📦

Audit History

MCP Integration - 9 audits

Version comparison

Capability and finding changes across audited versions, newest first.

Version	Date	Result	Review items	Change vs previous
v9 Latest	Jul 19, 2026, 09:39 AM	5 confirmed	1	No capability change
v8	Jul 8, 2026, 01:43 AM	No confirmed findings	0	No capability change
v7	Jul 5, 2026, 09:05 AM	No confirmed findings	0	Filesystem access
v6	Jun 29, 2026, 01:13 PM	1 confirmed	4	Filesystem access
v5	Jan 17, 2026, 01:55 AM	No confirmed findings	0	No capability change
v4	Jan 17, 2026, 01:55 AM	No confirmed findings	0	Network accessEnv variablesExternal commands
v3	Jan 7, 2026, 01:23 AM	No confirmed findings	0	No capability change
v2	Jan 7, 2026, 01:23 AM	No confirmed findings	0	No capability change
v1	Jan 7, 2026, 01:23 AM	No confirmed findings	0	Baseline

Audit version 9 Latest

Jul 19, 2026, 09:39 AM

Most static alerts are false positives caused by Markdown fences, placeholders, example URLs, and documented authentication patterns. The audit confirms unsafe `.env` loading guidance that can execute file contents. Additional risks include unpinned package execution, broad filesystem access, unrestricted autonomous tools, and secret-printing troubleshooting.

Files scanned

2,249

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (5)

High

references/authentication.md:223

Environment file access

Load with: \`source .env\` or \`export $(cat .env | xargs)\`

The guide recommends loading `.env` with `source`, which executes the file as shell code. A modified or untrusted environment file can run arbitrary commands.

High

references/tool-usage.md:124-155

Unrestricted Autonomous MCP Tool Access

The guide states that agents can use any MCP tool without pre-approval. State-changing tools could modify or delete external data without confirmation.

The guide explicitly says agents need no allowlist and can use every tool Claude considers necessary. No approval boundary for state-changing operations is provided.

Medium

examples/stdio-server.json:4-5 references/server-types.md:50-52 SKILL.md:74-76

Unpinned Package Execution

Examples run unpinned NPM MCP packages through `npx -y`. Package drift or registry compromise could execute changed code without review.

Three examples use `npx -y` without a version. This automatically accepts and executes whichever package version the registry resolves.

Medium

examples/stdio-server.json:3-5

Broad Project Filesystem Access

The filesystem example grants the MCP server the entire project directory. This can expose source, credentials, and configuration beyond the task.

The filesystem server receives `${CLAUDE_PROJECT_DIR}` as its allowed root. That scope covers the complete project rather than a task-specific directory.

Medium

references/authentication.md:364-370

Secret Exposure During Troubleshooting

The troubleshooting example prints the complete API token to the terminal. Tokens can enter transcripts, logs, screen recordings, or shared support output.

The example runs `echo $API_TOKEN`, which displays the full credential. This directly conflicts with the guide's instruction not to log tokens.

Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

references/authentication.md:223

Shell command substitution

Load with: \`source .env\` or \`export $(cat .env | xargs)\`

The guide recommends `export $(cat .env | xargs)`, which performs command substitution and unsafe word splitting on file contents. Crafted values can alter arguments or trigger unintended shell behavior.

Risk Factors

🌐 Network access (37)

🔑 Env variables (22)

⚙️ External commands (50)

Audited by: codex

Audit version 8

Jul 8, 2026, 01:43 AM

All static findings were adjudicated as documentation or example configuration, not executable behavior. The reviewed files mention URLs, environment variable placeholders, and shell snippets, but no automatic command execution, credential exfiltration, or prompt injection text was found.

Files scanned

2,249

Lines analyzed

Review items

False positives ignored

Risk Factors

🌐 Network access (37)

🔑 Env variables (22)

⚙️ External commands (84)

Audited by: codex

Audit version 7

Jul 5, 2026, 09:05 AM

The static findings are expected documentation examples for MCP endpoints, environment-variable placeholders, and shell snippets. They do not execute code, include live secrets, or show data-exfiltration intent. No prompt injection attempts or hidden malicious instructions were found in the reviewed files.

Files scanned

2,249

Lines analyzed

Review items

False positives ignored

Risk Factors

🌐 Network access (37)

🔑 Env variables (22)

⚙️ External commands (84)

Audited by: codex

Audit version 6

Jun 29, 2026, 01:13 PM

Static analysis reported a critical combination of command execution, network access, and credential handling, but review found these patterns in documentation and example MCP configuration, not concealed executable code. The skill is not malicious, but it legitimately teaches users to start local processes, connect to remote MCP endpoints, and pass credentials through environment variables, so publication should include a security warning.

Files scanned

2,249

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Low

references/tool-usage.md:76-84 SKILL.md:213-222 SKILL.md:365-376

Wildcard MCP Tool Allow Lists Require Care

The documentation shows wildcard MCP tool allow lists but also warns to use them sparingly and prefer specific tools. Wildcards can grant broader access than needed if copied without review.

