Debridge Mcp

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:05 PM UTC
• Version: 0.1.0

Overview

This skill is clearly about deBridge crypto swaps, but it installs and persists unaudited remote code that can initiate high-impact financial actions.

Review this before installing. Only use it if you trust the upstream deBridge MCP repository and are comfortable letting an OpenClaw-connected MCP server help create crypto orders. Prefer a pinned audited commit, deterministic dependency install, and wallet-level spending/chain limits before enabling it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: setup.sh:12
• Finding: Unpinned Remote Repository Is Retrieved and Executed## Vulnerability Details **File Location**: `setup.sh`, lines 12-20 **Vulnerability Type**: Remote payload retrieval and supply-chain code execution **Risk Level**: Medium ```bash else echo "Cloning deBridge MCP..." git clone https://github.com/debridge-finance/debridge-mcp.git ~/debridge-mcp fi cd ~/debridge-mcp echo "Installing dependencies..." npm install echo "Building..." npm run build ``` ### Technical Analysis The setup script clones the current state of a remote repository without pinning an audited commit, release, or cryptographic digest. It then runs `npm install` and `npm run build` from that repository. Both commands can execute repository-controlled code, including npm lifecycle hooks and build scripts. The effective payload can therefore change after this skill has been reviewed. If `$HOME/debridge-mcp` already exists, the script also trusts that directory without verifying its Git remote, ownership, integrity, or revision. This creates an additional local substitution path. The installation instructions in `SKILL.md`, lines 14-17, reproduce the same unsafe workflow: ```bash git clone https://github.com/debridge-finance/debridge-mcp.git ~/debridge-mcp cd ~/debridge-mcp npm install npm run build ``` ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or a resolved npm dependency; alternatively, the attacker places a malicious project at `$HOME/debridge-mcp`. 2. The attacker adds a malicious npm lifecycle hook, build command, dependency, or other repository-controlled executable content. 3. A user runs `setup.sh` or follows the equivalent commands in `SKILL.md`. 4. `npm install` or `npm run build` executes the attacker-controlled payload with the user's privileges. 5. If the generated MCP server is subsequently registered with OpenClaw, compromised code may run again whenever OpenClaw launches that server. ### Impact Assessment Su ...[truncated 650 chars]
• Remediation: ## Remediation Suggestions 1. Pin the repository to a specific audited commit or immutable, signed release rather than using the current default branch. 2. Verify the downloaded revision using an expected commit hash and, where available, a trusted release signature. 3. Commit and review a dependency lockfile, then use `npm ci` instead of `npm install` to enforce deterministic dependency resolution. 4. Disable npm lifecycle scripts with `npm ci --ignore-scripts` when functionality permits. If lifecycle scripts are required, review and explicitly allow only the necessary scripts. 5. Before using an existing `$HOME/debridge-mcp` directory, verify that it is a Git repository with the expected remote URL, pinned revision, ownership, and clean working tree. Otherwise, stop installation rather than trusting it. 6. Build and run the MCP server in a sandbox or container with minimal filesystem, network, credential, and wallet access. 7. Require explicit user review and confirmation before enabling the resulting MCP server, particularly because its tools can initiate cryptocurrency transactions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Skill Enumeration

Medium

• Category: Agent Snooping

Content

# Add MCP config (simplified - user may need to manually merge)
    echo "⚠️ Manual step needed: Add MCP adapter config to openclaw.json"
    echo "See: ~/.openclaw/workspace/skills/debridge-mcp/SKILL.md"
else
    echo "MCP adapter already configured"
fi

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Static analysis

No suspicious patterns detected.