Debridge Mcp

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:05 PM UTC
• Version: 0.1.0

Overview

This skill is clearly about deBridge crypto swaps, but it installs and persists unaudited remote code that can initiate high-impact financial actions.

Review this before installing. Only use it if you trust the upstream deBridge MCP repository and are comfortable letting an OpenClaw-connected MCP server help create crypto orders. Prefer a pinned audited commit, deterministic dependency install, and wallet-level spending/chain limits before enabling it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: setup.sh:12

Finding

Unpinned Remote Repository Is Retrieved and Executed

Content

View full analysis

Vulnerability Details

File Location: setup.sh, lines 12-20
Vulnerability Type: Remote payload retrieval and supply-chain code execution
Risk Level: Medium

bash

else
    echo "Cloning deBridge MCP..."
    git clone https://github.com/debridge-finance/debridge-mcp.git ~/debridge-mcp
fi

cd ~/debridge-mcp
echo "Installing dependencies..."
npm install
echo "Building..."
npm run build

Technical Analysis

The setup script clones the current state of a remote repository without pinning an audited commit, release, or cryptographic digest. It then runs npm install and npm run build from that repository. Both commands can execute repository-controlled code, including npm lifecycle hooks and build scripts.

The effective payload can therefore change after this skill has been reviewed. If $HOME/debridge-mcp already exists, the script also trusts that directory without verifying its Git remote, ownership, integrity, or revision. This creates an additional local substitution path.

The installation instructions in SKILL.md, lines 14-17, reproduce the same unsafe workflow:

bash

git clone https://github.com/debridge-finance/debridge-mcp.git ~/debridge-mcp
cd ~/debridge-mcp
npm install
npm run build

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or a resolved npm dependency; alternatively, the attacker places a malicious project at $HOME/debridge-mcp.
2. The attacker adds a malicious npm lifecycle hook, build command, dependency, or other repository-controlled executable content.
3. A user runs setup.sh or follows the equivalent commands in SKILL.md.
4. npm install or npm run build executes the attacker-controlled payload with the user's privileges.
5. If the generated MCP server is subsequently registered with OpenClaw, compromised code may run again whenever OpenClaw launches that server.

Impact Assessment

Su ...[truncated 650 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository to a specific audited commit or immutable, signed release rather than using the current default branch.
2. Verify the downloaded revision using an expected commit hash and, where available, a trusted release signature.
3. Commit and review a dependency lockfile, then use npm ci instead of npm install to enforce deterministic dependency resolution.
4. Disable npm lifecycle scripts with npm ci --ignore-scripts when functionality permits. If lifecycle scripts are required, review and explicitly allow only the necessary scripts.
5. Before using an existing $HOME/debridge-mcp directory, verify that it is a Git repository with the expected remote URL, pinned revision, ownership, and clean working tree. Otherwise, stop installation rather than trusting it.
6. Build and run the MCP server in a sandbox or container with minimal filesystem, network, credential, and wallet access.
7. Require explicit user review and confirmation before enabling the resulting MCP server, particularly because its tools can initiate cryptocurrency transactions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · setup.sh (reported line 30)May include surrounding context.

sh

# Add MCP config (simplified - user may need to manually merge)
    echo "⚠️ Manual step needed: Add MCP adapter config to openclaw.json"
    echo "See: ~/.openclaw/workspace/skills/debridge-mcp/SKILL.md"
else
    echo "MCP adapter already configured"
fi

Static analysis

No suspicious patterns detected.