Jarvis MCP Filesystem

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:03 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but it gives broad read access to the OpenClaw workspace and installs an unpinned global npm package.

Review this before installing. Use it only with a workspace that does not contain secrets, credentials, or sensitive agent memory, and prefer a pinned, locally scoped install of the MCP filesystem server where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:63

Finding

Unpinned Global npm Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 63–67
Vulnerability Type: Unpinned third-party package installed globally
Risk Level: High

Complete Code Snippet:

markdown

## Установка

```bash
npm install -g mcp-server-filesystem

text

### Technical Analysis

The installation instructions retrieve and globally install the latest available release of `mcp-server-filesystem` without specifying an exact version, lockfile, package integrity hash, or verified build provenance. The project contains no local implementation against which the installed package's behavior can be audited.

Because the package version is mutable, the code executed by users can differ from the code reviewed when this Skill was authored. A compromised npm account, malicious future release, package ownership transfer, or registry-level supply-chain incident could introduce arbitrary lifecycle scripts or malicious runtime behavior. The declared GitHub homepage alone does not cryptographically establish that the npm artifact was built from the referenced source.

Global installation also increases exposure because the executable becomes available system-wide for the installing user and may replace or conflict with an existing executable of the same name.

### Attack Path

1. An attacker compromises the package publisher, obtains package ownership, or otherwise causes a malicious release to be published under the expected npm package name.
2. A user follows the documented `npm install -g mcp-server-filesystem` instruction.
3. npm resolves the mutable latest release rather than a previously audited version.
4. Malicious package lifecycle scripts may execute during installation with the privileges of the installing account.
5. The installed executable may execute additional malicious behavior whenever the Skill invokes the MCP filesystem server.

### Impact Assessment

Successful exploitation can execute arbitrary code wi
...[truncated 470 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specifically reviewed version rather than resolving the latest release.
• Record and verify the package integrity hash using an npm lockfile or an equivalent integrity-controlled installation mechanism.
• Verify that the npm package name, publisher, source repository, and release provenance correspond to the intended upstream project.
• Prefer a local, project-scoped installation over npm install -g to reduce system-wide exposure.
• Use reproducible builds and verify signed release provenance where upstream support is available.
• Disable npm lifecycle scripts during installation where operationally feasible, then explicitly audit any scripts required for normal operation.
• Run the server under a dedicated, minimally privileged account or container with access only to the required filesystem paths.
• Periodically review pinned versions and update them through a controlled security-review process.

other

Warning

• Location: SKILL.md:40

Finding

Filesystem Tool Scope Includes Sensitive Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40–44
Vulnerability Type: Sensitive agent-memory exposure through broad filesystem access
Risk Level: Medium

Complete Code Snippet:

markdown

### get_file_info
Информация о файле (размер, даты, права).
```bash
mcporter call --stdio "mcp-server-filesystem /root/.openclaw/workspace" get_file_info path=/root/.openclaw/workspace/MEMORY.md

text

### Technical Analysis

The Skill configures the MCP filesystem server with `/root/.openclaw/workspace` as its accessible root and explicitly demonstrates access to `MEMORY.md`. The example only obtains file metadata, but the same documented server exposes the general-purpose `read_file` operation throughout that root. Consequently, a caller that can invoke the Skill may substitute `read_file` and retrieve the contents of the memory file or other sensitive workspace files.

Filesystem sandboxing to the workspace prevents the server from directly accessing arbitrary paths outside the configured root, but it does not establish least privilege within that workspace. No file-level denylist, task-specific directory allowlist, or separation of persistent agent state from ordinary documents is documented.

This finding concerns local sensitive-data exposure. The reviewed Skill does not contain a network transmission mechanism or instructions to exfiltrate the retrieved data.

### Attack Path

1. The MCP filesystem server is started with `/root/.openclaw/workspace` as its permitted root.
2. A caller identifies `MEMORY.md` from the documented example or discovers sensitive files using `list_directory` or `search_files`.
3. The caller invokes the advertised `read_file` tool with `/root/.openclaw/workspace/MEMORY.md` instead of invoking only `get_file_info`.
4. The server returns the file contents because the file is located inside the allowed root.
5. The caller gains access to persistent agent context or other sen
...[truncated 523 chars]

Remediation

View remediation

Remediation Suggestions

• Configure the filesystem server with a narrowly scoped, task-specific directory rather than the entire workspace.
• Store persistent agent memory, credentials, and sensitive configuration outside directories exposed to general-purpose filesystem tools.
• Implement explicit allowlists for accessible files and directories and deny access to MEMORY.md, hidden files, credential stores, and configuration containing secrets.
• Separate metadata-only operations from content-reading operations where file contents are not required.
• Apply filesystem permissions so the MCP server's dedicated account cannot read sensitive agent-state files.
• Remove examples that target persistent memory and replace them with non-sensitive sample files.
• Log and audit access to sensitive paths, and require explicit user authorization before exposing persistent agent state.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explicitly grants access to the workspace filesystem and documents file read, directory listing, search, and metadata retrieval capabilities, but it does not warn about confidentiality, sensitive file discovery, or unintended data exposure. Even though access is sandboxed to /root/.openclaw/workspace, that scope can still contain secrets, source code, credentials, prompts, or user data, so omission of safety guidance creates a real information-disclosure risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The natural-language description and operational instructions are presented in Russian throughout the file, with no indication that this locale is optional or intentionally restricted to a Russian-speaking audience. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.