@skillsmith/mcp-server

AI Security Review

Evidence context: threat category none; evidence quality moderate.

What this package does

@skillsmith/mcp-server describes itself as a registry for sharing, scanning, and tracking agent skills across teams. Version 0.7.18 ships a compiled dist/ tree next to its source. The manifest declares no host permissions and no permission strings, and the package lists no network endpoints.

Tool poisoning

Zero tool-poisoning findings matched. No tool description in the package carries directives aimed at an AI agent. Nothing tells a model to stay silent, skip user confirmation, or run a command before replying. The tool names that do show up (team-workspace, team-resolver, registry-tools) read as ordinary registry operations. MCP servers legitimately contain description: fields, and scanners sometimes mistake those definitions for poisoning. Here nothing matched at all, so the question does not arise.

Credential and network findings

The heaviest cluster is 35 critical MCP-TRANSPORT-HARDCODED-TOKEN alerts. Every one lands in a .test.js file:

• dist/tests/unit/namespace-audit-telemetry.test.js
• dist/src/shutdown.test.js
• dist/src/tools/team-workspace.test.js
• dist/src/tools/team-resolver.test.js (six hits)
• dist/tests/unit/apply-manifest-reconcile.test.js
• dist/src/tools/registry-tools.team.test.js
• dist/src/tools/registry-tools.live.manage.test.js

No production file, no server entry point, no tool implementation turns up in that list. Test suites for an authenticated MCP server need literal token strings to assert that bad credentials get rejected. The scanner matched those fixtures.

The other 35 findings sit in the network category, with no destination domain recorded and no endpoint attributed to the package. Nothing ties a credential read to a call to an unfamiliar host. The exfiltration shape, reading .ssh, .aws/credentials or .kube/config and then posting the contents somewhere, shows up nowhere here: no credential-access rule fires on those paths, and the scan records zero IoC and zero malware-signature matches.

Counterargument

The strongest case against this reading: 35 critical secrets is a lot, and the publisher string "GitHub Actions" names a CI job rather than a person or org, which makes attribution hard. A package that ships tokens inside dist/ could be leaking a real one. That argument fails on file placement. Hardcoded production credentials would live in the runtime code that talks to the registry, not exclusively in files whose names end in .test.js, and the scanner found none outside those files. The CI publisher string fits a repo that publishes from GitHub Actions, which is how most npm packages ship.

Verdict

The findings describe test fixtures and unspecified network calls, not hidden AI instructions or credential theft. Nothing here justifies concern beyond the ordinary caution that applies to any MCP server pointed at a development environment.

Key Reasons

• All 35 critical MCP-TRANSPORT-HARDCODED-TOKEN findings land in .test.js fixtures (dist/src/tools/team-resolver.test.js, dist/tests/unit/apply-manifest-reconcile.test.js), with zero hits in runtime code
• Zero tool-poisoning findings: no tool description carries directives aimed at an AI agent
• The 35 network findings name no destination domain and the package declares no network endpoints
• No credential-access rule fires on .ssh, .aws or .kube paths, and the scan records zero IoC and zero malware-signature matches
• Publisher string 'GitHub Actions' fits a repo publishing from CI, and the manifest requests no permissions

False Positive Considerations

• MCP-TRANSPORT-HARDCODED-TOKEN rule matching deliberate credential placeholders in test suites
• Network findings with no destination domain attributed
• dist/ tree containing compiled test files alongside bundled code
• CI-generated publisher metadata read as an anonymous identity

Reviewed 2026-10-01; recommended action: suppress false positive; model confidence 72%.