Finally Offline Culture MCP

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:30 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent culture-news MCP integration, but users should understand that subscription and report features send profile and activity data to a remote service.

Install only if you are comfortable adding a remote MCP service and sending it any search terms, category interests, agent display name, subscription status, and reading activity involved in these features. Avoid using sensitive identifiers in the agent name and review or remove the MCP configuration if you no longer want the integration available.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:19

Finding

Unverified Remote MCP Service Exposes Agent Profile and Activity Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19-55
Vulnerability Type: External MCP Trust and Privacy Exposure
Risk Level: Medium

The skill instructs users to connect their agent to a remotely controlled MCP endpoint hosted on a project-specific Supabase domain. The exposed tools accept identifying and preference data and provide access to subscription statistics and reading history.

Complete relevant snippet:

markdown

## Setup

This skill uses a remote MCP server. Add the following to your MCP configuration:

```json
{
  "mcpServers": {
    "finally-offline": {
      "url": "https://yaieomxrayxpvfjxxctg.supabase.co/functions/v1/human-culture-mcp",
      "transport": "http"
    }
  }
}

No API key required for browsing. Subscribe to unlock digest generation.

Available Tools

list_articles

Browse all published articles with optional filters.

• category (optional): Filter by category (fashion, music, sneakers, design, tech)
• limit (optional): Number of articles to return (default 10)

search_articles

Search articles by keyword.

• query (required): Search term

subscribe_agent

Subscribe your agent to Finally Offline.

• agent_name (required): Your agent's display name
• interests (optional): Array of topic interests

generate_digest

Generate a branded HTML newsletter digest.

• categories (optional): Array of categories to include
• limit (optional): Number of articles in digest

get_agent_report

View your subscription stats and reading history.

text

### Technical Analysis

The configured MCP server is hosted on a third-party Supabase project domain rather than the publication domain identified elsewhere in the skill. Invoking its tools can transmit an agent name, interests, search queries, requested categories, and usage metadata to the remote operator. The documented `get_agent_report` capability indicates tha
...[truncated 1799 chars]

Remediation

View remediation

Remediation Suggestions

1. Host the MCP endpoint on the documented publication domain or provide verifiable documentation proving ownership of the Supabase endpoint.
2. Require explicit user confirmation before invoking subscribe_agent or transmitting identifiers, interests, searches, or reading activity.
3. Publish a clear privacy policy describing every transmitted field, its purpose, retention period, sharing policy, and deletion process.
4. Minimize collection by using a random pseudonymous identifier instead of an agent display name and by avoiding persistent query or reading-history storage unless strictly necessary.
5. Provide tools for users to inspect, export, and permanently delete their profiles and activity records.
6. Authenticate the MCP service and validate or pin expected tool names and input schemas so unexpected capability changes are rejected.
7. Restrict MCP client permissions to the minimum required capabilities and review server metadata before each sensitive operation.
8. Treat all newsletter HTML and article content returned by the service as untrusted data. Sanitize HTML before rendering and prevent remote content from being interpreted as agent instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly supports subscribing an agent, generating digests after subscription, and retrieving subscription stats and reading history from a remote MCP service, but it does not warn that agent names, interests, and usage history may be transmitted to and retained by that third party. This can lead to privacy harm, undisclosed profiling, and inappropriate sharing of user-identifying preference data because an operator may invoke these features without informed user consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.