pincushion-mcp@1.11.13
Visual feedback as agent work packets. Stakeholders drop pins on your live app; your AI coding agent reads each pin (selector, screenshot, DOM, thread, acceptance criteria) via MCP and ships the fix.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package is not malicious by the inspected source, but it has explicit user-command agent configuration and shell execution capabilities that warrant a warning. No lifecycle hook or unconsented install-time control-surface mutation was found.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs `pincushion-mcp setup` interactively or invokes `pincushion-mcp mobile-wall publish` with a deploy command or configured publish settings.
Impact
An MCP client may be configured for future project sessions; a publish command may execute the command selected in project configuration and send the selected image to the configured service.
Mechanism
Project-local MCP configuration, user-configured shell deployment, and authenticated screenshot upload.
AI rationale
The package is not malicious by the inspected source, but it has explicit user-command agent configuration and shell execution capabilities that warrant a warning. No lifecycle hook or unconsented install-time control-surface mutation was found.
Evidence
lib/setup-core.jsmobile-wall.mjsserver.jslib/license.js.cursor/mcp.json.vscode/mcp.json.mcp.jsoncrit-wall/wall.config.jsoncrit-wall/wall/publish-manifest.jsoncrit-wall/wall/publish-report.md
Network endpoints1
dpsqzszdviltqvethxbr.supabase.co
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit interactive setup command writes a Pincushion MCP entry into a project-local editor configuration.
- The mobile-wall publish command executes a deploy command supplied through its CLI or wall configuration.
- The mobile-wall publish flow can upload a selected screenshot to the Pincushion cloud service using a license key.
- The server enables cloud sync when a license key is supplied through an argument, environment variable, or local key file.
- The license helper identifies user and project license-key locations, though it exposes only the final four characters.
Evidence against
- package.json has no preinstall, install, postinstall, or other registry lifecycle hook.
- Editor configuration changes require the user to run the interactive setup command and target only project-local files.
- Shell execution is limited to the explicitly requested publish deploy command; no downloaded code execution was found.
- Network use is aligned with the package's sync, screenshot-upload, and telemetry functions; no broad environment or credential harvesting was found.
Behavioral surface
Source & flagged code
11 flaggedmobile-wall.mjsView file
17// injectable so both modes are testable without a simulator.
L18: import { execFileSync } from 'node:child_process';
L19: import {
High
mobile-wall.mjs#virtual:normalized:round1View file
121function publicUrlFrom(text) {
L122: const m = /(https?:\/\/[^\s"'<>]+)/.exec(String(text || ''));\n return m ? m[1].replace(/[),.;]+$/, '') : '';\n}\n\nasync function fetchCloudAnnotations(ctx, { baseUrl, key, proje...
L123: }
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
mobile-wall.mjs#virtual:normalized:round1View on unpkg · L12117// injectable so both modes are testable without a simulator.
L18: import { execFileSync } from "node:child_process";
L19: import {
...
L32: const DEFAULT_OUT = "crit-wall";
L33: const DEFAULT_FUNCTION_BASE = "https://dpsqzszdviltqvethxbr.supabase.co/functions/v1";
L34:
...
L78: function isSignedIn() {
L79: if (process.env.PINCUSHION_LICENSE_KEY) return true;
L80: try { return !!readFileSync(join(homedir(), ".pincushion", "license-key"), "utf8").trim(); } catch { return false; }
L81: }
...
L97: const firstLine = (e) => String(e.message || e).split("\n")[0];
L98: const execErrText = (e) => [e?.stderr, e?.stdout, e?.message].filter(Boolean).join("\n");
Findings
5 Critical7 High3 Medium6 Low
CriticalSame File Env Network Executionmobile-wall.mjs#virtual:normalized:round1
CriticalCredential Exfiltrationserver.js
CriticalDownload Executemobile-wall.mjs#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilityserver.js
CriticalPrevious Version Dangerous Deltasetup.mjs
HighChild Processmobile-wall.mjs
HighShell
HighCommand Output Exfiltrationmobile-wall.mjs#virtual:normalized:round1
HighCopied Package Dependency Bridgelib/posthog.js
HighTrigger Reachable Credential Exfiltrationserver.js
HighTrigger Reachable Command Output Exfiltrationmobile-wall.mjs#virtual:normalized:round1
Affected versions and remediation
This report applies to pincushion-mcp@1.11.13.
See all versions of pincushion-mcp for other recorded verdicts.
- Review the evidence and your use of pincushion-mcp@1.11.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.