Security checks for vulnerabilities and agentic risk
Overview
The skill is read-only in its stated workflow, but its setup instructions ask users to install and run unpinned external MCP code without integrity checks.
Install only if you are comfortable trusting the external Campus Copilot repository or bundle as executed code. Prefer a pinned reviewed commit or signed release, verify checksums, use a frozen lockfile, and run the MCP server with a dedicated low-privilege account or sandbox limited to the specific snapshot inputs and output directory.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T08 · Insecure Dependencies
Error
Location
references/INSTALL.md:11
Finding
Unpinned External Repository and Dependency Execution
Content
View full analysis
Vulnerability Details
File Location: references/INSTALL.md, lines 11-25 Vulnerability Type: Supply-chain risk caused by retrieving, installing, building, and executing unpinned external code Risk Level: High
Vulnerable Code:
bash
git clone https://github.com/xiaojiou176-open/campus-copilot.git
cd campus-copilot
pnpm install
bash
pnpm --filter @campus-copilot/mcp-server build
bash
pnpm --filter @campus-copilot/mcp-server start
Technical Analysis
The installation instructions clone the default branch of an external Git repository without specifying an immutable commit hash or verified signed tag. Consequently, the code installed by an operator can change after this Skill package has been reviewed.
The subsequent pnpm install operation installs third-party dependencies and may execute package lifecycle scripts. The instructions then build and start the retrieved MCP server. These operations execute code from the unpinned repository and its dependency graph with the permissions of the host user.
Although the documentation characterizes the server as read-only, this package does not contain or verify the server implementation. The stated application-level behavior therefore does not enforce operating-system-level restrictions on the external process.
Attack Path
An attacker compromises the upstream repository, its default branch, a maintainer account, or one of its package dependencies.
The attacker inserts malicious code into the MCP server, a build script, or an installation lifecycle script.
An operator follows the documented git clone and pnpm install procedure.
The malicious code executes during dependency installation, the build, or pnpm ... start.
The code receives the permissions and resource access available to the host user and MCP process.
It can potentially access or alter locally available files, environment variables,
...[truncated 701 chars]
Remediation
View remediation
Remediation Suggestions
Pin the repository to a reviewed, immutable commit hash or cryptographically verified signed release:
bash
git clone https://github.com/xiaojiou176-open/campus-copilot.git
cd campus-copilot
git checkout --detach <reviewed-commit-hash>
Verify the checked-out commit or release signature before installing dependencies.
Commit and review the dependency lockfile, then install with:
bash
pnpm install --frozen-lockfile
Disable dependency lifecycle scripts during initial installation where compatible:
bash
pnpm install --frozen-lockfile --ignore-scripts
Any required scripts should be separately reviewed before execution.
Run dependency integrity, provenance, and vulnerability checks before building.
Execute the MCP server in a sandbox or container with a dedicated unprivileged account, a restricted environment, read-only input mounts, a dedicated output directory, and deny-by-default network access.
Do not forward unrelated credentials or environment variables to the MCP process.
Document the exact reviewed repository commit alongside the Skill version so later installations reproduce the audited implementation.
T08 · Insecure Dependencies
Warning
Location
references/INSTALL.md:31
Finding
Unverified MCP Bundle Download
Content
View full analysis
Vulnerability Details
File Location: references/INSTALL.md, lines 31-36 Vulnerability Type: External executable bundle provided without documented integrity or signature verification Risk Level: Medium
Vulnerable Code:
text
## If your host supports MCP Bundles
Campus Copilot also ships a release-hosted MCP bundle:
- registry name: `io.github.xiaojiou176-open/campus-copilot-mcp`
- release asset: `https://github.com/xiaojiou176-open/campus-copilot/releases/download/v0.1.0/campus-copilot-mcp-0.1.0.mcpb`
Technical Analysis
The bundle URL contains a version number, but the instructions do not provide or require verification of a cryptographic checksum, release signature, or trusted provenance attestation. A versioned filename alone does not establish that the downloaded bytes match the artifact reviewed by the publisher.
The contents of the .mcpb bundle are not included in this project, so this audit cannot verify its implementation or integrity. If the release asset, publisher account, distribution channel, or local download is compromised, a host could load modified code while the URL and filename continue to appear legitimate.
Attack Path
An attacker compromises the upstream release account, release asset, distribution path, or another component involved in obtaining the bundle.
The legitimate-looking .mcpb asset is replaced or delivered with attacker-controlled content.
An operator retrieves and loads the bundle without checksum or signature verification.
The host executes the modified MCP implementation.
The malicious bundle operates with the permissions and data access granted to the MCP process.
Impact Assessment
Exploitation could result in code execution within the MCP host’s security context. Potentially exposed resources include student snapshot information, exported artifacts, inherited environment variables, local files accessible to the host,
...[truncated 210 chars]
Remediation
View remediation
Remediation Suggestions
Publish a SHA-256 or stronger checksum for the exact .mcpb release asset.
