ScopeBlind Passport

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 0.4.1

Overview

This is a coherent MCP access-control skill, but it needs Review because its security boundary relies on mutable npm execution and some “safe” policies allow unknown tools by default.

Install only if you are comfortable letting this wrapper mediate your MCP tools. Prefer pinned, locked package versions instead of @latest or unpinned npx; review the generated MCP config before use; use strict or default-deny policies for sensitive servers; verify every exposed tool name is covered; and reserve 24-hour approvals for tools you intentionally trust.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Mutable and Unpinned npm Packages Are Executed Locally

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15-16, with additional unversioned execution references at SKILL.md:47, SKILL.md:64, SKILL.md:72, SKILL.md:105, SKILL.md:237, and SKILL.md:258; corresponding instructions appear at README.md:23, README.md:28, README.md:38, and README.md:62
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

yaml

install: |
  npm install -g protect-mcp@latest @scopeblind/passport@latest

Other unpinned package executions include:

bash

npx @scopeblind/passport wrap --runtime openclaw --config ./openclaw.json --policy email-safe
npx protect-mcp init
npx @veritasacta/verify --self-test

Technical Analysis

The installation procedure explicitly selects the mutable latest release of two npm packages. The documented npx commands also omit exact package versions. Consequently, the code executed by users is not fixed to the version that existed when this skill was audited.

npm packages and their transitive dependencies can execute JavaScript through CLI entry points and installation lifecycle hooks. If a maintainer account, package release process, dependency, or registry resolution path is compromised, a later package version can execute arbitrary code without requiring any modification to this repository.

Global installation increases exposure because the package is installed into the user's global npm environment. No lockfile, integrity digest, vendored dependency, or reproducible verification procedure is supplied by this project.

Attack Path

1. An attacker compromises one of the referenced npm packages, its maintainer account, publishing token, or a transitive dependency.
2. The attacker publishes a malicious release under the version selected by latest, or otherwise causes an unversioned npx command to resolve to malicious package content.
3. A user follows the documented installation, in ...[truncated 921 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest and every unversioned npx invocation with exact, audited package versions.
2. Use project-local dependencies rather than global installation wherever possible.
3. Commit a lockfile generated by a supported npm version and enforce deterministic installation with npm ci.
4. Verify package tarball integrity and provenance before execution. Record expected integrity hashes and validate signed npm provenance where available.
5. Disable lifecycle scripts during dependency retrieval when they are unnecessary, then invoke only reviewed entry points.
6. Audit and pin transitive dependencies, not only the three direct packages.
7. Establish a controlled dependency-upgrade process requiring security review before changing pinned versions or hashes.
8. Document the exact reviewed package versions so users can distinguish audited releases from later mutable releases.

T09 · Insecure Skill Coding Practices

Warning

• Location: policies/email-safe.json:2

Finding

Email-Safe Policy Permits Unrecognized Dangerous Tools by Default

Content

View full analysis

Vulnerability Details

File Location: policies/email-safe.json:2-5
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable code:

json

"tools": {
  "*": {
    "rate_limit": "100/hour"
  },

The policy restricts only selected exact tool names:

json

"send_email": {
  "require_approval": true
},
"send_message": {
  "require_approval": true
},
"reply_email": {
  "require_approval": true
},
"forward_email": {
  "require_approval": true
},
"delete_email": {
  "block": true
},

Technical Analysis

The wildcard rule applies only a rate limit and does not block unrecognized tools or require approval. Restrictions are assigned using an exact-name list, including send_email, send_message, reply_email, forward_email, and delete_email.

A dangerous operation exposed under a different name is therefore governed only by the permissive wildcard rule. Examples could include newly introduced or provider-specific aliases for sending, deleting, archiving, purging, or modifying email. A rate limit limits frequency but does not prevent the first unauthorized action.

This is a fail-open policy design: safety depends on every consequential tool exposed by every wrapped MCP server having a name anticipated by the policy author.

