ClawHub
Back to skill

Security audit

therapyportal-mcp

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marks this skill suspicious because scanners report that its authenticated portal helper can make unrestricted changes and expose sensitive records, beyond its stated read-only purpose.

Consider avoiding installation unless you need this skill and can accept the reported risk of portal changes and sensitive data exposure. The scan is incomplete: Skillspector inspected two of three components, and its tool-misuse analysis was degraded after a parser limit, so the available evidence does not establish that unreported behavior is safe.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

The raw command exposes unrestricted authenticated portal POST requests despite the skill's read-only purpose.

High
Category
Excessive Agency
Confidence
98% confidence
Finding

The raw branch accepts a caller-selected endpoint and form fields, while post automatically supplies the signed-in session's anti-forgery token and practice context. Consequently, the helper does not enforce its read-only promise: a caller could invoke mutation endpoints available to that session, potentially sending messages or changing portal records, subject to the portal's own authorization and validation.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: network.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The unrestricted raw command exposes sensitive demographic records beyond the skill's stated portal-reading purpose.

Medium
Category
Excessive Agency
Confidence
96% confidence
Finding

The documented raw command bypasses the projected commands' data minimization and can return full demographic records, including potentially populated SSN fields and free-text comments. Although this does not demonstrate bypassing portal authorization, exposing unnecessary mental-health-linked information to agent output or logs is particularly dangerous for minors; prose instructions to filter with jq are not an enforced boundary.

Content

No source excerpt is available for this finding.