T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:53- Finding
Sensitive credentials are submitted to an externally hosted MCP service without documented safeguards
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 53-56, 80-82, and 131-143
Vulnerability Type: Third-party credential exposure and excessive trust
Risk Level: HighVulnerable Code Snippets
SKILL.md, lines 53-56:markdown | `wizard_submit_env_vars` | Submit values as `{uuid: value}` dict | | `wizard_set_auth` | Generate bearer token | | `wizard_generate_code` | Trigger code gen (async) | | `wizard_regenerate_tool_code` | Regenerate single tool code (sync) |SKILL.md, lines 80-82:markdown 9. wizard_submit_env_vars → Provide values as {uuid: value} dict (call even if empty) 10. wizard_set_auth → Generate bearer token 11. wizard_generate_code → Trigger code generation (async → poll)SKILL.md, lines 131-143:markdown ### Claude Desktop config ```json { "mcpServers": { "my-server": { "url": "https://api.mcphero.app/mcp/<server-id>/mcp", "headers": { "Authorization": "Bearer <bearer_token>" } } } }text ### Technical Analysis The documented workflow directs users to submit environment-variable values, including API credentials, to the externally hosted service at `api.mcphero.app`. It also instructs users to configure a bearer token in an MCP client. While credentials may be necessary for the intended integration, the Skill does not document: - How submitted secrets are stored, encrypted, retained, or deleted. - Whether generated tools can read all submitted environment variables. - Whether operators of the hosted service can access the credentials. - Whether secrets are isolated between servers or tenants. - Any required user confirmation before transmitting production credentials. - Least-privilege, expiration, rotation, or secret-revocation requirements. Consequently, users may provide long-lived production credentials that grant the hosted MCP server broader access than ...[truncated 1747 chars]- Remediation
View remediation
Remediation Suggestions
- Add an explicit warning before
wizard_submit_env_varsthat secret values are transmitted to and processed by an external hosted service. - Require an affirmative user approval step before submitting any non-empty environment-variable values.
- Document secret storage, encryption, tenant isolation, retention, access logging, and deletion policies.
- Recommend short-lived, revocable, service-specific credentials instead of personal or long-lived production tokens.
- Require least-privilege scopes that permit only the API operations exposed by the generated MCP tools.
- Prohibit credential reuse across development, staging, and production environments.
- Integrate with a managed secrets vault so raw credentials do not need to appear in prompts, logs, or generated configuration.
- Redact credentials from wizard responses, telemetry, error messages, and audit logs.
- Provide documented rotation and immediate revocation procedures.
- Warn users that bearer tokens stored directly in MCP client configuration files must be protected with restrictive filesystem permissions.
- Add an explicit warning before