Attack Path

1. A wrapped MCP email server exposes a consequential operation under a name not explicitly listed in the policy.
2. The agent invokes that tool, whether through ordinary planning, misleading content, or an untrusted instruction encountered in data.
3. No exact restrictive rule matches the tool name.
4. The wildcard 100/hour rate limit is applied.
5. The operation is allowed without the approval or blocking behavior intended for equivalent listed tools.

Impact Assessment

Depending on the capabilities of the unlisted tool, an attacker could cause email to be sent, altered, moved, o ...[truncated 456 chars]

Remediation

View remediation

Remediation Suggestions

1. Change the wildcard rule to default-deny unknown tools:

   json

   "*": {
     "block": true
   }
   

2. Explicitly allow only the required read-only email operations and apply suitable rate limits to each.
3. Require approval for every operation that sends data externally or mutates mailbox state.
4. Prefer capability metadata or normalized operation identifiers over raw provider-specific tool names where the policy engine supports them.
5. Maintain explicit mappings for aliases used by each supported email MCP server.
6. Add automated tests proving that unknown tools are denied and that aliases for send, reply, forward, delete, purge, move, and label modification cannot bypass approval.
7. Revalidate the policy whenever an MCP server is upgraded or its exposed tool inventory changes.

T09 · Insecure Skill Coding Practices

Warning

• Location: policies/web-browsing-safe.json:2

Finding

Web-Browsing-Safe Policy Permits Unrecognized Active Tools by Default

Content

View full analysis

Vulnerability Details

File Location: policies/web-browsing-safe.json:2-5
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable code:

json

"tools": {
  "*": {
    "rate_limit": "60/hour"
  },

Only selected exact names receive stronger controls:

json

"fill_form": {
  "require_approval": true
},
"submit_form": {
  "require_approval": true
},
"download_file": {
  "require_approval": true
},
"execute_javascript": {
  "block": true
},
"run_script": {
  "block": true
}

Technical Analysis

The policy blocks or requires approval for a short list of exact tool names, while its wildcard rule allows all other tools subject only to a rate limit. An MCP browser server can expose semantically equivalent capabilities under different names, such as a provider-specific script evaluator, page-action tool, upload operation, navigation-and-submit operation, or generalized browser command.

Such tools would not match fill_form, submit_form, download_file, execute_javascript, or run_script. They would fall through to the permissive wildcard rule. Rate limiting does not mitigate a single high-impact action, such as submitting credentials, executing page-context code, or initiating a download.

Attack Path

1. A wrapped browser MCP server exposes an active or dangerous browser operation under an unlisted name.
2. The agent invokes it, potentially after processing hostile instructions from a web page.
3. The exact-name approval and blocking rules do not match.
4. The wildcard 60/hour rule applies.
5. The operation executes without the intended human approval or prohibition.

