AADDYY AI Tools

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent AADDYY MCP integration, but it asks users to install a persistent, unpinned third-party MCP server that can receive prompts, files, URLs, and an API key with limited data-handling disclosure.

Review this before installing if you will use it with confidential prompts, private documents, internal URLs, or paid API credits. Prefer a pinned and reviewed MCP package version, use a dedicated revocable AADDYY API key with spending limits, and avoid submitting secrets or non-public URLs unless you are comfortable sending them to AADDYY's service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Third-Party MCP Package Allows Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:27
• README.md:6-8

Vulnerability Type: Unpinned executable third-party dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:27:

bash

openclaw mcp set aaddyy '{"command":"npx","args":["@aaddyy/mcp-server"],"env":{"AADDYY_API_KEY":"aip_your_key_here"}}'

README.md:6-8:

bash

openclaw mcp set aaddyy '{"command":"npx","args":["@aaddyy/mcp-server"],"env":{"AADDYY_API_KEY":"YOUR_KEY"}}'

Technical Analysis

The documented setup executes @aaddyy/mcp-server through npx without specifying an exact package version or enforcing an integrity hash. Consequently, installation behavior depends on whichever package release the registry resolves at execution time. The effective executable can therefore change after this skill has been reviewed.

The MCP process is also explicitly provided with AADDYY_API_KEY. Because an npm package can run arbitrary JavaScript under the invoking user's account, a compromised or malicious future package release could access this credential and perform any operation permitted by the local process environment.

The documentation additionally states in SKILL.md:10 and SKILL.md:38 that tools are loaded dynamically from the remote AADDYY API and that new tools can appear without a skill update. This further expands the external trust boundary, although the audited files do not establish that the current remote tool definitions are malicious.

Attack Path

1. An attacker compromises the npm publisher account, the package release process, or another relevant supply-chain component for @aaddyy/mcp-server.
2. The attacker publishes a modified release under the same package name.
3. A user follows the documented command, or the configured integration invokes npx in a way that resolves the unpinned release.
4. npx downloads and executes the attacker-controlled package under the agent user's operating-system account.
5. The malicious proces ...[truncated 1133 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP package to a reviewed exact version instead of resolving the latest available release:

   bash

   openclaw mcp set aaddyy '{"command":"npx","args":["--yes","@aaddyy/mcp-server@EXACT_VERSION"],"env":{"AADDYY_API_KEY":"YOUR_KEY"}}'
   

2. Prefer installing the package through a committed lockfile and invoking the verified local binary. Avoid floating version ranges.

3. Verify package integrity using registry integrity metadata, checksums, signatures, or provenance attestations in the deployment pipeline.

4. Audit each package update before changing the pinned version. Enable dependency monitoring for publisher changes and suspicious releases.

5. Run the MCP server in a restricted environment with minimal filesystem permissions, an outbound-network allowlist, and no unrelated environment variables.

6. Use a dedicated, revocable API key with the minimum required account permissions and spending limits. Rotate it immediately if package compromise is suspected.

7. Require explicit administrative approval before enabling newly introduced remote tools. Pin or version the remote tool manifest where supported.

8. Document the precise reviewed package version and expected package checksum in both SKILL.md and README.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill routes prompts and uploaded/supplied content through AADDYY's external MCP/API service but does not clearly disclose that user data leaves the local agent environment for third-party processing. This can lead users to submit sensitive prompts, documents, or business data under a false assumption of local handling, creating privacy, confidentiality, and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The SEO analysis capability encourages users to submit external URLs for analysis without warning that those URLs and associated fetch/analysis activity are performed by a third-party service. This may expose internal, private, pre-release, or sensitive URLs to the provider and can create privacy or reconnaissance concerns if users analyze non-public targets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.