registry / AI-agent control-surface risk / mcp-computrabajo-open
mcp-computrabajo-open
A Model Context Protocol (MCP) server for accessing Computrabajo job listings in Latin America
This report shows the evidence for mcp-computrabajo-open@1.0.1, the only known version.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe automatic postinstall writes package-controlled content into the global Claude skills control surface, meeting the install-hook abuse boundary. The remote-login cookie transfer adds a concrete credential-exposure path.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation runs postinstall; remote cookie transfer requires the iniciar-sesion-remota command.
Impact
The package can alter a broad AI-agent control surface without an explicit setup command and can send an authenticated session to an external service.
Mechanism
Install-time global AI-agent skill injection and remote session-cookie transfer.
Policy narrative
On installation, npm runs the postinstall script, which copies every packaged skill into the user's global Claude configuration. This changes the agent's available instructions without a separate user setup action. Separately, the explicit remote-login flow obtains a Computrabajo session cookie and posts it to a remote worker selected from a default maintainer-controlled URL.
AI rationale
The automatic postinstall writes package-controlled content into the global Claude skills control surface, meeting the install-hook abuse boundary. The remote-login cookie transfer adds a concrete credential-exposure path.
Evidence
package.jsonscripts/install-skills.mjsdist/src/index.js~/.claude/skills/<skill>/SKILL.md~/.claude/skills/.mcp-computrabajo-open.json
Network endpoints1
computrabajo-mcp.torres-sergio2205.workers.dev
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The install lifecycle automatically runs a script after npm installation.
- That script writes package-controlled skill files into the user's global Claude skills directory.
- The runtime remote-login path sends session cookies to a maintainer-controlled default worker endpoint.
Evidence against
- The skill installer preserves an existing skill file unless it has this package's marker.
- Skill installation can be disabled with an environment variable.
- The cookie transfer occurs only through an explicit remote-login command.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/install-skills.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/src/index.jsView file
144var high = parseInt(escaped, 16) - 65536;
L145: return high !== high || escapedWhitespace ? escaped : high < 0 ? String.fromCharCode(high + 65536) : String.fromCharCode(high >> 10 | 55296, high & 1023 | 56320);
L146: }
...
L363: name: getName(2).toLowerCase(),
L364: data: selector.charCodeAt(selectorIndex) === 40 ? readValueWithParenthesis() : null
L365: });
...
L619:
L620: // package.json
L621: var name = "mcp-computrabajo-open";
...
L642: // src/config/node-config.ts
L643: var DEFAULT_COOKIE_FILE = join(homedir(), ".computrabajo", "cookies.txt");
L644: function getCookies() {
Critical
Credential Exfiltration
Source appears to send environment or credential material to an external endpoint.
dist/src/index.jsView on unpkg · L144144Trigger-reachable chain: manifest.main -> dist/src/index.js
L144: var high = parseInt(escaped, 16) - 65536;
L145: return high !== high || escapedWhitespace ? escaped : high < 0 ? String.fromCharCode(high + 65536) : String.fromCharCode(high >> 10 | 55296, high & 1023 | 56320);
L146: }
...
L363: name: getName(2).toLowerCase(),
L364: data: selector.charCodeAt(selectorIndex) === 40 ? readValueWithParenthesis() : null
L365: });
...
L619:
L620: // package.json
L621: var name = "mcp-computrabajo-open";
...
L642: // src/config/node-config.ts
L643: var DEFAULT_COOKIE_FILE = join(homedir(), ".computrabajo", "cookies.txt");
L644: function getCookies() {
Findings
3 Critical3 High4 Medium5 Low
CriticalCredential Exfiltrationdist/src/index.js
CriticalAi Agent Control Hijackscripts/install-skills.mjs
CriticalTrigger Reachable Dangerous Capabilitydist/src/index.js
HighInstall Time Lifecycle Scriptspackage.json
HighEvaldist/src/index.js
HighTrigger Reachable Credential Exfiltrationdist/src/index.js
MediumSecret Patterndist/src/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to mcp-computrabajo-open@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing mcp-computrabajo-open@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.