Why this verdict
- inconclusive: unresolved question on CRED
- inconclusive: unresolved question on EXEC
Security findings 0
No individual findings recorded
The inconclusive verdict rests on the open questions below; 1 candidate finding was refuted on review.
Open questions 3
What the analysis could not settle from the code alone.
The API client source (src/api.ts) is shown only as comments; the actual code is absent. Where does request() send the API key, and how is the 'shared public demo key' fetched (from what URL, and is it executed or only used as a header)?
Credential access
[file request scripts/pack-mcpb.mjs] What does this build script do (file access, network, exec)?
Code execution
[file request scripts/release.mjs] What does the release script run (publishing, network, shell, credential use)?
Supply chain
Refuted findings 1
Candidates the review stage examined and rejected, kept for transparency.
Credential access
highRefutedlow confidenceThe API base URL can be overridden by the ATLASFETCH_API_URL environment variable, and every request then sends the Bearer API key and tool payloads to that host, so a malicious or misconfigured value would redirect the key and data off-host.
process.env.ATLASFETCH_API_URL ?? DEFAULT_BASE_URL
Why it was refuted
This is a standard operator-set base-URL override for the wrapped service. The default is the vendor's own API, and the Bearer key is sent to that same service. Only whoever configures the server's environment can change the value, and no code or instruction lets the agent or tool input redirect it, so it is not a credential-exfiltration chain.
