ClawHub
Back to skill

Security audit

OpenTalk2HTML-NotMD MCP Server

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned, but it tells users to run an unpinned external MCP package whose executable is not included in the reviewed artifact.

Review before installing. Prefer a reconciled, exact npm version with a known reviewed package, avoid dynamic `npx` resolution in MCP client startup, and run the server with limited filesystem, environment, and network access. Do not process secrets or regulated data unless you understand where generated HTML and email-ready output will be written or sent.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned npm Package Is Downloaded and Executed Without Confirmation

Content
View full analysis
- Generate, patch, read, and compress HTML pages for reports, dashboards, and docs — AI talks to you through beautiful pages, not markdown dumps. 18 tools, 22 components, 25+ templates with sub-second patch times. published_date: '2026-05-21' version: '1.1.0' ``` However, `references/package.json:1-4` identifies a different version: ```json { "name": "@aimino/opentalk2html-notmd", "version": "0.1.2", "description": "OpenTalk2HTML-NotMD MCP Server — AI talks to you through beautiful HTML pages instead of overwhelming markdown dumps. Five-tier architecture with 18 tools, 22 components, 25+ templates.", ``` `references/server.json:6-13` also identifies version `0.1.2`: ```json "version": "0.1.2", "packages": [ { "registryType": "npm", "identifier": "@aimino/opentalk2html-notmd", "version": "0.1.2", "transport": { "type": "stdio" } ``` ### Technical Analysis The documented launch command uses `npx -y` with no exact package version. When invoked, npm resolves and downloads the package version available from the registry at execution time. The `-y` option suppresses the interactive installation confirmation. ...[truncated 2517 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (31)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to launch an MCP server via npx -y @aimino/opentalk2html-notmd without pinning an exact package version. That causes the latest published package to be fetched and executed at runtime, creating a supply-chain risk where a compromised maintainer account, malicious update, or dependency hijack could lead to arbitrary code execution on the host running the MCP client.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The Claude Code example again uses npx -y @aimino/opentalk2html-notmd without a pinned version, so each install/use path pulls and executes whatever version is current at the time. In the MCP context this is especially risky because the server typically gains access to local files and agent workflows, amplifying the impact of a malicious package update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill advertises email/inbox functionality (render_email, html_to_email) without any privacy, data-handling, or transmission warning. That omission is risky because users may pass sensitive report or dashboard content through tooling that could generate outbound email artifacts or integrate with delivery paths, creating accidental disclosure risks.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to execute the MCP server via npx -y @aimino/opentalk2html-notmd without pinning an exact package version. That causes installs to resolve to the latest published release at runtime, creating a supply-chain risk where a compromised maintainer account, malicious update, or dependency hijack could silently change the code executed by users and their AI tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The MCP client configuration again references the server package without a pinned version, so every fresh setup may fetch whatever version is current at that moment. In the MCP context this is especially relevant because the installed server can read, write, transform, and email content on behalf of an agent, increasing the blast radius of a malicious package update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README advertises file-writing and email-related capabilities such as write_raw_html, render_email, and html_to_email without any visible warning about privacy, outbound data flow, or the need for user approval before writing or sending content. In an agent-integrated server, this can normalize sensitive-data handling and make accidental exfiltration, unsafe file writes, or unintended email generation more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The workflow examples normalize writing to /tmp/report.html and patching local HTML files but do not warn that the MCP server can create and modify files on the local system. In an agent setting, missing disclosure of file-write capability can lead users to grant trust too broadly, increasing the chance of unintended overwrites, persistence of sensitive content, or misuse through prompt-driven actions.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/LICENSE (reported line 594)May include surrounding context.

text
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/LICENSE (reported line 606)May include surrounding context.

text
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The description states that the AI 'talks to you through beautiful HTML pages instead of overwhelming markdown dumps,' which is a natural-language instruction favoring a specific output format by default. This can be a policy concern if the skill forces a presentation format without user opt-in or a documented, context-specific justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · references/package.json (reported line 55)May include surrounding context.

json
"prepublishOnly": "npm run clean && npm run build"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.11.0",
    "dompurify": "^3.2.0",
    "dot": "^1.1.3",
    "html-minifier-terser": "^7.2.0",

Unverifiable Dependency: @modelcontextprotocol/sdk has 3 known advisory(ies) (CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport); CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
80% confidence
Finding

The manifest declares @modelcontextprotocol/sdk with a loose semver range while the package has multiple known advisories. Because this project is an MCP server, that dependency is security-relevant in context, and failing to pin or document a known-safe minimum version makes it impossible to verify whether installs are exposed to issues like cross-client data leakage, ReDoS, or missing DNS rebinding protections.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · references/package.json (reported line 56)May include surrounding context.

