ClawHub
Back to skill

Security audit

Cloudways MCP

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Cloudways operations guide with high-impact capabilities, but its access and safety instructions are purpose-aligned and explicit.

Install only with the minimum Cloudways token role needed. Use READ tokens for audits and monitoring, LIMITED tokens for specific write workflows, and FULL ACCESS only when you intentionally want the agent able to perform destructive account-wide operations after confirmation. Avoid legacy API keys, keep tokens out of committed files and logs, and review every write confirmation carefully, especially deletes, restores, team changes, billing changes, and whitelist updates.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
> Treat the token like a password — never commit it or print it in responses. Prefer one token **per integration** (per MCP connection), each with the minimum role it needs, so tokens can be revoked individually.

> **Legacy API key — deprecated.** The old flow (API key + `X-CW-Email`/`X-CW-Api-Key` headers) still works but the API key **stops working on October 15, 2026**. If you have an existing connection using the old headers, regenerate as an Access Token and update the connection before then. Until migrated, a legacy connection retains **unrestricted full-account access** — the RBAC roles apply only to Access Tokens. And note there is still **no per-tool permission control at the MCP layer** beyond the token's role: a FULL ACCESS token can call every tool.

**Required headers** (every request; header names are case-sensitive):
Confidence
89% confidence
Finding
The document explicitly states that a FULL ACCESS token can call every tool and that legacy API credentials retain unrestricted full-account access. In the context of an MCP skill for infrastructure management, this creates a real capability-risk: once such credentials are configured, the agent can potentially perform destructive server and application actions across the account if higher-level confirmation controls fail or are bypassed.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/installation.md:119