ClawHub
Back to skill

Security audit

skill-mcp

Security checks for vulnerabilities and agentic risk

Overview

This is a small disclosed demo skill, though users should know its test script prints environment variable names when run.

Install this only if you are comfortable with a demo script that may display the names of environment variables visible to it. Run it under the intended mcp-host fence or another sanitized environment if variable names could reveal sensitive infrastructure details.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
The skill is described as a harmless demo, but its declared runnable behavior includes enumerating environment variable names and reporting execution-context details such as argv and working directory. In a real deployment, this can expose sensitive infrastructure metadata, aid fingerprinting of the host environment, and normalize running arbitrary demo code that reveals more than the description suggests.

Ae1

High
Category
analysis-evasion
Content
- script: scripts/report.js
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- script: scripts/report.js
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
- script: scripts/report.js
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
A directory holding `SKILL.md` — YAML frontmatter (`name`, `description`, and
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Env Variable Harvesting

High
Category
Data Exfiltration
Content
const report = {
  argv: process.argv.slice(2),
  cwd: process.cwd(),
  envNames: Object.keys(process.env).sort(),
  node: process.version,
};
process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
Confidence
95% confidence
Finding
The script enumerates all environment variable names and prints them to stdout, which is explicitly noted to flow directly into tool results without downstream redaction. Even without exposing values, variable names can reveal sensitive integrations, cloud providers, secret management schemes, internal infrastructure, and the presence of credentials or tokens, creating unnecessary information disclosure that can aid follow-on attacks.

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill declares and encourages execution of a bundled Node script that can access process environment data, but it provides no explicit tool-scope or permission constraints in the skill metadata. Even though the text warns that declared scripts are still arbitrary code, the absence of scoped permissions increases the chance that a user or host will run it with broader access than intended, enabling environment discovery and possible leakage of sensitive runtime metadata.

Static analysis

No suspicious patterns detected.