St Ent Mcp

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:14 AM UTC
• Version: 0.1.2

Overview

This skill is a disclosed 699pic enterprise asset integration, but it can send an enterprise API key to an unrestricted configurable endpoint and may trigger on broad image/video search requests.

Install only if you trust the publisher and control the environment. Before use, set a narrowly scoped SERVICE_API_KEY, verify any mcporter st-mcp registration, and do not set SERVICE_API_BASE_URL to an untrusted or non-HTTPS host. Be aware that generic image/video requests may route through this enterprise service unless the agent confirms intent first.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/openapi.js:4

Finding

API Key Transmission to an Unvalidated Configurable Endpoint

Content

View full analysis

Vulnerability Details

File Location: scripts/openapi.js, lines 4 and 31–36
Vulnerability Type: Unvalidated destination for sensitive credential transmission
Risk Level: Medium

Vulnerable Code

js

const BASE_URL = (process.env.SERVICE_API_BASE_URL || 'https://pre-st-api.699pic.com').replace(/\/+$/, '');

js

const res = await fetch(`${BASE_URL}${path}`, {
  method: 'POST',
  headers: {
    'content-type': 'application/x-www-form-urlencoded',
    'x-api-key': API_KEY,
  },
  body,
});

Technical Analysis

The script reads SERVICE_API_BASE_URL from the process environment without parsing or validating its scheme, hostname, port, or embedded credentials. It then sends SERVICE_API_KEY to that destination in the x-api-key header on every API request.

Credential transmission is necessary for the declared authenticated 699pic integration, and the default destination uses HTTPS. However, allowing an unrestricted override exceeds the minimum privilege necessary for that integration. A mistaken or attacker-controlled environment can redirect requests to an arbitrary server. An http:// endpoint would additionally transmit the API key and request parameters without transport encryption.

The transmitted request body can contain search terms, content or asset identifiers, asset types, years, and download-record query parameters. No evidence of intentional credential theft or a hidden destination was found; the risk arises from insufficient destination validation.

Attack Path

1. An attacker gains influence over the environment used to launch the Skill, such as deployment configuration, shell variables, an automation wrapper, or an untrusted MCP-related setup.
2. The attacker sets SERVICE_API_BASE_URL to a server they control, for example https://attacker.example, or to a plaintext HTTP endpoint.
3. A user or agent invokes a command such as search-photos, check-downloaded, download-asset, or download-records.

...[truncated 975 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse the configured endpoint with new URL() and reject malformed values.
2. Require the https: protocol in production. Permit plaintext HTTP only behind an explicit, disabled-by-default local-development option.
3. Allowlist authorized 699pic hostnames rather than accepting arbitrary destinations.
4. If custom enterprise endpoints are required, maintain an explicit administrator-controlled allowlist and require confirmation before sending credentials to a newly configured host.
5. Reject URLs containing embedded usernames or passwords, unexpected ports, fragments, or other unnecessary components.
6. Disable or strictly validate redirects so the API key cannot be forwarded to another origin.
7. Avoid including the API key, full endpoint, or sensitive response content in error logs.
8. Use a narrowly scoped, revocable API key and rotate it immediately if an untrusted endpoint may have received it.
9. Add automated tests covering malicious values such as http://attacker.example, non-699pic HTTPS hosts, embedded credentials, and redirect responses.

A hardened initialization pattern should validate the destination before any authenticated request is made:

js

const rawBaseUrl =
  process.env.SERVICE_API_BASE_URL || 'https://pre-st-api.699pic.com';
const parsedBaseUrl = new URL(rawBaseUrl);

const allowedHosts = new Set([
  'pre-st-api.699pic.com',
  // Add explicitly approved production hosts here.
]);

if (parsedBaseUrl.protocol !== 'https:') {
  throw new Error('SERVICE_API_BASE_URL must use HTTPS');
}

if (!allowedHosts.has(parsedBaseUrl.hostname)) {
  throw new Error('SERVICE_API_BASE_URL host is not authorized');
}

if (parsedBaseUrl.username || parsedBaseUrl.password) {
  throw new Error('Embedded URL credentials are not allowed');
}

const BASE_URL = parsedBaseUrl.origin;

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to use environment-provided secrets (SERVICE_API_KEY) and make network requests to a local or configurable API endpoint, but it declares no explicit tool scope or permission boundaries. That creates a real risk of unintended secret use or outbound access if the skill is auto-invoked, especially because the base URL can be overridden and local MCP configuration may point to internal services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation text is broad enough to trigger on common image or video search requests, increasing the chance that the skill runs in situations where the user did not specifically intend to access the 699pic enterprise integration. In this skill, over-triggering is more dangerous because execution may consume enterprise credentials, query download history, and contact configurable network endpoints.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/openapi.js:4