Roo Code

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:08 PM UTC
• Version: 1.0.0

Overview

The skill is a Roo Code setup guide, but it recommends high-authority MCP integrations using unpinned npx packages and a GitHub token without enough scoping guidance.

Install only if you are comfortable running Roo Code as a high-authority coding agent. Before copying the MCP example, verify the package identities, pin exact reviewed versions, restrict filesystem access to intended project paths, and use a dedicated GitHub token with minimal scopes rather than a broad personal token.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:58

Finding

Unpinned Third-Party MCP Packages Are Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58-70
Vulnerability Type: Supply-chain risk from unpinned automatically executed dependencies
Risk Level: Medium

Vulnerable Code

json

// .vscode/mcp.json
{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@anthropic/mcp-filesystem"]
    },
    "github": {
      "command": "npx",
      "args": ["-y", "@anthropic/mcp-github"],
      "env": { "GITHUB_TOKEN": "${env:GITHUB_TOKEN}" }
    }
  }
}

Technical Analysis

The documented MCP configuration invokes npx with the -y option and package names that have no pinned versions. This causes npm packages to be retrieved and executed without interactive confirmation while allowing the resolved package contents to change after the Skill has been reviewed.

The configuration does not specify exact audited versions, package integrity hashes, a lockfile, or other provenance controls. Consequently, compromise or replacement of a referenced package or one of its transitive dependencies could result in arbitrary code running with the privileges of the VS Code or Roo Code process.

The GitHub MCP server additionally receives GITHUB_TOKEN through its environment. Any code executed as that server can potentially read the token, making dependency compromise particularly significant.

Attack Path

1. An attacker compromises, replaces, or otherwise influences a referenced npm package or one of its transitive dependencies.
2. A user copies the documented configuration into .vscode/mcp.json.
3. Roo Code starts the configured MCP server by running npx -y with the unpinned package name.
4. npx retrieves the package version currently resolved by the registry and executes it without confirmation.
5. Malicious package code executes under the user's account.
6. For the GitHub server, the code reads GITHUB_TOKEN from its process environment and ...[truncated 814 chars]

Remediation

View remediation

Remediation Suggestions

1. Confirm and document the official, current package identifiers before recommending them.
2. Pin every MCP package to an exact reviewed version rather than relying on registry resolution of an unversioned package name.
3. Install dependencies through a committed lockfile and use a reproducible installation mechanism such as npm ci.
4. Verify package provenance, publisher identity, signatures where available, and integrity hashes before execution.
5. Avoid npx -y for security-sensitive integrations because it suppresses confirmation before download and execution.
6. Prefer a locally installed, reviewed executable referenced by a fixed path in the MCP configuration.
7. Review and pin transitive dependencies as part of the dependency audit.
8. Supply a dedicated, short-lived GitHub token with only the repository and operation scopes strictly required by the MCP server.
9. Run MCP servers in a sandbox or container with restricted filesystem, environment-variable, and network access.
10. Document package verification and update procedures so version changes require review before deployment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.