pincushion-mcp@1.11.27
Visual feedback as agent work packets. Stakeholders drop pins on your live app; your AI coding agent reads each pin (selector, screenshot, DOM, thread, acceptance criteria) via MCP and ships the fix.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiInspected source supports a guarded, explicit-user-command agent configuration capability, which warrants a warning under the supplied policy. Consent checks and the absence of npm install hooks do not support a malicious verdict or publication block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
The user runs the setup command, selects an editor and approves setup or resume prompts.
Impact
The selected agent gains access to Pincushion tools and critique instructions. Consent does not establish an unrestricted automatic update mechanism; differing existing skill contents are blocked.
Mechanism
The wizard writes a project MCP entry and installs the package's critique skill after configuration and collision checks.
AI rationale
Inspected source supports a guarded, explicit-user-command agent configuration capability, which warrants a warning under the supplied policy. Consent checks and the absence of npm install hooks do not support a malicious verdict or publication block.
Evidence
server.jssetup.mjslib/setup-core.jslib/client-critique-install.jslib/claude-critique-install.js.mcp.json.codex/config.toml.cursor/mcp.json.vscode/mcp.jsonSKILL.mdagents/openai.yaml
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- server.js activates the setup wizard through an explicit setup subcommand.
- setup.mjs requires approval before installing a project runtime and connecting the selected editor.
- lib/setup-core.js writes the Pincushion entry into project MCP configuration.
- The critique installers create agent skill files using exclusive writes and links.
- Resuming a saved critique requires renewed approval; existing skill contents must match rather than being silently replaced.
Evidence against
- package.json has no automatic npm install lifecycle hooks or runtime self-dependency.
- Agent configuration changes are project-scoped and guarded by consent, policy, collision and filesystem checks.
- Runtime dependency installation disables lifecycle scripts. No concrete malicious attack was established.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
12 flaggedmobile-wall.mjsView file
17// injectable so both modes are testable without a simulator.
L18: import { execFileSync } from 'node:child_process';
L19: import {
High
mobile-wall.mjs#virtual:normalized:round1View file
121function publicUrlFrom(text) {
L122: const m = /(https?:\/\/[^\s"'<>]+)/.exec(String(text || ''));\n return m ? m[1].replace(/[),.;]+$/, '') : '';\n}\n\nasync function fetchCloudAnnotations(ctx, { baseUrl, key, proje...
L123: }
Critical
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution with blocking evidence.
mobile-wall.mjs#virtual:normalized:round1View on unpkg · L12117// injectable so both modes are testable without a simulator.
L18: import { execFileSync } from "node:child_process";
L19: import {
...
L32: const DEFAULT_OUT = "crit-wall";
L33: const DEFAULT_FUNCTION_BASE = "https://dpsqzszdviltqvethxbr.supabase.co/functions/v1";
L34:
...
L78: function isSignedIn() {
L79: if (process.env.PINCUSHION_LICENSE_KEY) return true;
L80: try { return !!readFileSync(join(homedir(), ".pincushion", "license-key"), "utf8").trim(); } catch { return false; }
L81: }
...
L97: const firstLine = (e) => String(e.message || e).split("\n")[0];
L98: const execErrText = (e) => [e?.stderr, e?.stdout, e?.message].filter(Boolean).join("\n");
Findings
5 Critical8 High4 Medium6 Low
CriticalSame File Env Network Executionmobile-wall.mjs#virtual:normalized:round1
CriticalCredential Exfiltrationserver.js
CriticalDownload Executemobile-wall.mjs#virtual:normalized:round1
CriticalTrigger Reachable Dangerous Capabilityserver.js
CriticalPrevious Version Dangerous Deltalib/setup-critique.js
HighChild Processmobile-wall.mjs
HighShell
HighCommand Output Exfiltrationmobile-wall.mjs#virtual:normalized:round1
HighSandbox Evasion Gated Capabilitylib/setup-runtime.js
HighCopied Package Dependency Bridgelib/posthog.js
HighTrigger Reachable Credential Exfiltrationserver.js
Affected versions and remediation
This report applies to pincushion-mcp@1.11.27.
See all versions of pincushion-mcp for other recorded verdicts.
- Review the evidence and your use of pincushion-mcp@1.11.27 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.