DealWatch Read-only Builder

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.1.1

Overview

This skill is a coherent read-only DealWatch setup guide, but users should understand that it runs a pinned external MCP package from PyPI.

Install only if you intend to use DealWatch and are comfortable running the published `dealwatch==1.0.1` MCP package locally. For stricter environments, review the package source and dependencies, run it in a constrained environment, and remove the saved MCP config when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:29

Finding

Unverified Third-Party Package Is Downloaded and Executed as an MCP Server

Content

View full analysis

Vulnerability Details

File Locations:

• README.md:29-33
• references/INSTALL.md:19-26
• references/mcp-install.md:13-19
• references/mcp-install.md:24-36
• references/mcp-install.md:39-46
• references/OPENHANDS_MCP_CONFIG.json:1-8
• references/OPENCLAW_MCP_CONFIG.json:1-10

Vulnerability Type: Third-party supply-chain execution without local implementation review or artifact integrity verification
Risk Level: Medium

Vulnerable Code

README.md:29-33:

bash

## The shortest install path

Use the published package, not a repo-local checkout:

uvx --from dealwatch==1.0.1 dealwatch-mcp serve

references/INSTALL.md:19-26:

bash

## Smoke check

uvx --from dealwatch==1.0.1 dealwatch-mcp list-tools --json

If that command returns the tool inventory, the published MCP package is wired
correctly.

references/mcp-install.md:13-19:

toml

Add the server to `~/.openhands/config.toml`:

[mcp]
stdio_servers = [
  { name = "dealwatch", command = "uvx", args = ["--from", "dealwatch==1.0.1", "dealwatch-mcp", "serve"] }
]

references/mcp-install.md:24-36:

json

Add the server to your saved MCP server config:

{
  "mcp": {
    "servers": {
      "dealwatch": {
        "command": "uvx",
        "args": ["--from", "dealwatch==1.0.1", "dealwatch-mcp", "serve"]
      }
    }
  }
}

references/mcp-install.md:39-46:

bash

## Smoke check

uvx --from dealwatch==1.0.1 dealwatch-mcp list-tools --json

If that command returns the tool inventory, the published MCP package is wired
correctly.

references/OPENHANDS_MCP_CONFIG.json:1-8:

json

{
  "mcpServers": {
    "dealwatch": {
      "command": "uvx",
      "args": ["--from", "dealwatch==1.0.1", "dealwatch-mcp", "serve"]
    }
  }
}

references/OPENCLAW_MCP_CONFIG.json:1-10:

json

{
  "mcp": {
    "servers": {
      "
...[truncated 3175 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish or vendor the complete MCP implementation and make its source revision traceable to the distributed package artifact.
2. Generate a locked dependency set that includes transitive dependencies and cryptographic hashes. Install only artifacts matching the reviewed lock data.
3. Verify package ownership, release provenance, signatures, and build attestations before recommending execution.
4. Prefer an internally mirrored or otherwise trusted package repository after independently validating the package and all dependencies.
5. Run the MCP server in a dedicated sandbox or container with:
   • a non-privileged service account;
   • a minimal environment with secrets removed;
   • read-only filesystem mounts where possible;
   • access only to explicitly required directories;
   • restricted outbound network access;
   • operating-system resource limits.
6. Review the actual MCP tool schemas and implementation to verify that all advertised operations are read-only and that submitted URLs cannot trigger unsafe internal-network requests.
7. Document the package's required filesystem, environment, and network permissions so operators can enforce least privilege.
8. Treat a successful list-tools response only as a connectivity check, not as proof of package integrity or safe behavior.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases are broad enough to match common, ambiguous user requests such as product comparison or watch-group/task queries that may appear outside the intended DealWatch context. This can cause the skill to activate in unrelated conversations, steering the agent toward package installation or MCP-specific guidance the user did not actually request, increasing the risk of misrouting, confusion, or unsafe tool selection.

Content

No source excerpt is available for this finding.