Security audit

Deal Works Mcp

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent with its deal.works purpose, but it exposes money-moving and agent-management tools without strong local confirmation controls, and some install docs can run the wrong or unpinned npm package.

Install only after reviewing the exact package name and pinning a trusted version. Use a dedicated, revocable, least-privilege deal.works API key, disable or avoid mutation tools you do not need, and require human confirmation before transfers, cashouts, escrow funding, agent deployment/funding, marketplace publishing, voting, deal cancellation/completion, or final vault sealing.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

Location: README.md:29
Finding: Inconsistent and Unpinned Package Execution Can Run an Unintended npm Package
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/index.ts:47
Finding: High-Impact Financial and Irreversible Tools Lack Local Authorization and Confirmation Controls
Content: View full analysis
) => Promise> = { // Deal tools deal_list: handleDealTool, deal_create: handleDealTool, deal_get: handleDealTool, deal_action: handleDealTool, deal_search: handleDealTool, deal_timeline: handleDealTool, deal_attachments: handleDealTool, // Fund tools fund_balance: handleFundTool, fund_transfer: handleFundTool, fund_transactions: handleFundTool, fund_escrow: handleFundTool, fund_cashout: handleFundTool, fund_agent_fund: handleFundTool, // Bourse tools bourse_search: handleBourseTool, bourse_get: handleBourseTool, bourse_fork: handleBourseTool, bourse_publish: handleBourseTool, bourse_earnings: handleBourseTool, // Cadre tools cadre_list: handleCadreTool, cadre_deploy: handleCadreTool, cadre_command: handleCadreTool, cadre_health: handleCadreTool, cadre_delegations: handleCadreTool, cadre_sla_violations: handleCadreTool, // Oath tools oath_attest: handleOathTool, oath_verify: handleOathTool, oath_vault_upload: handleOathTool, oath_vault_seal: handleOathTool, oath_trust_tier: handleOathTool, // Parler tools parler_dispute_file: handleParlerTool, parler_dispute_list: handleParlerTool, parler_proposals: handleParlerTool, parler_vote: handle ...[truncated 4396 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/client.ts:102
Finding: User-Controlled Identifiers Are Concatenated into Authenticated Request Paths
Content: View full analysis
( engine: string, path: string, options: { method?: "GET" | "POST" | "PUT" | "DELETE"; body?: unknown; idempotencyKey?: string; } = {} ): Promise> { const { method = "GET", body, idempotencyKey } = options; checkCircuit(engine); const baseUrl = this.baseUrls[engine]; if (!baseUrl) { return { success: false, error: { code: "UNKNOWN_ENGINE", message: `Unknown engine: ${engine}`, retryable: false, }, }; } const url = `${baseUrl}${path}`; const headers: Record = { "Content-Type": "application/json", "User-Agent": "@goettelman/deal-works-mcp/0.1.0", }; if (this.apiKey) { headers["Authorization"] = `Bearer ${this.apiKey}`; } ``` For example, a deal identifier is only required to be non-empty: ```ts const DealGetInputSchema = z.object({ dealId: z.string().min(1), }); ``` It is then inserted directly into the path: ```ts case "deal_get": { const input = DealGetInputSchema.parse(args); return client.fetch("deal", `/deals/${input.dealId}`); } ``` The same pattern is used for state-changing endpoints: ```ts case "deal_action": { const input = DealActionInputSchema.parse(args); return client.fetch("deal", `/deals/${input.dealId}/actions`, { method: "POST", body: { action: input.action, comment: i ...[truncated 2370 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (41)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the underlying skill package performs external web search against api.perplexity.ai while the manifest only frames the skill as deal infrastructure, reviewers and users may not anticipate third-party data egress. Undisclosed outbound access can expose prompts, deal metadata, or business-sensitive research context to an external service outside the expected deal.works domain boundary.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the underlying skill package performs external web search against api.perplexity.ai while the manifest only frames the skill as deal infrastructure, reviewers and users may not anticipate third-party data egress. Undisclosed outbound access can expose prompts, deal metadata, or business-sensitive research context to an external service outside the expected deal.works domain boundary.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the underlying skill package performs external web search against api.perplexity.ai while the manifest only frames the skill as deal infrastructure, reviewers and users may not anticipate third-party data egress. Undisclosed outbound access can expose prompts, deal metadata, or business-sensitive research context to an external service outside the expected deal.works domain boundary.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: If the underlying skill package performs external web search against api.perplexity.ai while the manifest only frames the skill as deal infrastructure, reviewers and users may not anticipate third-party data egress. Undisclosed outbound access can expose prompts, deal metadata, or business-sensitive research context to an external service outside the expected deal.works domain boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill exposes money-moving operations such as fund transfers and cashout as single-step tool calls with no in-code confirmation, policy gate, recipient verification, or transaction-risk interlock. In an agentic setting, a prompt-injected or mistaken workflow could trigger irreversible financial actions using the configured API key, making this especially dangerous given the skill's financial/escrow context.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The vault seal operation defaults to FINAL, and the prompt/tool description notes that final sealing is irreversible, but the code executes it directly without any confirmation or safer default. This makes accidental or adversarial triggering more dangerous because it can permanently finalize document state and interfere with later updates, dispute handling, or evidence management.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to execute the MCP server via npx without pinning an exact package version, which allows whatever version is current at install/run time to be fetched and executed. Because this skill exposes financial operations, escrow, cashout, publishing, and agent deployment capabilities, a compromised or malicious future package version could immediately gain access to high-impact actions and any configured API key.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README advertises numerous high-impact tools such as fund_transfer, fund_cashout, fund_escrow, cadre_deploy, and dispute/voting functions, but does not clearly warn that these actions can move funds, deploy agents, or create irreversible business effects. In an agentic context, presenting these capabilities as ordinary tools and prompts without explicit confirmation requirements increases the risk of unsafe autonomous use, operator misunderstanding, or prompt-driven misuse.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill exposes access to sensitive capabilities via environment variables and networked MCP functionality, but it does not declare any explicit tool scope such as allowed-tools or permissions. That makes it harder for a host or reviewer to enforce least privilege and increases the chance an agent can invoke state-changing or data-accessing operations more broadly than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documents tools for fund transfers, escrow locking, cashout, voting, and agent deployment, but it does not clearly require explicit user confirmation before irreversible or state-changing actions. In an agent setting, this can lead to accidental financial loss, unauthorized on-chain or wallet operations, or unintended deployment and governance actions from ambiguous prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: These prompts instruct an agent to perform sensitive financial and account-affecting actions such as creating deals, checking balances, funding escrow, deploying agents, and filing disputes, but they do not include privacy warnings, transaction-risk notices, or explicit confirmation gates for irreversible/account-impacting steps. In an AI-agent context, operational prompts like this can normalize high-impact actions without adequate user awareness, increasing the risk of accidental fund movement, disclosure of financial/account data, or unintended account changes.
Content: No source excerpt is available for this finding.

