ClawHub
Back to skill

Security audit

Ben Mcadams Mcp

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple public MCP connector, with one supply-chain caution for the optional unpinned npx setup command.

Install only if you want this public personal-site MCP server available in your client. Prefer the direct URL configuration when supported; if you need the npx stdio bridge, consider pinning and reviewing the mcp-remote package version before running it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:28
Finding

Unpinned npm Package Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:28-30
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

The affected setup instruction is:

bash
npx -y mcp-remote https://benmcadams.info/api/mcp

Technical Analysis

The documented command executes mcp-remote through npx without specifying an exact package version or verifying its integrity. Consequently, package resolution can select a mutable current release rather than a previously reviewed artifact.

The -y option automatically accepts the installation prompt, reducing the opportunity for the user to inspect the resolved package and version before execution. npm packages can run executable package code and lifecycle hooks with the invoking user's privileges. Therefore, compromise of the package, its publishing account, or its dependency chain could turn this setup command into a local code-execution vector.

The audit did not establish that mcp-remote is malicious. The confirmed issue is the unsafe, unpinned dependency-execution pattern and the resulting supply-chain exposure.

Attack Path

  1. An attacker compromises the mcp-remote package, its maintainer account, or a transitive dependency and publishes a malicious release.
  2. A user follows the documented stdio-only client setup instruction.
  3. npx resolves and downloads the mutable package release because no exact version or integrity constraint is provided.
  4. The -y flag allows installation to proceed without an interactive confirmation.
  5. Malicious package code or lifecycle hooks execute with the operating-system privileges of the user running the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's account. Depending on that account's permissions and environment, an attacker could access user-readable files, environment variables, MCP client configuration, and credentials av ...[truncated 390 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin mcp-remote to an exact, reviewed version rather than allowing mutable latest-version resolution.
  • Record the dependency in a lockfile where the supported client workflow permits it.
  • Use npm integrity verification or another cryptographic checksum mechanism for the reviewed artifact.
  • Document the expected package name, exact version, publisher, registry, and source repository so users can validate provenance.
  • Remove -y from security-sensitive installation guidance where practical, allowing users to inspect the resolved dependency before installation.
  • Prefer installing and reviewing the pinned package separately before executing it.
  • Regularly review the pinned release and its transitive dependency tree before performing controlled version upgrades.

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

name: ben-mcadams-mcp description: Connect to Ben McAdams's personal MCP server for his resume, portfolio, and blog notes. version: 1.0.0 metadata: openclaw: always: true emoji: "🧑‍💻" homepage: https://benmcadams.info

Ben McAdams MCP

Ben McAdams's personal site (benmcadams.info) runs a remote MCP server with structured access to his resume, portfolio, and blog notes. No install or credentials needed — it's a public HTTP endpoint.

Setup

Add to your MCP client config:

json
{
  "mcpServers": {
    "ben-mcadams": {
      "url": "https://benmcadams.info/api/mcp"
    }
  }
}

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs users to execute npx -y mcp-remote without pinning an exact package version, which creates a supply-chain risk: a future malicious or compromised release of mcp-remote would be pulled and executed automatically. This is more dangerous in skill content because users are likely to copy-paste setup commands directly, giving the package immediate execution in their environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.