Local Falcon

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:45 AM UTC
• Version: 0.1.0

Overview

This is a coherent Local Falcon SEO skill, but users should review its MCP setup and install metadata because it can install/run external packages with an API key and trigger billable or account-changing actions.

Review before installing. Prefer a pinned, verified MCP package version, avoid storing the API key directly in broadly readable config files, confirm the marketplace package name before running npm install, and require explicit approval before scans, campaigns, or Falcon Guard changes that may spend credits or alter account state.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:98
• Finding: Unpinned Third-Party MCP Package Is Installed and Executed with an API Credential< - Create or copy your API key - Requires an active Local Falcon subscription **Step 3: Configure Claude Code** Add to your Claude Code MCP settings (usually `~/.config/claude/mcp.json` or similar): ```json { "mcpServers": { "local-falcon": { "command": "npx", "args": ["@local-falcon/mcp"], "env": { "LOCAL_FALCON_API_KEY": "your-api-key-here" } } } } ``` ``` Equivalent unpinned installation or execution guidance also appears in `README.md:84`, `SKILL.md:576`, and `references/mcp-workflows.md:9-21`. ### Technical Analysis The instructions install `@local-falcon/mcp` without an exact version, lockfile, or integrity constraint. The MCP configuration then invokes the package through `npx` without `--no-install` or an explicit local executable path. Consequently, the code ultimately executed can change after this skill has been reviewed. npm packages may execute lifecycle scripts during installation, while an MCP server runs as a local process with the invoking user's operating-system permissions. The configured process also receives `LOCAL_FALCON_API_KEY` in its environment. The MCP implementation is not included in this repository, so its behavior cannot be validated by this audit. Although MCP integration is relevant to live Local Falcon analysis, unrestricted installation and execution of the latest package version exceeds the minimum supply-chain trust necessary. A fixed, audited release would provide the same declared functionality with less risk. ### Attack Path 1. An attacker compromises the npm package, a mainta ...[truncated 1250 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the MCP dependency to a specific reviewed version, for example: ```bash npm install --save-exact @local-falcon/mcp@X.Y.Z ``` 2. Publish and use a lockfile containing npm integrity hashes. 3. Run only the already installed package: ```json { "command": "npx", "args": ["--no-install", "@local-falcon/mcp"] } ``` Prefer an explicit path to the local binary where the host supports it. 4. Verify package provenance, signatures, maintainers, and integrity before recommending a release. 5. Document the MCP server's required filesystem, network, account, and tool permissions. 6. Use a narrowly scoped API key where supported, and avoid reusing credentials across environments. 7. Store credentials through the host's secret-management facility rather than directly in a broadly readable configuration file. 8. Restrict permissions on the MCP configuration file and rotate the key after suspected package or host compromise. 9. Require explicit user confirmation before scans, campaigns, or other operations that consume credits or modify account state. 10. Keep every installation example in `SKILL.md`, `README.md`, and the reference documentation synchronized to the same pinned version. ]]>

T08 · Insecure Dependencies

Warning

• Location: marketplace.json:86
• Finding: Marketplace Metadata References a Different and Unverified npm Package<![CDATA[ ## Vulnerability Details **File Location**: `marketplace.json:86-90` **Vulnerability Type**: Package-name mismatch enabling wrong-package installation **Risk Level**: Medium ### Vulnerable Code ```json "install": { "instructions": "Copy the skill folder to ~/.config/claude/skills/ or .claude/skills/", "npm": "npm install @local-falcon/skill", "manual": "Download SKILL.md and reference files from GitHub" }, ``` The audited project's actual package name is declared in `package.json:2`: ```json "name": "@local-falcon/local-visibility-skill", ``` The README also instructs users to install the latter package: ```bash npm install @local-falcon/local-visibility-skill ``` ### Technical Analysis The marketplace installation metadata references `@local-falcon/skill`, while the audited project identifies itself as `@local-falcon/local-visibility-skill`. These are distinct npm package identifiers. A user or automated marketplace installer relying on `marketplace.json` could therefore retrieve code that is not part of the audited project. If the mismatched package is unrelated, abandoned, or later controlled by an attacker, npm installation can execute its lifecycle scripts with the installing user's privileges. The discrepancy also prevents consumers from reliably associating the installed artifact with the repository they reviewed. ### Attack Path 1. A user or automated agent reads the npm installation command from `marketplace.json`. 2. It executes `npm install @local-falcon/skill`. 3. npm resolves a package different from the audited `@local-falcon/local-visibility-skill`. 4. If the different package is malicious or compromised, its lifecycle scripts execute during installation. 5. The package gains the local access available to the invoking user and can establish additional malicious behavior or collect accessible data. This path is conditional on the mismatched package being malicious or becoming attacker-controlled; the audit did not inspec ...[truncated 466 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the mismatched command with the audited package name and an exact version: ```json "npm": "npm install --save-exact @local-falcon/local-visibility-skill@1.0.1" ``` 2. Verify that the package name, version, repository, and publisher identity agree across `package.json`, `marketplace.json`, `SKILL.md`, and `README.md`. 3. Add automated CI validation that rejects releases when installation metadata differs from `package.json`. 4. Verify ownership and status of `@local-falcon/skill`; deprecate or redirect it if it is an obsolete package under the same publisher's control. 5. Provide lockfile or integrity-verification guidance for automated marketplace installation. 6. Test installation commands in a clean environment before publishing marketplace metadata. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes very broad terms such as "local search," "local rankings," "AI Mode," and "Local Falcon," which can cause the skill to auto-invoke in many unrelated conversations. Over-broad auto-invocation expands the skill's authority and increases the chance that users are steered into this skill unexpectedly, including into setup flows involving external tools and API-key guidance.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 92% confidence
• Finding: The trigger phrase "review velocity" begins with the common built-in command word "review," creating a shadow-command conflict that could cause unintended invocation or interception when users attempt other review-related actions. In an auto-invoked skill, this kind of overlap is especially risky because it can hijack normal command routing and confuse users about which capability is responding.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Step 2: Get a Local Falcon API key**
- Go to [localfalcon.com/api/credentials](https://www.localfalcon.com/api/credentials/)
- Create or copy your API key
- Requires an active Local Falcon subscription

**Step 3: Configure Claude Code**

• Confidence: 83% confidence
• Finding: The skill instructs users to place a long-lived API key in a local MCP configuration file via an environment variable, which creates session-persistence risk if that file is reused, exposed, logged, or committed accidentally. In skill context, this is more dangerous because the content explicitly walks the user through credential acquisition and durable storage, increasing the chance of sensitive secret retention beyond the immediate session.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger list contains broad, generic phrases such as 'local seo', 'ai visibility', 'google business profile', and 'map pack' that are likely to match many ordinary user requests outside the user's explicit intent to invoke this specific skill. Overbroad invocation increases the chance the skill is auto-selected in unrelated contexts, which can cause prompt hijacking of routing, unintended exposure to the skill's instructions, or biased/commercial responses when a neutral answer was expected.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow reference documents tools that can create campaigns, run scans that consume credits, and pause, resume, or remove monitored resources, but it does not prominently warn that these are state-changing and billable actions. In an agent setting, that omission increases the chance that a user or calling system will invoke destructive or costly operations without informed confirmation, leading to unauthorized changes or unexpected charges.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The markdown explicitly suggests the natural-language phrase "Check my Local Falcon account" as something that triggers tool use. While somewhat domain-specific, it is still presented as a free-form trigger without any constraints, negative examples, or clarification about when the skill should or should not activate, which increases the risk of unintended invocation in ordinary conversation about account status.

Static analysis

No suspicious patterns detected.