ClawHub
Back to skill

Security audit

Web3 Daily Mcp

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it runs a Web3 MCP server that sends digest and wallet-analysis requests to a disclosed backend, with supply-chain and privacy cautions users should consider.

Install only if you are comfortable sending wallet addresses you choose to analyze to the J4Y backend. Prefer a pinned package version or local build over the unversioned npx examples, and update dependencies before exposing this MCP server in a less controlled environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:84
Finding

Unpinned npm Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:84-106
Additional Location: README.md:16-56
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

json
{
  "plugins": {
    "entries": {
      "web3-daily-mcp": {
        "enabled": true,
        "command": "npx",
        "args": ["web3-daily-mcp"]
      }
    }
  }
}

The same unpinned command is also recommended for Claude Desktop, OpenClaw, and Cursor:

json
{
  "mcpServers": {
    "web3-daily": {
      "command": "npx",
      "args": ["web3-daily-mcp"]
    }
  }
}

Technical Analysis

The documented configurations invoke npx web3-daily-mcp without an exact package version. Depending on the local npm cache and installation state, npx can retrieve the package version currently selected by the npm registry. The code executed later may therefore differ from the version audited here.

Although the repository contains a lockfile with integrity hashes for its dependencies, that lockfile does not pin the top-level package selected by these external npx configurations. A compromised publisher account, malicious future release, or registry-level package compromise could replace the effective MCP executable without requiring any change to this repository.

No evidence indicates that the package or its current dependencies are malicious. The risk arises from the unsafe installation and execution pattern.

Attack Path

  1. An attacker compromises the npm publishing account, release pipeline, or package distribution channel for web3-daily-mcp.
  2. The attacker publishes a malicious version under the same package name.
  3. A user installs or starts the MCP server using the documented unversioned npx web3-daily-mcp configuration.
  4. npx resolves and downloads the attacker-controlled release.
  5. Node.js executes the malicious package as the user running the MCP host.
  6. The payload can access resources available to that user and ...[truncated 639 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the package to a reviewed exact version in every configuration:

    json
    {
  "command": "npx",
  "args": ["--yes", "web3-daily-mcp@1.0.0"]
}

  2. Avoid version ranges, tags such as latest, and unversioned package names in executable MCP configurations.

  3. Prefer installing from a trusted lockfile and invoking the locally installed executable rather than downloading code during MCP startup:

    bash
    npm ci
npm run build
node dist/index.js

  4. Verify npm package provenance, publisher identity, integrity metadata, and release signatures before updating the pinned version.

  5. Review dependency and lockfile changes for every release. Use automated dependency scanning and require approval for package updates.

  6. Run the MCP server under a dedicated, least-privileged account or sandbox with restricted filesystem, environment-variable, and network access.

  7. Update all affected examples in SKILL.md and README.md so users are not directed toward unpinned execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High
Category
Supply Chain
Confidence
89% confidence
Finding

fast-uri 3.1.0 is reported with multiple host-confusion and SSRF-relevant parsing issues. In a networked MCP server that may consume or validate attacker-influenced URLs through framework or schema tooling, incorrect URI canonicalization can lead to policy bypass, SSRF, or host allowlist evasion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.9 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High
Category
Supply Chain
Confidence
92% confidence
Finding

hono 4.12.9 has many advisories affecting cookies, routing, and request handling. Because MCP servers are network-facing and handle untrusted inputs, framework-level flaws can directly affect authentication, routing correctness, header safety, and boundary enforcement, making this especially relevant.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High
Category
Supply Chain
Confidence
84% confidence
Finding

