ScopeBlind protect-mcp

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:55 AM UTC
• Version: 1.0.0

Overview

This skill has a coherent security-gateway purpose, but it asks users to run mutable npm packages with broad MCP visibility and insufficient privacy/supply-chain safeguards.

Review this before installing. Prefer a pinned, locally installed version with a lockfile instead of @latest or versionless npx, run it in a constrained environment, and decide where logs and signing keys will live before using shadow mode on sensitive MCP traffic.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party npm Packages Are Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12-18, SKILL.md:29-38, and SKILL.md:64-65
Vulnerability Type: Supply-chain risk through mutable, unpinned npm dependencies
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  emoji: 🛡️
  requires:
    bins:
      - npx
    env: []
  install: |
    npm install -g protect-mcp@latest

bash

# Shadow mode — log everything, block nothing
npx protect-mcp -- node your-server.js

# Enforce mode — apply per-tool policies
npx protect-mcp --policy policy.json --enforce -- node your-server.js

# Initialize signing (generates Ed25519 keypair)
npx protect-mcp init

bash

npx @veritasacta/verify receipt.json
npx @veritasacta/verify --self-test

Technical Analysis

The installation instruction explicitly selects the mutable latest release of protect-mcp, while the npx commands do not specify package versions. Consequently, the code executed by future users may differ from the package version that existed when this Skill was reviewed.

Neither an exact version, lockfile, integrity hash, nor audited vendored source is included in the project. npm packages can also execute lifecycle scripts during installation. Global installation further increases exposure because the installed executable is placed in the user's global npm environment rather than being isolated to this project.

This is a supply-chain weakness rather than evidence that either named package is currently malicious. Exploitation would require compromise or malicious publication of a referenced package or one of its transitive dependencies.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or a transitive dependency associated with protect-mcp or @veritasacta/verify.
2. The attacker publishes a malicious release that is selected by the latest tag or by versionless npx resolution.
3. A user ...[truncated 1128 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest and versionless package references with exact, reviewed versions, for example protect-mcp@X.Y.Z and @veritasacta/verify@X.Y.Z.
2. Avoid global installation. Use a project-local dependency declared in package.json and committed lockfile, then invoke the locked binary through a package script.
3. Commit a lockfile generated with a current npm client and verify registry integrity metadata during installation.
4. Review the selected packages and their transitive dependency trees before updating versions.
5. Use an automated dependency-update process that requires security review and test approval before lockfile changes are merged.
6. Disable npm lifecycle scripts where operationally possible, such as with npm ci --ignore-scripts, and explicitly review any scripts that must remain enabled.
7. Run the MCP proxy under a dedicated, least-privileged account or within a constrained container or sandbox. Limit filesystem, environment-variable, credential, and network access.
8. Configure trusted npm registries and scoped-package mappings explicitly, and consider organizational package allowlists or provenance verification.
9. Document a verified package version and integrity digest in SKILL.md so users do not resolve a different artifact at execution time.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The quick-start section advertises shadow mode as 'log everything, block nothing' but does not prominently warn that this may capture all MCP tool-call activity, including sensitive prompts, arguments, file paths, or secrets. In the context of an MCP security gateway, broad logging is expected functionality, but omission of an explicit user warning increases the risk of accidental sensitive-data collection and privacy/compliance violations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The quick-start command invokes npx protect-mcp without pinning a version, causing users to execute whatever package version is current at runtime. This creates a supply-chain risk: a malicious or compromised latest release could execute arbitrary code on the user's system during installation or startup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This example runs npx protect-mcp --policy policy.json --enforce -- node your-server.js without a pinned version. Because the skill is security-sensitive and intended to mediate tool execution, running an unpinned latest package is especially dangerous: a compromised update could subvert or bypass the very protections users expect.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The initialization command npx protect-mcp init is unpinned and may execute arbitrary code from the latest published package. Since this step generates signing keys, compromise here could lead to attacker-controlled key material, fake trust establishment, or exfiltration of generated secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The policy-listing example uses npx protect-mcp policies without version pinning, exposing users to execution of an arbitrary future package release. Even seemingly harmless informational commands can run install hooks or malicious startup logic.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This command references the clinejection policy pack through an unpinned npx protect-mcp invocation. Because the tool is positioned as a security control, unpinned execution undermines trust and could permit a malicious update to silently weaken enforcement or alter bundled policy behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The receipt verification example runs npx @veritasacta/verify receipt.json without a pinned version. Although this is a verifier rather than a gateway, it still executes code obtained at runtime, so a compromised package release could tamper with verification results or execute arbitrary code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The self-test example invokes npx @veritasacta/verify --self-test without version pinning, again relying on whatever package version the registry serves at execution time. In a trust and audit context, this weakens confidence in the verification chain and can expose systems to arbitrary package execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.