json
},
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.11.0",
    "dompurify": "^3.2.0",
    "dot": "^1.1.3",
    "html-minifier-terser": "^7.2.0",
    "js-beautify": "^1.15.0",

Unverifiable Dependency: dompurify has 16 known advisory(ies) (CVE-2026-65903 (DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit eva); CVE-2026-75838 (DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing X); CVE-2020-26870 (Cross-site Scripting in dompurify) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
84% confidence
Finding

dompurify is a core security control for any project generating or sanitizing HTML, and this package explicitly centers HTML output. Leaving dompurify unpinned while the package has multiple historical XSS-related advisories materially increases risk because consumers cannot verify whether the installed version actually protects against known bypasses.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · references/package.json (reported line 57)May include surrounding context.

json
"dependencies": {
    "@modelcontextprotocol/sdk": "^1.11.0",
    "dompurify": "^3.2.0",
    "dot": "^1.1.3",
    "html-minifier-terser": "^7.2.0",
    "js-beautify": "^1.15.0",
    "jsdom": "^25.0.0",

Unverifiable Dependency: dot has 2 known advisory(ies) (CVE-2020-8141 (Improper Control of Generation of Code in doT); GHSA-4859-gpc7-4j66 (Command Injection in dot)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
82% confidence
Finding

The project depends on doT for templating, and that package has known advisories including code-generation and command-injection concerns. In an HTML template-generation server, a loose version range without proof of a patched resolved version creates a meaningful supply-chain and code-execution risk if unsafe releases are installed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · references/package.json (reported line 58)May include surrounding context.

json
"@modelcontextprotocol/sdk": "^1.11.0",
    "dompurify": "^3.2.0",
    "dot": "^1.1.3",
    "html-minifier-terser": "^7.2.0",
    "js-beautify": "^1.15.0",
    "jsdom": "^25.0.0",
    "parse5": "^8.0.1",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · references/package.json (reported line 59)May include surrounding context.

json
"dompurify": "^3.2.0",
    "dot": "^1.1.3",
    "html-minifier-terser": "^7.2.0",
    "js-beautify": "^1.15.0",
    "jsdom": "^25.0.0",
    "parse5": "^8.0.1",
    "zod": "^3.24.0"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · references/package.json (reported line 60)May include surrounding context.

json
"dot": "^1.1.3",
    "html-minifier-terser": "^7.2.0",
    "js-beautify": "^1.15.0",
    "jsdom": "^25.0.0",
    "parse5": "^8.0.1",
    "zod": "^3.24.0"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · references/package.json (reported line 61)May include surrounding context.

json
"html-minifier-terser": "^7.2.0",
    "js-beautify": "^1.15.0",
    "jsdom": "^25.0.0",
    "parse5": "^8.0.1",
    "zod": "^3.24.0"
  },
  "devDependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · references/package.json (reported line 62)May include surrounding context.

json
"js-beautify": "^1.15.0",
    "jsdom": "^25.0.0",
    "parse5": "^8.0.1",
    "zod": "^3.24.0"
  },
  "devDependencies": {
    "@types/dompurify": "^3.0.0",

Unverifiable Dependency: zod has 1 known advisory(ies) (CVE-2023-4316 (Zod denial of service vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
74% confidence
Finding

zod has a known denial-of-service advisory history, and this package likely uses it for validating MCP inputs or internal schemas. A loose version specification means the security posture cannot be verified from the manifest, and malformed attacker-controlled input could potentially trigger resource exhaustion if an affected version is installed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · references/package.json (reported line 65)May include surrounding context.

json
"zod": "^3.24.0"
  },
  "devDependencies": {
    "@types/dompurify": "^3.0.0",
    "@types/dot": "^1.1.0",
    "@types/js-beautify": "^1.14.0",
    "@types/jsdom": "^28.0.3",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · references/package.json (reported line 66)May include surrounding context.

json
},
  "devDependencies": {
    "@types/dompurify": "^3.0.0",
    "@types/dot": "^1.1.0",
    "@types/js-beautify": "^1.14.0",
    "@types/jsdom": "^28.0.3",
    "@types/node": "^22.0.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · references/package.json (reported line 67)May include surrounding context.

json
"devDependencies": {
    "@types/dompurify": "^3.0.0",
    "@types/dot": "^1.1.0",
    "@types/js-beautify": "^1.14.0",
    "@types/jsdom": "^28.0.3",
    "@types/node": "^22.0.0",
    "@types/parse5": "^6.0.3",