a mutable remote code-execution channel. The external repository is outside the audited artifact, so its retrieved contents cannot be considered reviewed merely because this installer was reviewed. ### Attack Path 1. A user reviews revision A of the upstream repository. 2. The user sets `ST_ENT_MCP_REVIEWED=1`, believing the reviewed code will be installed. 3. The upstream default branch is changed to revision B, whether through repository compromise, maintainer account compromise, or an unreviewed update. 4. The installer clones revision B or runs `git pull --ff-only` and updates the checkout to revision B. 5. The script immediately executes `node "$REPO_DIR/mcp/server.js"`. 6. Malicious code in revision B runs with the invoking user's privil ...[truncated 663 chars]
Remediation: View remediation
&2 exit 1 fi ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/install-example.sh:42
Finding: Predictable Shared Temporary Files Permit Symlink-Based File Truncation
Content: View full analysis
/tmp/st-ent-mcp-smoke.out 2>/tmp/st-ent-mcp-smoke.err & ``` ### Technical Analysis The smoke test redirects standard output and standard error to fixed, predictable paths in the shared `/tmp` directory. The shell opens these files with truncation before starting Node.js. On a system where applicable operating-system symlink protections do not prevent the operation, an attacker who can create entries in `/tmp` can pre-create either path as a symbolic link to another file. The redirection may then follow that link and truncate or overwrite the linked target. The files are also shared across concurrent installer runs, resulting in collisions and possible exposure or corruption of diagnostic output. The exploitability of cross-user symlinks can be reduced by platform-specific protections such as Linux protected-symlink settings, but the script does not enforce or verify those protections and is intended to be reusable across environments. ### Attack Path 1. An attacker predicts the fixed path `/tmp/st-ent-mcp-smoke.out` or `/tmp/st-ent-mcp-smoke.err`. 2. Before the installer runs, the attacker creates that path as a symbolic link to a file writable by the victim. 3. The victim invokes the installer. 4. The shell processes the output redirection and follows the symbolic link where platform protections allow it. 5. The target file is truncated and subsequently receives the MCP server's output. ### Impact Assessment The process can corrupt or truncate any file writable by the invoking user and reachable through the crafted link. This can cause loss of user data or corruption of user-owned configuration. If the script is run with elevated privileges and the platform permits the link traversal, the scope can extend to privileged w ...[truncated 226 chars]
Remediation: View remediation
"$SMOKE_OUT" \ 2>"$SMOKE_ERR" & ``` Additionally: - Do not use fixed filenames in a shared temporary directory. - Ensure temporary files are created with restrictive permissions, such as by setting `umask 077`. - Preserve logs only when explicitly requested, and place retained logs in a user-controlled directory with appropriate permissions. - Use a cleanup trap so temporary data is removed on normal exit, errors, and common termination signals. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.