Unbounded Resource Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
Content: Scanner excerpt · configs/perplexity-prompts.md (reported line 183)May include surrounding context.
md
| Dispute filing | 4,000-5,000 | sonar-pro | | Full lifecycle | 6,000-8,000 | sonar-reasoning-pro | Perplexity Max subscribers: Unlimited queries. Pro subscribers: Check your quota at perplexity.ai/settings.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Agent deployment and command APIs can create, start, stop, restart, or scale remote agents with real operational and possibly financial consequences, yet the skill provides no explicit disclosure or confirmation barrier in the action path. In an autonomous-agent platform, this raises the risk of prompt-driven unintended changes, service disruption, cost escalation, or deployment of unreviewed skills.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest description scopes the skill to deal infrastructure, escrow, attestations, and autonomous agents. The Academy engine adds browsing courses, enrolling in courses, and tipping course creators, which is a separate learning-platform capability not obviously required to implement that infrastructure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes business-domain infrastructure for deals, escrow, attestations, and agents, but does not mention environment-level credential sourcing or secret handling. This file pulls an API key directly from process.env, which is a broader host-environment access capability than the domain description alone justifies.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The bourse_publish handler performs a POST request containing the full listing payload, including description, content, price, and tags, to the remote marketplace. In this code file there is no confirmation prompt, logging, or warning comment/docstring informing users that their content will be transmitted and published externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code performs a safety-relevant POST request to deploy a new agent and may also allocate funds via fundingAmount, but there is no confirmation prompt, logging, or inline user disclosure around the action. Although the tool description states it deploys an agent, the code itself provides no explicit warning about the side effects of creating resources and optionally funding them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The cadre_command handler issues operational commands including STOP, RESTART, SCALE_UP, and SCALE_DOWN, which can affect availability or system behavior. The file contains no confirmation prompt, logging, or explicit warning near the destructive or service-impacting action, so users may not be adequately informed at execution time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The deal_action handler performs state-changing operations including REJECT, CANCEL, COMPLETE, and ARCHIVE via a POST request, but this file provides no confirmation prompt, warning comment, or user-facing disclosure around those potentially irreversible actions. Because these operations affect deal state and may be destructive, the lack of any visible warning mechanism in the code is a safety concern under the missing-user-warnings rule.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The fund_cashout handler performs a POST to a cashout endpoint with an external destination address, which is a safety-critical and potentially irreversible transfer of assets. In this code region there is no confirmation prompt, user-visible logging, or inline warning comment/documentation describing that funds will be sent externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The fund_agent_fund handler sends a POST request that allocates funds to an agent's wallet, which can materially affect user balances. Although the tool description states its purpose, this execution path contains no confirmation prompt, visible disclosure, or warning about the transfer before it occurs.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The usage example instructs users to run the package directly via npx without pinning a specific version. That causes execution of whatever version is current at install time, increasing supply-chain risk if a future release is compromised, typo-squatted, or unexpectedly changed. In an MCP server context, this is more sensitive because the package exposes many tools and may handle API keys and financial/deal operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The client sends user-controlled query content, optional system prompts, and search filters to Perplexity's third-party API for web search and synthesis. In an agent infrastructure context, those inputs may contain sensitive business data, deal details, or internal research prompts, and this file provides no consent gate, redaction, or policy enforcement before exfiltrating that data externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The escrow-deal prompt explicitly instructs the agent to create a deal, fund escrow for the full amount, and create attestations without any user-facing confirmation, spending warning, or verification checkpoint. In a skill focused on deals and escrow, this is materially risky because prompt execution could drive real financial commitments based only on interpolated user input.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The deploy-agent prompt directs the system to deploy an agent and fund its wallet within a stated budget, but it does not warn the user that this creates resource and spending commitments or require an explicit approval step. Because this skill manages autonomous agents and funding, automatic progression from search to deployment to funding increases the chance of unintended spend or misuse of a malicious or incorrect skill.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/integrations/sonar.ts:225