github-mpc

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:28 AM UTC
• Version: 1.0.1

Overview

This setup-only skill is coherent, but it asks users to run an unpinned MCP package and use broad GitHub credentials without enough scoping or handling guidance.

Review the GitHub MCP setup before installing. Prefer a pinned, reviewed MCP server version, avoid `npx -y` for automatic mutable package execution, and use a fine-grained or read-only token limited to the exact repositories and organization access needed. Do not put long-lived tokens in shared terminals, committed config, shell profiles, logs, or screenshots; rotate the token if it may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:122

Finding

Unpinned GitHub MCP Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 122–123
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

json

"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-github"],

Technical Analysis

The documented MCP configuration invokes npx with an unversioned npm package. Because no exact version, integrity hash, lockfile, or locally reviewed artifact is specified, the package resolved by the registry can change after the skill has been audited.

The -y option suppresses the normal installation confirmation. Consequently, following the instructions can cause Cursor to download and execute package lifecycle or runtime code without an additional user approval step.

This creates a supply-chain risk: compromise of the package, its maintainer account, a transitive dependency, or the npm delivery channel could replace the expected implementation with attacker-controlled code. The executed MCP process may inherit the local user's permissions and the configured GITHUB_TOKEN.

Attack Path

1. An attacker compromises the named npm package, its publisher account, a dependency, or its distribution channel.
2. The attacker publishes a malicious release under the package version range implicitly selected by the unversioned command.
3. A user copies the documented configuration and starts or restarts Cursor.
4. Cursor invokes npx -y @modelcontextprotocol/server-github.
5. npx retrieves the mutable package selected by the registry and executes it without an installation confirmation.
6. Malicious package code runs with the MCP process's operating-system privileges and can attempt to read inherited credentials, including GITHUB_TOKEN, access files available to the user, or communicate with external systems.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running Cursor. The reachable scope may inc ...[truncated 454 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP package to an exact, reviewed version rather than relying on the registry's current resolution:

   json

   "command": "npx",
   "args": ["@modelcontextprotocol/server-github@X.Y.Z"]
   

2. Remove -y so installation does not silently bypass user confirmation.
3. Prefer a separately installed and reviewed local dependency managed through a committed lockfile.
4. Verify package provenance, publisher identity, release signatures where available, and registry integrity metadata before installation.
5. Use automated dependency scanning and establish a controlled process for reviewing version upgrades.
6. Run the MCP server with restricted filesystem and network access where the platform supports sandboxing.
7. Replace broad classic token scopes with a fine-grained GitHub token limited to the required repositories and read-only operations.
8. Ensure credentials are supplied only to the specific MCP process that needs them and are not exposed to unrelated processes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This instruction directly guides the user to create a GitHub access token with broad repo and read:org scopes and set it via export GITHUB_TOKEN=your_token. That is credential acquisition and handling guidance without safeguards; if copied into insecure environments, shell history, logs, or shared sessions, the token could be exposed and abused for repository and organization data access.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

text

2. **Configure GitHub Token:**
   - Create a Personal Access Token at github.com/settings/tokens
   - Grant `repo` and `read:org` scopes
   - Set as environment variable: `export GITHUB_TOKEN=your_token`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md

**Figma MCP (for UI documentation):**
- Install: `@anthropic/mcp-server-figma`
- Requires Figma access token
- Useful for documenting user-facing features

**Elasticsearch MCP (for log verification):**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill tells users to create a GitHub personal access token and export it in the shell, but it provides no guidance on secure handling, least-privilege scoping, storage, rotation, or avoiding disclosure in shell history and logs. In a setup-oriented skill, this omission can normalize unsafe credential practices and increase the chance of token leakage or overprivileged long-lived credentials.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.