The risk is real but mitigated by adjacent cautionary guidance. It remains a low concern because users may copy permissive patterns into plugins.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:44-54 references/server-types.md:13-20 examples/stdio-server.json:3-7

Local MCP Server Process Execution

The skill documents stdio MCP servers that run local commands such as npx, Python modules, and plugin-bundled server paths. This is expected for MCP integration, but unsafe command paths or untrusted packages could execute code on the user machine.

The configuration explicitly launches local MCP server processes. The pattern is legitimate for MCP, but it is a real execution surface if users copy unsafe commands or packages.

Medium

examples/http-server.json:3-17 examples/sse-server.json:3-15 references/server-types.md:204-230

Remote MCP Endpoint Connections

The examples and references configure SSE and HTTP MCP servers over remote URLs with authorization headers. This is normal MCP behavior, but endpoints can receive tool requests and credentials if users configure untrusted services.

The network behavior is directly shown in MCP examples and documentation. It is not malicious by itself, but endpoint trust is central to safe use.

Medium

examples/stdio-server.json:12-23 references/authentication.md:179-189 references/authentication.md:500-517

Credential Forwarding Through Environment Variables

The skill instructs users to pass database URLs, API keys, passwords, and bearer tokens into MCP server configuration. The values are placeholders, not hardcoded secrets, but configured servers can access those credentials.

The references clearly pass credential-like environment variables and headers to MCP servers. The examples use placeholders, so this is an operational risk rather than evidence of credential theft.

Low

examples/http-server.json:5-14 examples/sse-server.json:5-13 SKILL.md:533-536

Hardcoded Example URLs Are Documentation Placeholders

Static analysis flagged hardcoded URLs in examples and references. Review found example.com, hosted MCP service examples, and documentation links, not hidden exfiltration endpoints.

The cited URLs are visible instructional examples and official documentation references. No evidence found that the skill itself sends data to those URLs.

Static false positives ignored (1)

These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.

Low

references/tool-usage.md:39 references/tool-usage.md:50 SKILL.md:3

Weak Crypto Static Matches Are False Positives

Static analysis flagged weak cryptographic algorithm patterns in tool-usage.md and SKILL.md. Review found those matches in ordinary documentation words and examples, not crypto API calls.

The reviewed locations contain text such as descriptions or metadata, not MD5, DES, or other weak algorithm usage. This is a scanner token collision.

Risk Factors

🌐 Network access (4)

examples/http-server.json:5-8 examples/sse-server.json:4-13 SKILL.md:247-267 references/server-types.md:204-230

📁 Filesystem access (3)

examples/stdio-server.json:3-7 references/server-types.md:47-54 SKILL.md:44-54

🔑 Env variables (4)

examples/stdio-server.json:12-23 references/authentication.md:179-189 references/authentication.md:271-286 SKILL.md:272-285

⚙️ External commands (4)

SKILL.md:24-37 references/server-types.md:13-20 references/authentication.md:243-257 SKILL.md:445-449

Detected Patterns

Command-Based Stdio MCP ConfigurationCredential Values Passed To MCP ServersNetwork MCP Server Configuration

Audited by: codex

Audit version 5

Jan 17, 2026, 01:55 AM

This is a documentation-only skill providing guidance for MCP server configuration. Static findings flag command patterns, URLs, and env var placeholders in documentation examples, but these are legitimate configuration examples, not executable code. The skill does not execute any code, make network requests, or access credentials directly.

Files scanned

2,468

Lines analyzed

Review items

False positives ignored

Risk Factors

🌐 Network access (42)

🔑 Env variables (29)

examples/stdio-server.json:14 examples/stdio-server.json:14 examples/stdio-server.json:22 examples/stdio-server.json:22 references/authentication.md:185 references/authentication.md:185 references/authentication.md:187 references/authentication.md:187 references/authentication.md:197 references/authentication.md:199 references/authentication.md:210 references/authentication.md:212 references/authentication.md:218 references/authentication.md:220 references/authentication.md:115 references/authentication.md:116 references/authentication.md:154 references/authentication.md:509 references/authentication.md:515 references/server-types.md:32 references/server-types.md:30 references/server-types.md:30 references/server-types.md:259 SKILL.md:183 SKILL.md:281 SKILL.md:182 SKILL.md:182 SKILL.md:282 SKILL.md:282

⚙️ External commands (280)

Audited by: claude

Audit version 4

Jan 17, 2026, 01:55 AM

Files scanned

2,468

Lines analyzed

Review items

False positives ignored

Risk Factors

🌐 Network access (42)

🔑 Env variables (29)

⚙️ External commands (280)

Audited by: claude

Audit version 3

Jan 7, 2026, 01:23 AM

This is a documentation-only skill providing guidance on MCP configuration patterns. Contains no executable code, no file access, no network operations, and no command execution capabilities. All content is markdown documentation and example JSON configurations.

Files scanned

1,764

Lines analyzed

Review items

False positives ignored

No confirmed security findings were recorded for this completed audit.

Audited by: claude

Audit version 2

Jan 7, 2026, 01:23 AM

Files scanned

1,764

Lines analyzed

Review items

False positives ignored

No confirmed security findings were recorded for this completed audit.

Audited by: claude

Audit version 1

Jan 7, 2026, 01:23 AM

Files scanned

1,764

Lines analyzed

Review items

False positives ignored

No confirmed security findings were recorded for this completed audit.

Audited by: claude

← Back to Skill