UUMuse Brain

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:11 AM UTC
• Version: 1.1.1

Overview

The skill is coherent with its UUMuse knowledge-base purpose, but it needs review because it runs an unpinned MCP package and can send an API key plus document or memory operations to configurable network endpoints.

Review this skill before installing. Use only a narrowly scoped UUMuse API key, prefer the default HTTPS endpoint or a TLS-protected self-hosted endpoint, avoid plaintext LAN HTTP, and be careful with delete, overwrite, and memory features. The publisher should pin the MCP package version and add explicit confirmation and privacy guidance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: skill.json:44

Finding

Unpinned npm Package Is Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: skill.json:35-51
Vulnerability Type: Unpinned executable dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code

json

"permissions": {
  "network": true,
  "filesystem": false,
  "browser": false,
  "shell": false,
  "notifications": false
},
"mcp": {
  "server": {
    "command": "npx",
    "args": ["-y", "uumuse-mcp"],
    "env": {
      "UUMUSE_API_KEY": "{{config.uumuse_api_key}}",
      "UUMUSE_API_URL": "{{config.uumuse_api_url}}"
    }
  },

The same unpinned execution pattern is documented in README.md:29-30, README.md:61-71, and README.md:86-87:

bash

npx -y uumuse-mcp

Technical Analysis

The MCP server is launched through npx -y uumuse-mcp without an exact package version or integrity constraint. Consequently, npm can resolve and execute whichever release is current at installation or startup time. The Skill manifest has its own version (1.1.1), but that does not constrain the version of the executable uumuse-mcp dependency.

The -y option suppresses interactive confirmation, making package retrieval and execution automatic. If the npm package, publisher account, registry resolution process, or a future release is compromised, attacker-controlled JavaScript can execute under the operating-system account running the Agent.

This behavior also conflicts with the declared "shell": false permission posture. Although the Skill does not directly invoke an interactive shell, it configures the host to start an externally retrieved executable through npx, creating a local code-execution capability not clearly represented by the declared permissions.

No evidence establishes that the current uumuse-mcp package is malicious. The vulnerability is the absence of dependency pinning and reproducible integrity controls.

Attack Path

1. An attacker compromises the npm publisher account, ...[truncated 1234 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP package to an exact reviewed version, for example:

   json

   "command": "npx",
   "args": ["-y", "uumuse-mcp@1.1.1"]
   

2. Prefer installing dependencies from a lockfile with verified integrity hashes rather than resolving a package dynamically at every installation or startup.

3. Vendor or package the reviewed MCP implementation with the Skill when operationally feasible.

4. Establish an explicit dependency-update process that includes source review, provenance validation, and security testing.

5. Use npm provenance/signature verification and a trusted registry configuration where supported.

6. Run the MCP server in a sandbox with minimal filesystem and network access.

7. Provide the MCP process with a narrowly scoped API key rather than an unrestricted credential.

8. Update the permission declaration and documentation so that external process execution is accurately disclosed.

T09 · Insecure Skill Coding Practices

Error

• Location: uumuse_mcp_stdio.py:34

Finding

Bearer Credential and Sensitive MCP Payloads Can Be Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: uumuse_mcp_stdio.py:12-13, uumuse_mcp_stdio.py:21-22, and uumuse_mcp_stdio.py:34-50
Vulnerability Type: Plaintext transmission of credentials and sensitive data
Risk Level: High when an http:// endpoint is configured

Vulnerable Code

The module documentation explicitly presents a plaintext HTTP endpoint as a supported example:

python

环境变量：
    UUMUSE_MCP_URL  — MCP HTTP 端点 URL（必填，如 http://192.168.4.58:8082/mcp/）
    UUMUSE_API_KEY  — API Key（必填，如 sk-uu-xxx）

The endpoint and credential are read directly from the environment:

python

MCP_URL = os.environ.get("UUMUSE_MCP_URL", "").rstrip("/")
API_KEY = os.environ.get("UUMUSE_API_KEY", "")

The bridge then places the credential in an Authorization header and sends the complete JSON-RPC payload to the configured URL without validating that TLS is in use:

python

def _post(payload: str) -> str:
    """发送 JSON-RPC 到 MCP HTTP 端点，返回响应体"""
    global _session_id

    headers = {
        "Content-Type": "application/json",
        "Accept": "application/json, text/event-stream",
        "Authorization": f"Bearer {API_KEY}",
    }
    if _session_id:
        headers["Mcp-Session-Id"] = _session_id

    url = MCP_URL if MCP_URL.endswith("/") else MCP_URL + "/"
    req = urllib.request.Request(url, data=payload.encode("utf-8"), headers=headers, method="POST")

    try:
        with urllib.request.urlopen(req, timeout=120) as resp:

Technical Analysis

The bridge accepts the configured URL without enforcing https://. Python's urllib.request.urlopen therefore sends requests over plaintext when UUMUSE_MCP_URL uses http://.

