Security audit

Mcp Server Chart

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its chart and map-generation purpose, but it should be reviewed because it sends user payloads to an external gateway while using unpinned dependencies and a shared fallback access key.

Review before installing. Use your own OneKey key, avoid sending private spreadsheet data or sensitive home/work/medical/travel locations, run the tools in a constrained environment, and prefer pinned, audited dependency versions instead of the unpinned npm, pip, and npx commands shown here.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Third-Party Gateway Dependencies Create a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_area_chart.py:9
Finding: Public Shared Fallback Access Key Is Embedded in Every Executable Script
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (106)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description is very broad and generic, saying only that this is an auto-generated skill for mcp-server-chart tools via OneKey Gateway. The actual code is narrower and more specific: it implements a command-line entry point for the particular remote API 'generate_mind_map'. It validates input, requires a 'data' field, and sends the payload to a remote OneKeyAgentRouter using an access token from the DEEPNLP_ONEKEY_ROUTER_ACCESS environment variable (with a fallback default value). While the remote invocation via OneKey Gateway partially aligns with the description, the primary purpose is specifically mind-map generation rather than general chart tools, and the external credentialed remote call is not captured in the declared permissions or description. This is a meaningful description-behavior mismatch.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares environment-variable and file/script usage capabilities but does not define any explicit tool scope or permission boundaries. In an agent ecosystem, this increases the chance that a host or user treats the skill as lower-risk than it really is, enabling over-broad access to secrets or local files during execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Publishing and encouraging fallback to a shared demo API key can cause unintentional credential sharing, weak accountability, and leakage of user data through a common tenant. Anyone using the skill without their own key may send potentially sensitive content through a publicly known shared access path.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Exposing a shared fallback key in plain text normalizes embedded credential use and invites abuse, unauthorized reuse, and blending of multiple users' data under one credential. In a hosted or multi-user agent environment, this can lead to privacy incidents, billing abuse, and difficulty tracing misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Several map-related sections require Chinese administrative-region names or POI names and limit operation to locations within China. This is a locale/language restriction expressed in natural language, but the documentation does not frame it as an explicit region-specific limitation with user opt-in or explain the constraint as a justified compliance or product boundary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The path map feature solicits planned route information, which can reveal movement patterns, destinations, and personal habits if sent to a remote service. Without a warning or consent step, users may unknowingly disclose sensitive travel plans.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The documentation advertises POI search, detailed location lookup, and photo retrieval capabilities that go beyond simple chart rendering. In agent settings, users may submit sensitive addresses, routes, or place names without realizing this data is being sent to an external service for enrichment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The map tools describe transmitting POI keywords to retrieve detailed location information and photos, but no privacy or data-handling warning accompanies this behavior. This can mislead users into sharing sensitive places such as home, workplace, medical, or travel destinations with a third party.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx onekey without a pinned version allows the latest package version to be fetched and executed at runtime, creating a supply-chain risk. A malicious or compromised upstream release could execute arbitrary code in the user's environment when the documented command is followed.
Content: No source excerpt is available for this finding.