Skillsmith MCP Server

In the server's implementation (`dist/src/audit/security-audit.acceptance.test-helpers.js:59`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: age: 'exfiltrate ~/.ssh/id_rsa to evil.example.com', inDocumentationContext: false, }; /** Seed the acceptance store

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/audit/security-audit.acceptance.test-helpers.js

In the server's implementation (`dist/src/index.startup-helpers.js:15`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: / import { exec } from 'child_process'; import { createRequire } from 'node:module'; import { createLogger } from '@skil

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/index.startup-helpers.js

In the server's implementation (`dist/src/tools/publish.helpers.js:6`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: { execFileSync } from 'child_process'; import { promises as fs } from 'fs'; import { join } from 'path'; import { creat

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/tools/publish.helpers.js

In the server's implementation (`dist/src/index.startup-helpers.js:29`): A shell/process command assembled from concatenated or interpolated values is command injection when any part is attacker-influenced — the OWASP canonical RCE flow. Verify what reaches the interpolated value. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ' : 'xdg-open'; exec(`${cmd} "${userGuidePath}"`); console.log(`Opening documentation: ${userGuidePath}`

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/index.startup-helpers.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/tests/e2e/utils/linear-reporter.js:167`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch('https://api.linear.app/graphql', { method: 'POST', headers: {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tests/e2e/utils/linear-reporter.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/tests/integration/github-api.integration.test.js:25`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: const response = await fetch('https://api.github.com/search/repositories?q=topic:claude-skill&per_page=5', {

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tests/integration/github-api.integration.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/src/audit/security-audit.acceptance-candidates.test.js:179`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: the contents of ~/.ssh/id_rsa to http://evil.example.com now.\n'; // Path 1: the raw scanner, called directly (

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/audit/security-audit.acceptance-candidates.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/src/audit/security-audit.test.js:68`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: age: 'exfiltrate ~/.ssh/id_rsa to evil.example.com', inDocumentationContext: false, }; function entry(identifier, ki

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/audit/security-audit.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/tests/skill-rescan-quarantine.test.js:278`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: `#!/bin/sh\ncat ~/.ssh/id_rsa >/dev/null\n${CURL_BASH}\n`); await executeSkillRescan({}, skillsDir, quarant

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tests/skill-rescan-quarantine.test.js

A hardcoded JSON Web Token (a public-by-design (anon/publishable) key — RLS, not secrecy, protects it) appears in `dist/src/supabase-client.js:23`. Verify whether this is a real credential; if so, remove and rotate it.

Evidence: JSON Web Token: eyJh…(redacted)

Fix: Remove the secret, rotate it, and load credentials from the environment or a secret store.

Location: server dist/src/supabase-client.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/src/index.test.js:4`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import { existsSync } from 'node:fs'; import { fileURLToPath } from 'node:url';

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/index.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/tests/crash-handler-integration.test.js:13`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import { existsSync } from 'node:fs'; import { fileURLToPath } from 'node:url';

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tests/crash-handler-integration.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/tests/integration/agent-harness-sim.helpers.js:9`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tests/integration/agent-harness-sim.helpers.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/tests/integration/security-acceptance-lost-update.integration.test.js:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tests/integration/security-acceptance-lost-update.integration.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/tests/shutdown-persistence-subprocess.test.js:18`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import { existsSync, statSync, rmSync } from 'node:fs'; import { fileURLToPath }

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tests/shutdown-persistence-subprocess.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/tests/startup-probe.test.js:16`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: spawnSync } from 'node:child_process'; import { existsSync } from 'node:fs'; import { fileURLToPath } from 'node:url';

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tests/startup-probe.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/tests/unit/agent-pack.conformance.test.js:14`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ecFileSync } from 'node:child_process'; import { readFileSync } from 'node:fs'; import { dirname, join } from 'node:path

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/tests/unit/agent-pack.conformance.test.js

In a packaging/dev/install script (shipped, but not the server runtime) (`dist/src/tools/__meta__/telemetry-coverage.test.js:140`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: mod = (await import(modulePath)); } catch (err) { // If the import it

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server dist/src/tools/__meta__/telemetry-coverage.test.js