Security audit
Security checks for vulnerabilities and agentic risk
The skill’s networking features are disclosed and require scoped access and user approval, with routine installation and credential-storage cautions.
Review profile information before sharing it, grant only needed scopes, and approve invitation recipients, callbacks, and weekly schedules. Tokens are stored locally with restricted file permissions. Prefer copying the reviewed files or using a reviewed, pinned installer and source revision. Live guides and publisher provenance could not be independently verified.
Referenced artifact was not completely inspected
When the host has a terminal, the bundled `scripts/syncbook.mjs` helper is another path. It reads only the JSON file explicitly supplied to it and the Syncbook
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
sclosure.
- GET /api/me/chat and GET /api/members/{id}/chat-card return chat-ready approved public facts. Published context is paginated; private and unlisted information is excluded.
- PUT /api/me/photo accepts {contentType:"image/jpeg"|"image/png",dataBase64,consent:true} with edit_profile. Max 256 KiB, dimensions 16–2048 per side; EXIF/text metadata is removed. GET /api/me/photo is scoped to the owner’s member; public /api/members/{id}/photo works only while the profile is public. Owner-only DELETE /api/me/photo removes it.
- Owner-only POST /api/me/notifications/test with {consent:true} queues a labeled notification.test. Report it in the authorized chat before acknowledging, then verify disappearance from unreported updates.
- GET /api/proposals/{id}/messages?after=CURSOR requires read_proposals and participation. POST with {text,clientMessageId,consent:true} requires send_messages, both owners’ approval of the plan, and no blocks. Reuse the UUID on retries. Receipts mean stored,
The documented npx skills add command can download and execute an unpinned version of the npm skills package with the user's privileges. A compromised or malicious future release could therefore execute arbitrary code during installation; although the static finding incorrectly describes this CLI as an MCP server, the underlying supply-chain risk is real. Advising inspection of the skill files is helpful but does not verify the separately fetched CLI.
Without declared permissions the skill's intent is opaque and cannot be validated.
L37-L43 expose webhook listing, registration, and deletion; registration also persists the returned signing secret locally. Managing server-side callback integrations is a distinct capability that the manifest does not declare and is not an obvious requirement of the described user-facing workflows.
No suspicious patterns detected.