Skills Indec MCP

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:11 AM UTC
• Version: 1.0.1

Overview

The skill's directory-search purpose is coherent, but it runs an unpinned external npm MCP server whose reviewed behavior can change after installation.

Install only if you are comfortable running an npm-delivered local MCP server. Prefer pinning skillsindex-mcp to a reviewed exact version, checking the npm package/source provenance, and running the MCP host with minimal filesystem, environment, credential, and network access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.json:13

Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: skill.json:13-23; also documented in SKILL.md:89-97
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

skill.json:13-23:

json

"install": {
  "type": "npx",
  "package": "skillsindex-mcp",
  "command": "npx",
  "args": ["skillsindex-mcp"]
},
"config": {
  "mcpServers": {
    "skillsindex": {
      "command": "npx",
      "args": ["skillsindex-mcp"]
    }
  }
}

SKILL.md:89-97:

json

{
  "mcpServers": {
    "skillsindex": {
      "command": "npx",
      "args": ["skillsindex-mcp"]
    }
  }
}

Technical Analysis

The configuration invokes npx skillsindex-mcp without specifying an exact package version or verifying an integrity digest. Consequently, package resolution can retrieve and execute whatever version the npm registry currently associates with the package name.

The audited artifact contains only documentation and configuration; it does not contain the package's executable source, a lockfile, or an integrity record. Therefore, statements in SKILL.md claiming that the runtime does not read local files, environment variables, or system data cannot be independently verified from this artifact. The effective executable payload can also change after this Skill has been reviewed without requiring any modification to the reviewed files.

This is a supply-chain trust issue rather than evidence that the currently published package is malicious. Exploitation would require compromise of the package, its publisher account, the package distribution channel, or another mechanism capable of influencing npm package resolution.

Attack Path

1. An attacker compromises the skillsindex-mcp npm publisher account, package, or relevant distribution infrastructure.
2. The attacker publishes a modified release under the same package name.
3. A user or MCP host loa ...[truncated 1178 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically audited version, for example by replacing the unversioned package reference with skillsindex-mcp@<exact-version>.
2. Use a lockfile and verify the package archive against an expected cryptographic integrity value before execution.
3. Prefer installing from a controlled, reviewed dependency manifest rather than allowing npx to resolve and download the package dynamically on every invocation.
4. Vendor the reviewed source or compiled artifact into the project when feasible so the runtime implementation is included within the audit boundary.
5. Automate package provenance, signature, publisher, and integrity verification in the release process.
6. Run the MCP server in a sandbox with minimal filesystem access, a restricted environment, no unnecessary credentials, and an outbound-network allowlist limited to documented endpoints.
7. Review the exact packaged npm artifact—not only the linked repository—to verify that the distributed JavaScript matches the claimed source.
8. Update both skill.json and the installation example in SKILL.md so users consistently execute the pinned, verified release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to run an MCP server via npx skillsindex-mcp without pinning an exact package version or integrity hash. This creates a supply-chain risk: a later malicious or compromised npm release could be fetched and executed automatically in the local agent environment, and the danger is increased because MCP servers run as local code with access to agent I/O and can make network requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.