Require operators to verify the checksum before loading the bundle.
Cryptographically sign the release artifact and document signature verification using a trusted publisher key.
Prefer a registry that supplies immutable content-addressed artifacts and verifiable provenance attestations.
Pin the documentation to the verified artifact digest rather than relying only on the versioned URL.
Run the bundle in a least-privilege sandbox with narrowly scoped filesystem and network access.
Record the verified bundle digest in manifest.yaml so the Skill package and executable dependency can be audited together.
T08 · Insecure Dependencies
Error
Location
references/mcp-setup.md:5
Finding
Unpinned Dependency Installation Repeated in MCP Setup Guide
Content
View full analysis
Vulnerability Details
File Location: references/mcp-setup.md, lines 5-10 Vulnerability Type: Dependency installation and MCP execution without immutable source or lockfile verification requirements Risk Level: High
Vulnerable Code:
bash
From the Campus Copilot repo root:
pnpm install
pnpm --filter @campus-copilot/mcp-server build
pnpm --filter @campus-copilot/mcp-server start
Technical Analysis
This alternate setup guide directs operators to install dependencies, build the MCP package, and execute it without requiring that the repository revision or lockfile correspond to a reviewed version. pnpm install can retrieve mutable third-party packages and may run lifecycle scripts. The build and start commands then execute code from that dependency tree.
The guide assumes the operator is already in the Campus Copilot repository, but it does not require verification of the repository origin, checked-out commit, release signature, or dependency lock state. A compromised or substituted repository can therefore execute attacker-controlled code through the documented workflow.
Attack Path
The operator obtains a compromised, modified, or unintended Campus Copilot repository revision.
Alternatively, a mutable dependency or package maintainer is compromised.
The operator runs pnpm install, allowing dependencies and applicable lifecycle scripts to execute.
The operator builds and starts the MCP server.
Attacker-controlled code executes with the host user’s permissions and the MCP process’s access to local data and network resources.
Impact Assessment
Successful exploitation can yield arbitrary code execution in the host-user context. The attacker could potentially read or modify accessible workspace files, inspect inherited environment variables, access student snapshots supplied to Campus Copilot, or communicate with reachable network services.
The audited guide d
...[truncated 195 chars]
Remediation
View remediation
Remediation Suggestions
State the exact supported repository commit or signed release in this guide.
Require verification of the repository remote and checked-out revision before installation.
Require a reviewed lockfile and use pnpm install --frozen-lockfile.
Avoid lifecycle scripts by default where possible, and explicitly review any script that must run.
Add package integrity and provenance validation to the installation procedure.
Run the server as a dedicated unprivileged user or inside a restricted container.
Limit the process to read-only access to explicitly selected snapshot inputs and a dedicated artifact output directory.
Restrict environment inheritance and outbound network connectivity to the minimum required for documented functionality.
T08 · Insecure Dependencies
Warning
Location
references/mcp-setup.md:13
Finding
Unverified MCP Bundle Reference Repeated in Alternate Setup Guide
Content
View full analysis
Vulnerability Details
File Location: references/mcp-setup.md, lines 13-16 Vulnerability Type: External executable bundle referenced without cryptographic integrity verification Risk Level: Medium
Vulnerable Code:
text
## If the host supports MCP Bundles
- registry name: `io.github.xiaojiou176-open/campus-copilot-mcp`
- release asset: `https://github.com/xiaojiou176-open/campus-copilot/releases/download/v0.1.0/campus-copilot-mcp-0.1.0.mcpb`
Technical Analysis
This setup guide offers a remotely hosted MCP bundle but does not provide a checksum, digital signature, provenance record, or mandatory verification procedure. The artifact is versioned, but versioning alone does not prevent publisher-account compromise, release-asset replacement, or use of an artifact that differs from the reviewed implementation.
Attack Path
An attacker substitutes or compromises the externally hosted MCP bundle.
An operator downloads the bundle using the documented reference.
The operator loads it without verifying its digest or publisher signature.
The MCP host executes attacker-controlled bundle contents.
The bundle accesses resources available under the host’s MCP permission model.
Impact Assessment
A malicious bundle could execute code in the MCP host context and potentially access student data, local files, inherited environment variables, and reachable services. The exact scope depends on host permissions and sandboxing, which are not specified in the audited package.
Remediation
View remediation
Remediation Suggestions
Publish and pin the cryptographic digest of the exact bundle.
Sign the artifact and require signature verification before installation.
Provide reproducible-build or supply-chain provenance metadata.
Reject a downloaded bundle if its digest or signature does not match the reviewed release.
Load the bundle only in a sandbox with least-privilege filesystem, environment, and network permissions.
