T08 · Insecure Dependencies
- Location
SKILL.md:10- Finding
Unverified Remote MCP Service Hosted on a Temporary Tunnel
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:10-11; duplicated inv2.5/SKILL.md:10-11andv2.5/SKILL 2.md:10-11
Vulnerability Type: Untrusted external service dependency
Risk Level: MediumVulnerable Code
text MCP service address: https://syncopated-retractively-anitra.ngrok-free.dev/mcp If the tool is unavailable or the domain expires, tell the user to contact “Xiao Zou” for a new address.The displayed snippet is an English translation of the corresponding source instructions.
Technical Analysis
The skill requires the agent to use an MCP service exposed through an
ngrok-free.devtunnel. Such tunnel addresses are temporary and externally controlled, and the project does not provide server authentication, endpoint ownership verification, certificate pinning, response integrity checks, or a trusted mechanism for distributing replacement endpoints.The skill directs the agent to submit template-search queries and poster slot values to this service. Depending on the design request, those values may include user-provided brand names, account names, dates, campaign details, or other potentially confidential content. The remote service also controls template specifications, generated images, quality-assurance results, and download links returned to the agent.
The instruction to obtain a replacement address informally from a named individual does not provide a verifiable chain of trust. A compromised operator account, malicious replacement address, compromised tunnel, or reassigned endpoint could therefore place an attacker in control of the MCP responses.
No evidence establishes that the current endpoint is malicious. The vulnerability is the absence of controls needed to establish and preserve trust in a mutable external service dependency.
Attack Path
- An attacker compromises the remote service, obtains control of a replacement endpoint, or convinces users to configure an attacker ...[truncated 1350 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the temporary tunnel with a stable endpoint hosted on an organization-owned and access-controlled domain.
- Authenticate the MCP server using scoped credentials and require authenticated, encrypted communication.
- Publish approved endpoint changes through signed, version-controlled configuration rather than informal person-to-person replacement instructions.
- Validate the destination host and reject redirects or connections to endpoints outside an explicit allowlist.
- Define and disclose what user data is transmitted, how it is retained, and who can access it.
- Obtain user consent before transmitting potentially confidential content to the external service.
- Minimize submitted data and avoid sending secrets, credentials, personal data, or unnecessary account information.
- Validate returned download URLs, MIME types, file sizes, and image contents before presenting them as trusted output.
- Add endpoint monitoring, certificate-expiration monitoring, audit logging, and a documented incident-response process.
- Apply the same changes to all duplicated skill files so an insecure copy cannot remain active.