Each request includes Authorization: Bearer <API_KEY> and the full JSON-RPC request body. Depending on the invoked UUMuse tool, that body can contain:

• Search terms concerning private documents.
• Questions sent to the knowledge ...[truncated 2698 chars]

Remediation

View remediation

Remediation Suggestions

1. Reject plaintext endpoints before processing requests:

   python

   from urllib.parse import urlparse
   
   parsed = urlparse(MCP_URL)
   if parsed.scheme != "https":
       _fatal("UUMUSE_MCP_URL must use HTTPS")
   

2. Permit HTTP only for an explicitly enabled loopback-only development mode, and verify that the destination is localhost, 127.0.0.1, or ::1.

3. For self-hosted LAN deployments, require a valid TLS certificate or place the service behind a mutually authenticated TLS tunnel.

4. Do not provide plaintext HTTP endpoints as normal configuration examples. Replace them with HTTPS examples and prominent transport-security warnings.

5. Use short-lived, revocable API keys with the minimum required scopes. Separate read-only and write-capable credentials when possible.

6. Validate the destination host against an administrator-defined allowlist to reduce accidental credential disclosure to an unintended endpoint.

7. Disable automatic cross-origin redirects or verify the scheme and destination after redirects so that credentials cannot be forwarded to an untrusted or plaintext location.

8. Rotate any API key that may already have been used over an untrusted plaintext network.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (11)

Tainted flow: 'req' from os.environ.get (line 47, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · uumuse_mcp_stdio.py (reported line 50)May include surrounding context.

python

req = urllib.request.Request(url, data=payload.encode("utf-8"), headers=headers, method="POST")

    try:
        with urllib.request.urlopen(req, timeout=120) as resp:
            # 记录服务端返回的 session ID
            sid = resp.headers.get("Mcp-Session-Id")
            if sid:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README encourages users to upload PDFs, documents, and web pages to an external UUMuse service, but does not provide a clear privacy or data-sharing warning. This is dangerous because users may unknowingly send sensitive or regulated content to a third-party service, where it is stored, processed, and made accessible through agent tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub@latest install uumuse-brain, which fetches and executes the latest published package version at install time. This creates a supply-chain risk: if the package or a dependency is compromised, users may execute attacker-controlled code with their local user privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The MCP server is launched via npx -y uumuse-mcp without a pinned version, causing on-demand download and execution of whatever version is current in the registry. In the skill context, this is especially sensitive because the server handles API keys and access to user documents, so a compromised update could exfiltrate secrets or manipulate workspace data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The verification example again tells users to execute npx -y uumuse-mcp without version pinning, reinforcing a pattern of dynamic code execution from the package registry. Because this command is presented as a trust-building verification step, users may be more likely to run it without scrutiny, increasing supply-chain exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises tools that can edit, append, delete, and forget workspace content, but it does not explicitly warn users that the skill can modify or permanently remove remote data. In an agent setting, this increases the risk of accidental destructive actions or overbroad user trust, especially when the agent operates across messaging platforms.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

- When the user asks to list UUMuse workspaces, call `uumuse-lan__uumuse_workspaces` if available; otherwise call `uumuse_workspaces` directly.
- Never use shell commands, `npx`, `npm`, `uumuse-mcp`, `@openclaw/mcp-uumuse`, local source-code search, or local filesystem search as a substitute for UUMuse MCP tools.
- Never use `nodes`, `sessions_spawn`, paired-device commands, or subagents to call UUMuse. UUMuse is a configured local stdio/HTTP MCP server, not a paired mobile node.
- The API key and LAN/API URL are provided by the configured MCP server environment. Do not ask the user for `UUMUSE_API_KEY` unless the injected UUMuse MCP tools are unavailable.
- If tools are not available, tell the user to run the UUMuse install script or check their MCP configuration.

## When to Use

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes destructive capabilities like file deletion and memory deletion but does not require an explicit confirmation step before invoking them. In an agent setting, this creates a real risk of accidental or prompt-induced irreversible data loss, especially because embeddings and stored memory are described as permanently removed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill encourages proactive use of persistent memory to store preferences, facts, decisions, and context without requiring clear user consent or notifying the user that data will persist across sessions. This can lead to unanticipated retention of sensitive personal or organizational information and increases privacy risk if the agent stores more than the user intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description contains broad trigger language such as references to knowledge bases, documents, searching, and answering from files, which can cause the skill to activate for generic document-related requests rather than clearly UUMuse-scoped intent. This increases the chance of unintended routing of user queries and unnecessary transmission of user prompts or document-related context to the external UUMuse service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest explicitly says the skill can search uploaded documents, read files, and manage long-term memory, yet it does not warn users that prompts, document queries, and potentially sensitive knowledge-base data may be sent to a remote network service. In a skill with network access and API-key-based remote MCP endpoints, this lack of disclosure creates a meaningful privacy and data-handling risk through uninformed use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.