Why this verdict
plugin . Suspicious
- suspicious: finding plugin:.:.mcp.json:3:SUPPLY
- suspicious: finding plugin:.:src/cli/web-server.ts:382:EXFIL
- suspicious: finding plugin:.:src/cli/web-server.ts:528:EXFIL
skill skill No issues found
- benign: 43 checks satisfied, no findings for skill:skill
Security findings 3
Supply chain
highContextual risklow confidenceThe shipped .mcp.json launches the MCP server through `bunx claudia-cli mcp` without a version pin, so it fetches whatever claudia-cli version is current on npm at runtime, unlike server.json which pins 0.1.3.
"command": "bunx"
conceal:remotevector:metadata
Counter-argument considered
The shipped launch config really runs `bunx claudia-cli mcp` with no version pin, so it executes whatever is current on npm; no carve-out or mitigation applies, though severity is low.
Data exfiltration
highContextual risklow confidenceThe local dashboard server copies the unescaped `project` query parameter into HTML href attributes, which allows reflected XSS on localhost; injected script could then read the unauthenticated /api/tasks and /api/projects endpoints, or POST to /api/clear-completed.
<a href="/?view=tasks${selectedProjectId ? '&project=' + selectedProjectId : ''}"vector:code
Counter-argument considered
The project query param flows unescaped into the HTML href attributes, giving reflected XSS. Injected same-origin script could reach the unauthenticated API endpoints. No mitigation is shown, so the finding is not refuted.
Data exfiltration
highContextual risklow confidenceThe dashboard's Bun.serve call sets no hostname and no auth, Origin or CSRF check, so /api/tasks and /api/projects serve task data and POST /api/clear-completed archives tasks for any client that can reach the port; this is an undeclared exposure with low confidence that it is reachable beyond localhost.
const server = Bun.serve({vector:code
Counter-argument considered
Bun.serve is called with only a port, so there is no hostname restriction and no auth, Origin or CSRF check. The task and project APIs and the state-changing POST are served to any client that can reach the port. Nothing in the code mitigates this.
Refuted findings 2
Candidates the review stage examined and rejected, kept for transparency.
Tool poisoning
criticalRefutedlow confidenceThe task_claim tool description uses imperative language ('CRITICAL', 'You MUST call this before working on any task') to condition the agent's behavior across all work, though it only concerns the artifact's own task-tracking workflow and is plausibly honest.
You MUST call this before working on any task.
Why it was refuted
The imperative wording only describes the artifact's own task-claim workflow, which the in-file comment openly documents. It does not steer the agent toward any unrelated or harmful action, so it is not tool poisoning.
Persistence
highRefutedlow confidenceDocumentation tells the user to add the project's own MCP server entry to ~/.claude/claude_desktop_config.json (an agent control-plane config); this is standard setup for registering the declared MCP server, not hidden or harmful, but it is an undeclared host-config write.
Add to `~/.claude/claude_desktop_config.json`:
Why it was refuted
This is user-facing setup documentation for registering the project's own declared MCP server, which is its core capability. The entry is plain and visible, and the claimed contradiction with 'Failed operations do not partially modify state' is a detector misfire, since that claim concerns task operations. No agent instruction performs the write.
Coverage gaps 3
Parts of the artifact the static analysis could not fully examine.
no_tools_extracted MCP server target with no statically extractable tools/prompts/resources
.claude-plugin/plugin.json
unanalyzed_image image text not analyzed
assets/claudia-demo.gif
vision_skipped animated GIF with 10 frames (models see one); 1058 bytes after the image end
assets/claudia-demo.gif
