{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-09-06","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"reviewed","auth_posture":"auth_required","category":"Web Connector","confidence":"high","description":"Edit a design project in an open SSHOW editor through Claude. Inspect scenes, change text or shapes, add assets and adjust animation keyframes. Preview changes with screenshots and use undo or redo in the active project.","did":"18bbfafd-a259-4c45-8c65-c2f00f2b6114","documentation_url":"https://s.show/docs/mcp","editorial_description":{"extended_description":"SSHOW combines layout, motion and presentation on one canvas. A SSHOW account and an open editor session are required for the described editing workflow. Batched edits can be undone as one step.","schema_version":1,"summary":"Edit a design project in an open SSHOW editor through Claude.\nInspect scenes, change text or shapes, add assets and adjust animation keyframes.\nPreview changes with screenshots and use undo or redo in the active project."},"homepage_url":"","icon":"https://s.show/favicon-512.png?v=color1","id":"18bbfafd-a259-4c45-8c65-c2f00f2b6114","installs":0,"last_scanned":"","license":"","long_description":"SSHOW combines layout, motion and presentation on one canvas. A SSHOW account and an open editor session are required for the described editing workflow. Batched edits can be undone as one step.","manual_assessment":"medium","manual_review":{"all_findings":[{"evidence":"Official docs say the assistant creates, changes and arranges objects, imports media, and can create a new empty account project.","reasoning":"These are persistent document and account changes, even though edits are normally reversible.","risk_type":"data_modification","severity":"medium","title":"Edits presentations and creates projects","triggering_tools_or_skills":["apply_actions","create_project","import_asset","redo","undo"]},{"evidence":"Official docs confirm the connector switches scenes/selections, runs the presentation, steps it and sends preview interactions.","reasoning":"The connector actively controls visible application state and simulated presentation input.","risk_type":"browser_control","severity":"medium","title":"Controls the open editor and presentation preview","triggering_tools_or_skills":["control_show","select_objects","set_active_scene"]},{"evidence":"Official docs allow image, video or audio import from data URLs or HTTPS addresses that permit cross-site loading.","reasoning":"User-selected URLs are fetched by the service, creating network-access exposure.","risk_type":"arbitrary_network_access","severity":"low","title":"Imports media from caller-selected HTTPS URLs","triggering_tools_or_skills":["import_asset"]}],"assessment_status":"reviewed","auth_and_scopes":"Cloud OAuth acts as the signed-in user on accessible projects; edits require an open editor and project creation counts toward the user's plan limit. Local mode uses a desktop access token.","blocked_missing_evidence":null,"confidence":"high","displayed_risk":"medium","evidence_completeness":"complete","manual_overall_risk":"medium","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/18bbfafd-a259-4c45-8c65-c2f00f2b6114.json","what_it_proves":"Candidate PR #125 record identity (name \"SSHOW\", publisher, type web_connector) and 16 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/18bbfafd-a259-4c45-8c65-c2f00f2b6114: complete tool_names inventory (16 tools), remote streamable-http endpoint https://s.show/mcp, auth_posture auth_required, directory tier community"},{"accessed_at":"2026-10-10T21:13:14Z","url_or_path":"https://s.show/docs/mcp","what_it_proves":"Official docs explain project editing, asset import, presentation control, undo/redo, project creation, OAuth and cloud/local connection behavior."}],"primary_reason":"Official SSHOW docs confirm persistent project editing, asset import and active editor/presentation control.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":false,"review_key":"claude:18bbfafd-a259-4c45-8c65-c2f00f2b6114","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 16 names against the official connector guide; no deletion, publishing or external messaging action is documented.","risk_domains":{"arbitrary_network_access":"true","authz_ambiguity":"false","browser_control":"true","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"true","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":16,"tools_or_skills_total":16},"name":"SSHOW","needs_runtime_verification":false,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=18bbfafd-a259-4c45-8c65-c2f00f2b6114&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://s.show/privacy","provisional_risk":null,"publication_recommendation":"accept","publisher":"SSHOW","publisher_url":"https://s.show/","remote_url":"https://s.show/mcp","repository_url":"","risk":"medium","risk_severity":"medium","security_risks":[{"description":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent document and account changes, even though edits are normally reversible.","evidence":"Edits presentations and creates projects: Official docs say the assistant creates, changes and arranges objects, imports media, and can create a new empty account project.","manual_risk_type":"data_modification","remediation":{"block_tool_categories":["state_change"],"steps":["Use a test account or sandbox before allowing changes to production data.","Grant only the write permissions required for the intended workflow.","Require human confirmation for consequential state changes."]