SourceHarbor Watchlist Briefing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:29 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its SourceHarbor briefing purpose, but it asks users to run unpinned external code and lists report-sending/workflow actions beyond a read-only briefing.

Review this before installing. Use a pinned, reviewed SourceHarbor revision or signed release, run the MCP server with minimal permissions, and prefer a read-only SourceHarbor role unless you explicitly intend the agent to send reports or run workflows.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/INSTALL.md:9

Finding

Unpinned External Repository Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: references/INSTALL.md:9-16; references/OPENCLAW_MCP_CONFIG.json:1-10; references/OPENHANDS_MCP_CONFIG.json:1-8
Vulnerability Type: Remote payload retrieval and execution through an unpinned external repository
Risk Level: Medium

Vulnerable Code

references/INSTALL.md:9-16:

bash

git clone https://github.com/xiaojiou176-open/sourceharbor.git
cd sourceharbor

bash

./bin/dev-mcp

references/OPENCLAW_MCP_CONFIG.json:1-10:

json

{
  "mcp": {
    "servers": {
      "sourceharbor": {
        "command": "./bin/dev-mcp",
        "cwd": "/ABSOLUTE/PATH/TO/sourceharbor"
      }
    }
  }
}

references/OPENHANDS_MCP_CONFIG.json:1-8:

json

{
  "mcpServers": {
    "sourceharbor": {
      "command": "./bin/dev-mcp",
      "cwd": "/ABSOLUTE/PATH/TO/sourceharbor"
    }
  }
}

Technical Analysis

The installation procedure clones the mutable default branch of an external GitHub repository and then executes its ./bin/dev-mcp launcher. No immutable commit hash, signed release, checksum, or integrity verification is specified.

The executed program is not included in the audited Skill package. Consequently, its effective behavior cannot be established from this package, and it may change after the Skill has been reviewed. Compromise of the upstream repository, maintainer account, release process, or Git hosting path could replace the launcher or one of its transitive components.

The MCP configuration makes this execution persistent at the configuration level: whenever the host starts the configured SourceHarbor server, it invokes the external repository’s launcher.

Attack Path

1. An attacker compromises the upstream repository or an authorized maintainer account.
2. The attacker modifies the default branch, ./bin/dev-mcp, or code loaded by that launcher.
3. A user follows the documented ...[truncated 907 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository to a reviewed, immutable commit hash rather than cloning and running the default branch.
2. Prefer a signed release artifact and verify its cryptographic signature or published SHA-256 digest before execution.
3. Record the expected repository revision and artifact digest in INSTALL.md.
4. Audit and vendor the minimal MCP launcher and required dependencies into a controlled release where feasible.
5. Configure automated dependency monitoring, but require review before advancing the pinned revision.
6. Run the MCP server in a sandbox or container with a minimal environment, read-only filesystem access where possible, restricted network access, and no unnecessary credentials.
7. Avoid forwarding the host agent’s complete environment to the MCP process.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: references/CAPABILITIES.md:8

Finding

Write-Capable MCP Operations Exceed the Read-Only Briefing Requirement

Content

View full analysis

Vulnerability Details

File Location: references/CAPABILITIES.md:8-14; duplicated in references/capability-map.md:7-13
Vulnerability Type: Excessive tool privileges and failure to enforce least privilege
Risk Level: Low

Vulnerable Code

references/CAPABILITIES.md:8-14:

text

- `sourceharbor.health.get`
- `sourceharbor.retrieval.search`
- `sourceharbor.jobs.get`
- `sourceharbor.jobs.compare`
- `sourceharbor.artifacts.get`
- `sourceharbor.reports.daily_send`
- `sourceharbor.workflows.run`

The same capability list appears in references/capability-map.md:7-13.

Technical Analysis

The declared purpose of the Skill is to retrieve one watchlist, inspect its briefing and evidence, and produce an answer. Health checks, retrieval, job comparison, and artifact reads are consistent with that purpose. By contrast, sourceharbor.reports.daily_send and sourceharbor.workflows.run are state-changing operations capable of sending reports or initiating workflows.

Documentation advises the agent not to drift into unrelated subscription or notification changes, but a natural-language warning is not an access-control boundary. If the connected MCP server exposes all listed operations under the same authorization context, the agent retains capabilities beyond those required for a read-oriented briefing.

Attack Path

1. A SourceHarbor MCP server is connected with report-sending and workflow-execution privileges.
2. The agent receives misleading operator input or untrusted content from a retrieved watchlist, briefing, artifact, or other data source.
3. That content influences the agent to select sourceharbor.reports.daily_send or sourceharbor.workflows.run.
4. The MCP server accepts the request under the connected user’s authorization.
5. A report is delivered or a workflow is executed even though the original task only required retrieval and summarization.

Impact Assessment

Ex ...[truncated 533 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a read-only MCP profile limited to health checks, watchlist and briefing retrieval, evidence search, job comparison, and artifact reads.
2. Remove sourceharbor.reports.daily_send and sourceharbor.workflows.run from this Skill’s default capability map.
3. Place state-changing operations behind a separate MCP server, role, or authorization scope.
4. Require explicit, action-specific user confirmation before sending a report or running a workflow.
5. Display the intended recipients and workflow parameters before confirmation.
6. Enforce authorization server-side rather than relying only on prompt guardrails.
7. Log all state-changing calls with the requesting user, tool arguments, confirmation event, and result.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest trigger list includes "operator question," which overlaps with many ordinary requests and does not clearly distinguish when this skill should activate versus other question-answering skills. The file also does not provide exclusion conditions or negative examples to narrow the trigger scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The capability map authorizes sourceharbor.reports.daily_send and sourceharbor.workflows.run, which are action-oriented operations not required to answer a single operator question with current context and evidence. In an agent setting, exposing these extra capabilities increases the chance of unintended side effects, prompt-induced task expansion, or abuse to send reports or trigger workflows beyond the user's narrow request.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document says the skill should not drift into subscription or notification changes unless the operator changes the task, yet it simultaneously lists capabilities that can send reports and run workflows. This contradiction weakens operational boundaries and can cause an agent to rationalize performing broader actions than intended, especially under ambiguous prompts or adversarial instruction content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The capability map includes sourceharbor.reports.daily_send and sourceharbor.workflows.run, which are action-oriented capabilities not required for answering a single operator question. In an agent skill, advertising broader write/execute surfaces than necessary increases the chance of prompt-induced scope expansion, unintended outbound reporting, or workflow execution from adversarial or ambiguous inputs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document warns not to drift into subscription or notification changes, yet it includes a report-sending action in the relevant capability set. This inconsistency is dangerous because agents often rely on nearby documentation to decide tool usage, and mixed guidance can cause unauthorized message sending or other side effects despite the skill’s stated single-question, current-context purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This is a manifest file, so vague-trigger checks apply. The file describes the skill's purpose and paired files, but it does not define concrete trigger phrases, scope boundaries, or negative examples for invocation, which can make activation conditions ambiguous in systems that rely on manifest metadata.

Content

No source excerpt is available for this finding.