jsreverser-mcp-javascript-reverse-engineering
Fail
Audited by Gen Agent Trust Hub on May 17, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to clone source code from an external repository located at
https://github.com/NoOne-hub/JSReverser-MCP.git, which is not associated with a known trusted vendor. - [REMOTE_CODE_EXECUTION]: The installation instructions require the user to run
npm installandnpm run buildon the downloaded code and then execute the resulting server usingnode, leading to the execution of untrusted code on the local system. - [DATA_EXFILTRATION]: Several tools within the skill, such as
dump_session_state,save_session_state, andexport_rebuild_bundle, are designed to harvest sensitive browser information, including session cookies and captured network traffic, and save them to local storage. - [COMMAND_EXECUTION]: The skill documentation provides instructions to execute shell commands to launch the system's web browser with remote debugging enabled (
--remote-debugging-port=9222), which allows the MCP server to programmatically control and inspect the browser environment.
Recommendations
- AI detected serious security threats
Audit Metadata