},"risk_type":"modifies_data","severity":"medium","title":"Edits presentations and creates projects","triggering_tools":["apply_actions","create_project","import_asset","redo","undo"]},{"description":"This connector can navigate pages and interact with browser content on the user's behalf. Review findings: The connector actively controls visible application state and simulated presentation input.","evidence":"Controls the open editor and presentation preview: Official docs confirm the connector switches scenes/selections, runs the presentation, steps it and sends preview interactions.","manual_risk_type":"browser_control","remediation":{"block_tool_categories":["state_change"],"steps":["Use an isolated browser profile without unrelated authenticated sessions.","Require confirmation before form submission, download, upload, or purchase actions."]},"risk_type":"browser_control","severity":"medium","title":"Controls the open editor and presentation preview","triggering_tools":["control_show","select_objects","set_active_scene"]},{"description":"This connector can send caller-provided data to an external service or publisher. Review findings: User-selected URLs are fetched by the service, creating network-access exposure.","evidence":"Imports media from caller-selected HTTPS URLs: Official docs allow image, video or audio import from data URLs or HTTPS addresses that permit cross-site loading.","manual_risk_type":"arbitrary_network_access","remediation":{"block_tool_categories":["sends_externally"],"steps":["Do not include secrets, regulated data, or customer information unless the destination is approved.","Review the recipient's retention and deletion policy before enabling the connector."]},"risk_type":"forwards_data_to_third_party","severity":"low","title":"Imports media from caller-selected HTTPS URLs","triggering_tools":["import_asset"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://s.show/contact","tags":["browser_control","forwards_data_to_third_party","modifies_data","network_access","oauth_required","web_connector"],"tools":[{"description":"","name":"apply_actions","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent document and account changes, even though edits are normally reversible."}},{"description":"","name":"control_show","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can navigate pages and interact with browser content on the user's behalf. Review findings: The connector actively controls visible application state and simulated presentation input."}},{"description":"","name":"create_project","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent document and account changes, even though edits are normally reversible."}},{"description":"","name":"find_objects"},{"description":"","name":"get_fonts"},{"description":"","name":"get_guide"},{"description":"","name":"get_object"},{"description":"","name":"get_project_overview"},{"description":"","name":"get_scene"},{"description":"","name":"get_screenshot"},{"description":"","name":"import_asset","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent document and account changes, even though edits are normally reversible."}},{"description":"","name":"list_projects"},{"description":"","name":"redo","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent document and account changes, even though edits are normally reversible."}},{"description":"","name":"select_objects","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can navigate pages and interact with browser content on the user's behalf. Review findings: The connector actively controls visible application state and simulated presentation input."}},{"description":"","name":"set_active_scene","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can navigate pages and interact with browser content on the user's behalf. Review findings: The connector actively controls visible application state and simulated presentation input."}},{"description":"","name":"undo","risk":{"category":"state_change","level":"medium","recommendation":"Follow the connector-level remediation and require approval for consequential actions.","why":"This connector can create, update, configure, or otherwise change connected resources. Review findings: These are persistent document and account changes, even though edits are normally reversible."}}],"tools_count":16,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/18bbfafd-a259-4c45-8c65-c2f00f2b6114","uuid":"25c170d7-842b-5ff0-8fa8-d5182cf52b29","verification_tier":"community","version":""},"query_key":"sshow","schema_version":1,"status":"match"}