ClawHub
Back to skill

Security audit

portal-security-watch

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed security-advisory helper that uses an external read-only MCP portal, with no evidence of hidden execution, destructive behavior, or credential access.

Install only if you are comfortable sending security-advisory queries and watchlist-like package/vendor/product names to the Chinng portal endpoint. For sensitive environments, verify the service operator and validate important vulnerability claims against upstream advisory sources before acting on them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unverified Third-Party MCP Service Introduces Supply-Chain and Data-Integrity Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 10
Vulnerability Type: Unverified external service dependency
Risk Level: Medium

Vulnerable instruction:

text
Standalone install (no plugin): register the read-only MCP endpoint first — `openclaw mcp add portal --transport http https://portal.chinng-lab-srv.dev/mcp`. Other MCP clients: https://portal.chinng-lab-srv.dev/mcp.

Technical Analysis

The Skill instructs users to persistently register an externally controlled MCP endpoint hosted on a third-party domain. The instruction does not specify endpoint ownership verification, authentication, integrity controls, a trust policy, or restrictions on the MCP tools exposed to the agent.

Although the endpoint is described as “read-only,” that property is asserted only in documentation and is not enforced by the displayed registration command. The remote service controls the advisory records, metadata, and MCP responses received by the agent. A compromised or malicious service could therefore return fabricated, altered, or selectively omitted vulnerability information. It could also observe security-related requests, including watched package, product, vendor, CVE, and OSV identifiers.

No evidence shows that the endpoint delivers or executes local code, obtains elevated operating-system privileges, or installs a system service. The confirmed risk is limited to reliance on an insufficiently verified external component, disclosure of queries sent to that component, persistent client configuration, and manipulation of security-report inputs.

Attack Path

  1. A user follows the installation instruction and registers https://portal.chinng-lab-srv.dev/mcp as the portal MCP server.
  2. The MCP configuration remains available to subsequent agent operations until the user removes or changes it.
  3. The Skill directs the agent to send package watchlists, vendor or product searches, and vulnerability identi ...[truncated 1051 chars]
Remediation
View remediation

Remediation Suggestions

  1. Verify and document the endpoint's owner, operational security controls, privacy policy, retention behavior, and incident-response process.
  2. Prefer a verified first-party or self-hosted MCP endpoint for security-sensitive workloads.
  3. Require explicit user approval before persistently registering the remote server, and provide a documented command for removing the registration.
  4. Restrict the MCP client to an allowlist of required read-only tools and reject unexpected capabilities or capability changes.
  5. Add authentication and server-identity controls where supported. Continue requiring TLS and fail closed on certificate validation errors.
  6. Validate vulnerability identifiers, affected-version claims, fixed versions, and source links against authoritative upstream advisories before including them in reports.
  7. Minimize request data and avoid submitting private asset inventories, internal deployment details, credentials, or other sensitive information.
  8. Document that “read-only” describes expected server behavior rather than a guarantee enforced by the shown registration command.
  9. Consider pinning or monitoring the service's expected capabilities and alerting when its MCP metadata or tool definitions change.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep