Prompt Switchboard Compare Workflows

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:24 AM UTC
• Version: 1.1.1

Overview

This skill is coherent for setting up a local browser comparison workflow, but it asks users to install and run an unpinned external MCP server that can change after review.

Review before installing. Only proceed if you trust the external Prompt Switchboard repository, are comfortable running its npm scripts locally, and can limit the MCP process's file, environment, and browser-tab access. Prefer a pinned reviewed commit, npm ci from a lockfile, and a host config that points only to that verified checkout.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/INSTALL.md:14

Finding

Unpinned Remote Repository and Dependencies Are Installed and Executed as an MCP Server

Content

View full analysis

Vulnerability Details

File Location: references/INSTALL.md:7, 14-25; references/OPENHANDS_MCP_CONFIG.json:4-9; references/OPENCLAW_MCP_CONFIG.json:5-10
Vulnerability Type: Mutable remote payload retrieval and insecure dependency installation
Risk Level: Medium

Vulnerable Code

references/INSTALL.md:7

markdown

- a local clone of `https://github.com/xiaojiou176-open/multi-ai-sidepanel`

references/INSTALL.md:14-17

bash

git clone https://github.com/xiaojiou176-open/multi-ai-sidepanel.git
cd multi-ai-sidepanel
npm install

references/INSTALL.md:24-25

bash

npm --prefix /absolute/path/to/multi-ai-sidepanel run mcp:server

references/OPENHANDS_MCP_CONFIG.json:4-9

json

"command": "npm",
"args": [
  "--prefix",
  "/absolute/path/to/multi-ai-sidepanel",
  "run",
  "mcp:server"
]

references/OPENCLAW_MCP_CONFIG.json:5-10

json

"command": "npm",
"args": [
  "--prefix",
  "/absolute/path/to/multi-ai-sidepanel",
  "run",
  "mcp:server"
]

Technical Analysis

The installation procedure clones the default branch of an external Git repository without selecting an immutable commit or verifying a cryptographic digest or signed release. Consequently, the code installed by a user can differ from the code reviewed when this Skill package was audited.

The subsequent npm install operation installs dependencies defined by that external repository and may execute npm lifecycle scripts. The external repository, its lockfile, dependency graph, and lifecycle scripts are not included in the audited package, so their integrity and behavior cannot be verified from this artifact.

Finally, the supplied host configurations launch the repository-owned mcp:server script using npm. This gives the remotely obtained code an ongoing MCP trust relationship with OpenHands or OpenClaw. The documented workflow also connects the server to ...[truncated 2006 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository to immutable source

   • Document a reviewed commit SHA or cryptographically signed release tag.
   • Clone and check out that exact revision rather than using the mutable default branch.
   • Verify that the checked-out commit equals the documented value before installation.

   bash

   git clone https://github.com/xiaojiou176-open/multi-ai-sidepanel.git
   cd multi-ai-sidepanel
   git checkout --detach EXPECTED_COMMIT_SHA
   test "$(git rev-parse HEAD)" = "EXPECTED_COMMIT_SHA"
   

2. Add integrity and provenance verification

   • Publish the expected commit SHA and release-artifact checksum in the Skill package.
   • Prefer signed releases and document the trusted signing identity.
   • Fail installation if signature or checksum verification does not succeed.

3. Use deterministic dependency installation

   • Require a reviewed lockfile from the pinned revision.
   • Replace npm install with npm ci so dependency versions cannot be rewritten during installation.
   • Run dependency audits and review all direct and transitive packages before approving a new pinned revision.

4. Control npm lifecycle scripts

   • Inspect package.json and dependency lifecycle scripts before execution.
   • Where compatible, initially install using npm ci --ignore-scripts.
   • Explicitly execute only scripts that have been reviewed and are required for operation.

5. Apply least privilege to the MCP process

   • Run the server under a dedicated low-privilege account or sandbox.
   • Restrict filesystem access, inherited environment variables, and outbound network destinations.
   • Do not expose unrelated credentials or secrets to the MCP host process.

6. Document and constrain browser-bridge permissions

   • Specify which tabs, session records, and browser data the bridge can access.
   • Require explicit user confirmation before transmit ...[truncated 477 chars]

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill directs the agent to read install/config files and launch a local MCP sidecar, but it does not explicitly require informed user consent before making local system changes or starting a local server process. In an agent setting, this can lead to unexpected code execution, configuration changes, or expansion of the local attack surface, especially if the referenced files later contain unsafe commands or overly broad permissions.

Content

No source excerpt is available for this finding.