Impact Assessment

Exploitation could allow unauthorized form submission, external data transmission, file download, state-changing web requests, or script-like browser actions, depending on the capabilities exposed by the MCP server. This can aff ...[truncated 307 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the permissive wildcard with a default-deny rule.
2. Explicitly allow only required passive browsing and search capabilities.
3. Require approval for all tools that submit data, upload or download files, mutate remote state, or interact with authenticated workflows.
4. Block all script and arbitrary browser-command capabilities using normalized capability classes rather than only exact names.
5. Enumerate and validate the complete tool inventory of each supported browser MCP server during configuration.
6. Add negative tests for unknown names and aliases representing script execution, form submission, file transfer, clicks that cause transactions, and generalized page actions.
7. Fail closed when a server upgrade introduces a tool absent from the reviewed policy.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to execute npx @scopeblind/passport without pinning an exact version, which causes code to be fetched and executed from the registry at install/run time. If the package is compromised, a malicious version is published, or dependency resolution changes unexpectedly, users may execute attacker-controlled code in their local environment or agent stack.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The manual initialization step uses npx protect-mcp init without an exact version, so users will run whatever version npm resolves at that moment. In a security-sensitive tool that generates signing keys and policy defaults, unpinned execution increases supply-chain risk and could lead to malicious initialization behavior or silently altered security settings.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The MCP wrapper example embeds protect-mcp as an unpinned runtime command, meaning every tool-wrapping invocation may depend on an arbitrary latest package version. Because this wrapper sits in front of MCP servers and mediates tool access, compromise or drift here is especially dangerous: it could weaken policies, tamper with receipts, or execute arbitrary code with the agent's privileges.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The example trigger phrases like "What did you do today?", "Show my passport", and "Show my receipts" are broad natural-language prompts that could overlap with ordinary user conversation and unintentionally invoke the skill. In an agent environment, ambiguous invocation can expose activity logs or trigger tool-related behavior when the user did not explicitly intend to use this skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The verification example runs npx @veritasacta/verify --self-test without pinning the package version, again introducing supply-chain execution risk. Although this verifier is less privileged than an MCP wrapper, users still execute downloaded code locally, and a compromised verifier could falsify trust in receipts or run arbitrary commands.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The real-receipt verification command invokes npx @veritasacta/verify receipt.json --key <public-key-hex> without a fixed version, so the trust-validation path itself depends on mutable remote code. This is dangerous because users may believe they are independently verifying receipts while actually trusting whatever current package version the registry serves.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs use of npx @scopeblind/passport wrap without pinning an exact version, which allows whatever package version is current at execution time to be fetched and run. Because npx executes package code, a compromised upstream package, malicious new release, or dependency confusion-style event could lead to arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

npx protect-mcp init runs an unpinned package directly from the registry, creating a supply-chain execution risk at initialization time. Since this command generates keys and local policy files, compromise here could both execute attacker code and poison the trust material the skill relies on.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The command triggers are broad natural-language phrases like 'Show my passport' and 'Prove what you did' with no explicit authorization, environment, or confirmation constraints. In an agent setting, broad triggers can be invoked by untrusted prompt content or ambiguous user messages, causing unintended command execution and disclosure of local operational data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The MCP wrapper configuration executes protect-mcp via npx without a pinned version in a tool path that may be invoked repeatedly during normal agent operation. This increases blast radius because arbitrary code from a changed upstream release could run whenever the wrapped MCP server starts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The enforce-mode example still uses npx protect-mcp without version pinning, so the skill's most security-sensitive path depends on mutable upstream code. An attacker controlling or compromising the package publish chain could subvert policy enforcement or execute arbitrary commands under the agent's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The status command invokes npx protect-mcp without a fixed version, which still creates a supply-chain execution vector even though the operation appears informational. Seemingly harmless status commands are dangerous when they implicitly download and execute code.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill instructs the agent to POST approval-granting requests to a local HTTP service, including an always mode that can persistently allow a tool for 24 hours. Even though the destination is localhost, this is still an externally mediated state-changing network action that can weaken access controls if triggered by prompt injection, spoofed approval text, or mishandled request identifiers/nonces.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

bash

# For one-time approval (scoped to this specific request):
curl -s -X POST http://127.0.0.1:9876/approve -H 'Content-Type: application/json' -d '{"request_id":"REQUEST_ID","tool":"TOOL_NAME","mode":"once","nonce":"NONCE"}'

# For always-allow this tool (session-scoped, 24h TTL):
curl -s -X POST http://127.0.0.1:9876/approve -H 'Content-Type: application/json' -d '{"tool":"TOOL_NAME","mode":"always","nonce":"NONCE"}'

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The receipt verification self-test uses npx @veritasacta/verify without version pinning, exposing users to execution of mutable third-party code during a trust-verification workflow. This undermines the assurance goal of the feature because the verifier itself can change unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The command to obtain the public key via npx protect-mcp status again relies on unpinned code, creating a supply-chain risk in the verification flow. If compromised, this step could misreport key material or perform additional malicious actions locally.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The final receipt verification command executes an unpinned verifier package from npm, which is a direct code execution hazard in a security-critical validation step. This weakens confidence in the attestation process because the validator is not fixed to a reviewed build.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.