Glin Profanity MCP

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:41 AM UTC
• Version: 1.0.0

Overview

This profanity-moderation skill is coherent, but it asks users to run a mutable npm MCP server and includes user tracking features without enough data-handling guardrails.

Review the npm package and pin a specific trusted version before installing. Use the tracking features only where your moderation policy permits storing user-level history, and confirm where profiles are stored, who can access them, how long they are kept, and how they can be deleted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Third-Party npm Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–25 and 35–38
Vulnerability Type: Unpinned and automatically executed third-party dependency
Risk Level: Medium

Complete Code Snippet:

json

{
  "mcpServers": {
    "glin-profanity": {
      "command": "npx",
      "args": ["-y", "glin-profanity-mcp"]
    }
  }
}

The same configuration is recommended for both Claude Desktop and Cursor.

Technical Analysis

The documented configuration invokes npx with the -y option and references glin-profanity-mcp without an exact version. Consequently, npm can resolve, download, and execute the package version available from the configured registry at invocation time. The -y option suppresses the installation confirmation prompt.

Because the project contains only SKILL.md and does not include the package implementation, lockfile, integrity hash, or vendored artifact, the effective executable code cannot be verified from the audited project. No evidence establishes that the current package is malicious; the vulnerability is the mutable and automatically executed supply-chain boundary.

Attack Path

1. A user copies the documented MCP configuration into Claude Desktop or Cursor.
2. The MCP client starts the configured server by running npx -y glin-profanity-mcp.
3. npx resolves the unpinned package through the user's configured npm registry and may download it without interactive confirmation.
4. If the package, a future release, its maintainer account, or the configured registry is compromised, attacker-controlled package code is returned.
5. The downloaded package executes locally as the user running the MCP client.
6. Malicious code could then act with that user's filesystem, process, and network permissions and access content supplied to the MCP server.

Impact Assessment

Successful supply-chain exploitation would permit arbitrary code execution under the MCP c ...[truncated 517 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version, for example glin-profanity-mcp@X.Y.Z, rather than relying on the latest registry resolution.
2. Remove -y where feasible so an unexpected download is not silently approved.
3. Install the package through a lockfile-controlled deployment process and verify the registry integrity hash before execution.
4. Review the selected package version, including install scripts and transitive dependencies, and repeat the review before upgrading.
5. Prefer a trusted, reproducibly built or vendored artifact whose source and checksum are documented.
6. Run the MCP server with least privilege in a sandbox or restricted account, limiting filesystem, environment-variable, and network access to what profanity detection requires.
7. Document the package version and expected publisher or provenance so substitutions and unexpected updates can be detected.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises user-tracking, moderation-history, and high-risk-user profiling features without any accompanying notice about privacy, consent, retention, access controls, or regulatory obligations. In an AI assistant workflow, this can encourage operators to process and persist potentially sensitive user moderation data without safeguards, increasing the risk of privacy violations, unauthorized profiling, or mishandling of personal data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.