Csb Clawhub Nd8cxH

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:49 AM UTC
• Version: 1.0.0

Overview

This is a small cruise-planning MCP skill that clearly points to a remote service and does not include local code, persistence, or privilege escalation behavior.

Install only if you are comfortable sending cruise-planning queries and preferences to the disclosed third-party MCP endpoint. Do not provide credentials, payment details, or unrelated private context unless the service separately documents why it needs them and how it protects them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: server.json:6

Finding

Unauditable Third-Party MCP Service Can Change Behavior After Package Review

Content

View full analysis

Vulnerability Details

File Location: server.json:6-9; duplicated in SKILL.md:16-18 and SKILL.md:29-32
Vulnerability Type: other: Untrusted Remote MCP Integration
Risk Level: Medium

Vulnerable Code

server.json:6-9:

json

"remotes": [
  {
    "type": "streamable-http",
    "url": "https://cruise-mcp.olavacations.com/api/gw/mcp/6426abde-462c-468a-9959-5ae1aeb52d69"
  }
]

SKILL.md:16-18:

text

https://cruise-mcp.olavacations.com/api/gw/mcp/6426abde-462c-468a-9959-5ae1aeb52d69

SKILL.md:29-32:

json

{
  "type": "streamable-http",
  "url": "https://cruise-mcp.olavacations.com/api/gw/mcp/6426abde-462c-468a-9959-5ae1aeb52d69"
}

Technical Analysis

The package contains no local MCP server implementation. Instead, it configures the agent to communicate with a third-party service over streamable HTTP. Although HTTPS protects traffic in transit, it does not make the remote implementation auditable or guarantee that its tools, responses, data-processing behavior, or operational logic remain unchanged after this package is reviewed.

The package does not document the remote operator's trust model, tool schema, requested capabilities, authentication controls, retention policy, privacy policy, or integrity/version guarantees. Consequently, security review of these three local files cannot establish what the endpoint does with user-supplied tool arguments or what content it may return.

This is not evidence that the current endpoint is malicious, and the configuration does not directly retrieve and execute local code. It is an untrusted-boundary and change-control risk inherent in delegating MCP behavior to an externally controlled service.

Attack Path

1. A user installs and activates the Skill.
2. The MCP client connects to the configured third-party endpoint.
3. The endpoint supplies MCP capabilities, tool metadata, and responses at runtime.

...[truncated 1115 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish an auditable MCP server implementation or provide a reproducible, versioned deployment artifact corresponding to the configured service.
2. Document the endpoint operator, complete tool schema, required permissions, authentication model, privacy policy, retention policy, and categories of data transmitted.
3. Pin the integration to a reviewed protocol and tool-contract version. Detect and reject unexpected tool definitions or capability changes.
4. Apply an explicit allowlist of permitted tools and argument fields, and require user approval before sending sensitive or unrelated context.
5. Minimize transmitted data and redact credentials, personal information, conversation history, and system context unless strictly required.
6. Validate and treat all remote descriptions and responses as untrusted data rather than agent instructions.
7. Add connection timeouts, response-size limits, structured-schema validation, logging, and a mechanism to revoke or disable the endpoint.
8. Consider deploying the reviewed server in a controlled environment instead of relying on a mutable third-party endpoint.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The user-facing title and description are entirely in Chinese, and there is no indication that the skill supports other languages or that Chinese is a required locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description and the main skill content are written entirely in Chinese, with no indication that other languages are supported or that Chinese is required for a region-specific purpose. This creates a language/locale policy concern because the skill implicitly enforces one language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description is written entirely in Chinese, which imposes a specific language context without any indication that the user can choose a different language or that the skill is intended only for Chinese-speaking users. This can conflict with organizational language/locale policy when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.