Security audit

Movi Review-First Bundle

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Movi MCP purpose, but its install path asks users to run unverified code from a mutable GitHub checkout, so it needs review before use.

Before installing, pin the Movi repository to a reviewed commit or signed release, verify hashes for launcher scripts, prefer `npm ci` with a lockfile, and run the MCP server with minimal workspace, network, and environment access. Treat manifest patch/apply tools as explicit user-approved actions only.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/INSTALL.md:7
Finding: Execution of Unpinned Code from a Mutable Remote Repository
Content: View full analysis
Remediation: View remediation
``` 2. Prefer a signed, immutable release artifact. Publish its expected SHA-256 digest and verify it before extraction or execution. 3. Require a committed dependency lockfile and replace `npm install` with: ```bash npm ci ``` 4. Where feasible, perform the initial dependency installation with lifecycle scripts disabled: ```bash npm ci --ignore-scripts ``` Any lifecycle scripts that are genuinely required should be documented, reviewed, and invoked explicitly afterward. 5. Vendor the executed bootstrap, verification, and MCP launcher scripts into the reviewed package, or publish their exact reviewed hashes so users can verify them before execution. 6. Configure MCP hosts to launch a verified immutable local artifact rather than a script from a mutable repository checkout. 7. Run the server with least privilege in a sandbox or container. Restrict filesystem mounts, environment variables, credentials, and network access to only what the MCP service requires. 8. Document the server's required permissions and data-access boundaries so users can make an informed decision before attaching it to an agent host. 9. Add automated integrity checks that fail closed if the repository revision, dependency lockfile, or launcher-script digest differs from the audited version. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest lists movi as a standalone trigger, which is very short and generic enough to be mentioned in unrelated contexts. The file does not provide exclusion conditions or negative examples to clarify when this trigger should or should not activate.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.