ClawHub
Back to skill

Security audit

Create MCP Server

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for creating MCPHero servers, but it under-discloses credential-handling risks while asking users to install a CLI and pass valuable tokens and integration secrets through commands and config files.

Review this skill carefully before installing. Use it only with MCPHero accounts and servers you intend to manage, avoid putting real tokens or passwords directly in shell commands when safer input methods exist, use narrowly scoped credentials for integrations, protect any client config containing bearer tokens, and verify the mcpheroctl package source before installation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Third-Party CLI Installation Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:34
Finding

Organization Authentication Token Exposed Through Command-Line Arguments

Content
View full analysis
``` ### Technical Analysis The documented authentication flow instructs users to provide the MCPHero organization token directly through the `--token` command-line argument. When a real token replaces the placeholder, it may be exposed through: - Shell history files. - Process listings while the command is running. - Terminal session recording. - Endpoint monitoring and process telemetry. - Automation logs or copied command transcripts. - Diagnostic or support bundles that capture command arguments. Command-line arguments are not an appropriate transport for long-lived or high-value credentials when a protected stdin, credential file, interactive hidden prompt, or operating-system credential store is available. The token transfer to MCPHero is necessary for the declared service-management functionality, but exposing the token in local process metadata exceeds the minimum disclosure required to authenticate. ### Attack Path 1. A user creates an MCPHero organization token. 2. The user substitutes the real token into the documented `--token` command. 3. The command is saved in shell history, captured by monitoring software, recorded in logs, or observed through process inspection. 4. A local user, malicious process, log reader, or telemetry-system operator retrieves the token. 5. The attacker authenticates to MCPHero using the stolen credential. 6. The attacker performs any organization or server-management operations permitted by that token. ### Impact Assessment The privileges obtained are limited by the permissions assigned to the stolen organization token. Depending on its scope, an attacker may be able to: - Access organization-level MCPHero resources. - Create, inspect, modify, deploy, or delete MCP serv ...[truncated 315 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:137
Finding

Integration Secrets Submitted Through Command-Line Arguments

Content
View full analysis
=localhost" \ --var "=5432" # Without env vars (empty list): mcpheroctl wizard submit-env-vars $SERVER_ID --json ``` ### Technical Analysis The Skill instructs users to submit actual environment-variable values through repeated `--var "UUID=VALUE"` command-line arguments. Although the example values are non-secret host and port values, the declared use cases include internal databases and authenticated REST APIs. In practical use, these variables may contain passwords, API keys, bearer tokens, connection strings, or other sensitive configuration. Real values can therefore be exposed locally through shell history, process listings, telemetry, terminal recordings, and automation logs. They are also transmitted to and stored or processed by the MCPHero service. The remote transfer is related to the declared hosted deployment functionality, and the audit found no evidence of transmission to an unrelated endpoint. Nevertheless, the Skill does not provide a clear consent boundary, data-handling warning, or least-privilege guidance before credentials are uploaded. ### Attack Path 1. The generated server requires credentials for an internal API, database, or other protected service. 2. The user inserts those credentials into one or more `--var "UUID=VALUE"` arguments. 3. The command and its arguments are captured in shell history, process metadata, endpoint telemetry, CI logs, or terminal recordings. 4. A person or process with access to those records obtains the credenti ...[truncated 1005 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
This skill covers the **mcpheroctl CLI** workflow for building servers end-to-end.

**Production API base URL:** `https://api.mcphero.app/api`

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
This skill covers the **mcpheroctl CLI** workflow for building servers end-to-end.

**Production API base URL:** `https://api.mcphero.app/api`

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · evals/evals.json (reported line 66)May include surrounding context.

json
This skill covers the **mcpheroctl CLI** workflow for building servers end-to-end.

**Production API base URL:** `https://api.mcphero.app/api`

---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly instructs users to save and reuse bearer tokens and shows them embedded in client configuration, but it does not warn that these are sensitive credentials that grant access to deployed MCP servers. In a skill whose purpose is provisioning remote tools and connecting clients to them, omission of secure token-handling guidance materially increases the risk of accidental exposure through shell history, copied config files, logs, screenshots, or source control.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The Claude Desktop example places a live bearer token directly into a local JSON configuration file without any warning about secure storage, local file permissions, backups, or credential leakage. In context, this is more dangerous than a generic external URL because it normalizes embedding reusable credentials in plaintext config for a remotely accessible service.

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

md
{
  "mcpServers": {
    "my-server": {
      "url": "https://api.mcphero.app/mcp/<server-id>/mcp",
      "headers": {
        "Authorization": "Bearer <bearer_token>"
      }

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The server management section includes mcpheroctl server delete SERVER_ID --yes and labels it irreversible, but the skill does not provide a prominent caution about data loss or recommend confirming the target server before deletion. For a markdown skill description covering destructive actions, an explicit warning is expected when user data or service availability may be affected.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This JSON file describes the skill name and example prompts, but it does not provide any explicit trigger constraints, exclusion conditions, or negative examples that would narrow activation. Because manifest files are in scope for SQP-1, the broad description of creating MCP servers could allow unintended invocation in loosely related contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
70% confidence
Finding

The eval explicitly directs configuration for Claude Desktop as the target client, which can be interpreted as forcing a specific client environment without stating that alternatives may be used. Under the language/locale policy category, this is a mild natural-language policy concern because no opt-in or alternative is mentioned in the instruction text.

Content

No source excerpt is available for this finding.