ip-address 10.1.0 includes an address parsing inconsistency and an XSS issue in HTML-emitting methods. In this dependency path it comes from express-rate-limit, so the parsing flaw is more relevant than the HTML method issue; if IP parsing is security-sensitive, inconsistencies around leading-zero octets can cause policy or logging mistakes.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill defines an MCP server that performs real backend/API requests and processes wallet addresses, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That makes the network-capable behavior less transparent to the host and user, increasing the risk of overbroad external communication or unexpected data egress.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The tool documentation states that language defaults to zh (Chinese). This imposes a specific language choice when the user does not explicitly select one, which is a natural-language locale policy concern because the skill does not present language choice as opt-in by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The wallet analysis tools send user-supplied wallet addresses and profiling parameters to a third-party remote API, enabling external collection of wallet-linked behavioral data. While blockchain addresses are public, associating them with an agent user’s request and generating personalized profiling creates a privacy and data-sharing risk, especially because the tool descriptions and code do not provide an explicit warning or consent step before transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest advertises personalized wallet analysis but does not state when the feature should or should not be invoked, what user consent is required, or whether sensitive wallet analysis is limited to explicitly user-supplied addresses. In an MCP context, this ambiguity can lead an agent to over-collect or over-send wallet identifiers to the backend, creating unnecessary privacy exposure even if the backend itself is legitimate.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The wallet-related tool descriptions are broad and do not define boundaries for use, such as whether they require direct user opt-in, what wallet may be analyzed, or whether analysis of third-party addresses is prohibited. For agent-integrated tools, vague descriptions increase the chance of inappropriate invocation and privacy-invasive behavior, especially because wallet analysis can reveal behavioral and financial patterns.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.11 — 2 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The lockfile pins @hono/node-server 1.19.11, which is flagged for middleware bypass via repeated slashes and Windows path traversal issues in serveStatic. Even though the vulnerable code may only be reachable if this MCP server exposes static files, the dependency is present in the runtime tree and could weaken request-path security if those features are used now or later.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low
Category
Supply Chain
Confidence
80% confidence
Finding

body-parser 2.2.2 is listed with a denial-of-service advisory related to invalid limit handling. In an MCP server that processes untrusted requests, malformed bodies could potentially trigger resource exhaustion or request handling instability if the affected parsing path is exercised.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.27.4 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low
Category
Supply Chain
Confidence
82% confidence
Finding

qs 6.15.0 is flagged for multiple denial-of-service and parsing edge-case issues. Since qs is used by Express/body-parser to process attacker-controlled query strings or bodies, these flaws can be relevant to availability and input handling in a public-facing server, though the expected impact is typically limited to DoS rather than code execution.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The dependency uses a caret range, which permits automatic installation of newer minor/patch releases rather than an exact reviewed version. In a security-sensitive MCP server that brokers access to backend data for AI agents, this increases supply-chain risk because a compromised or breaking upstream release could be pulled into installs without explicit approval.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json
"author": "Alex Wang",
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.28.0",
    "zod": "^3.23.0"
  },
  "devDependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The zod dependency is specified with a caret range, allowing non-exact upstream versions to be resolved at install time. While common in JavaScript projects, this still creates a real supply-chain exposure because an unexpected upstream release could alter validation behavior or introduce a malicious package version into the MCP server.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.28.0",
    "zod": "^3.23.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
84% confidence
Finding

The devDependency is not pinned to an exact version, so development and build environments may resolve newer upstream releases than were originally tested. Although @types/node is not typically shipped at runtime, unpinned build-time dependencies still contribute to supply-chain risk and can cause inconsistent or manipulated builds.

Content

Scanner excerpt · package.json (reported line 30)May include surrounding context.

json
"zod": "^3.23.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",
    "tsx": "^4.7.0",
    "typescript": "^5.4.0"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The tsx devDependency is specified with a caret range, permitting automatic resolution of newer versions in developer or CI environments. Because tsx is an executable development tool, a compromised upstream release could affect local execution or build workflows, making this somewhat more sensitive than a purely type-only package.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json
},
  "devDependencies": {
    "@types/node": "^20.0.0",
    "tsx": "^4.7.0",
    "typescript": "^5.4.0"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
87% confidence
Finding

The typescript compiler version is unpinned, allowing new compiler releases to be pulled automatically in development or CI. This is primarily a build integrity and reproducibility concern, but in a package that compiles code for an MCP server, unexpected compiler changes or a compromised release could impact generated artifacts and trust in the build pipeline.

Content

Scanner excerpt · package.json (reported line 32)May include surrounding context.

json
"devDependencies": {
    "@types/node": "^20.0.0",
    "tsx": "^4.7.0",
    "typescript": "^5.4.0"
  }
}