ClawHub
Back to skill

Security audit

Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its WooCommerce import purpose, but it can modify store catalog data and run an unpinned MCP startup package while handling an API key.

Review this before installing on a live store. Use a narrowly scoped, revocable Yundian API key; keep the API URL set only to the intended trusted HTTPS origin; avoid bulk imports unless you have checked the source and target behavior; and prefer a version that pins dependencies, includes a lockfile, and runs a local installed `tsx` binary instead of `npx -y`.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:22
Finding

Automatic Execution of an Unpinned Runtime Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-23
Vulnerability Type: Unpinned third-party package retrieval and execution
Risk Level: High

Vulnerable Code

json
"command": "npx",
"args": ["-y", "tsx", "{baseDir}/mcp-server.ts"],

Technical Analysis

The MCP configuration invokes npx -y tsx without specifying a package version. The tsx package is also absent from package.json, meaning npx can retrieve it dynamically from the configured npm registry when the server starts. The -y option suppresses the normal installation confirmation.

Consequently, the code executed at startup is not fully represented by the audited project. Its effective behavior can change after review because package resolution depends on the registry state, npm configuration, cache state, and available package versions.

Attack Path

  1. An attacker compromises the upstream tsx package, its maintainer account, the configured npm registry, or the package-resolution channel.
  2. A malicious or otherwise compromised release becomes the version selected by the unpinned npx invocation.
  3. The user starts the MCP server according to the documented configuration.
  4. npx -y downloads and executes the selected package without an interactive confirmation.
  5. The package executes with the operating-system privileges and environment of the MCP process.

Impact Assessment

Successful exploitation permits arbitrary code execution under the account running OpenClaw or the MCP server. This can expose environment variables—including YUNDIAN_WOO_IMPORTER_API_KEY—and any files, network resources, or local processes accessible to that account. The code could also alter local files or interfere with MCP communications. This does not inherently provide administrator privileges, but its scope equals the privileges granted to the Agent process.

Remediation
View remediation

Remediation Suggestions

  1. Add tsx to package.json using an exact, reviewed version rather than a range.
  2. Generate and commit a package-lock.json containing integrity hashes.
  3. Install dependencies with npm ci from the committed lockfile.
  4. Invoke the project-local executable, such as node_modules/.bin/tsx, instead of allowing npx to download packages automatically.
  5. Remove the -y automatic-download workflow from the documented MCP configuration.
  6. Use a trusted registry and consider restricting installation scripts where operationally feasible.

T08 · Insecure Dependencies

Warning
Location
package.json:6
Finding

Non-Reproducible Dependency Resolution

Content
View full analysis

Vulnerability Details

File Location: package.json, lines 6-8; related installation instruction at SKILL.md, line 5
Vulnerability Type: Unlocked and loosely versioned dependency
Risk Level: Medium

Vulnerable Code

package.json, lines 6-8:

json
"dependencies": {
  "@modelcontextprotocol/sdk": "^1.0.0"
}

Related installation configuration in SKILL.md, line 5:

yaml
metadata: { "openclaw": { "requires": { "env": ["YUNDIAN_WOO_IMPORTER_API_KEY"], "bins": ["node", "npm", "npx"] }, "primaryEnv": "YUNDIAN_WOO_IMPORTER_API_KEY", "emoji": "🛍️", "homepage": "https://ydplus.net", "install": "npm install" } }

No dependency lockfile is present in the audited project.

Technical Analysis

The caret range ^1.0.0 permits npm to install later compatible releases of @modelcontextprotocol/sdk. The documented npm install operation is not backed by a committed lockfile, so installations performed at different times can resolve to different dependency versions and transitive dependency trees.

This prevents reproducible verification of the code loaded by mcp-server.ts. Because imported npm modules execute within the MCP server process, a compromised or unexpectedly changed dependency receives the same process access as the server.

Attack Path

  1. An attacker compromises a permitted release of @modelcontextprotocol/sdk, one of its transitive dependencies, a package maintainer, or the configured registry.
  2. The compromised version remains compatible with the declared ^1.0.0 range.
  3. A user follows the installation instruction and runs npm install.
  4. Without a lockfile, npm resolves and installs the affected dependency tree.
  5. The MCP server imports the installed package, causing attacker-controlled code to execute in the Agent process.

Impact Assessment

Exploitation can result in code execution with the MCP server user's privileges. Accessible assets include ...[truncated 321 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the caret dependency range with an exact, reviewed version.
  2. Generate and commit package-lock.json.
  3. Change installation guidance from npm install to npm ci.
  4. Review and update dependencies through a controlled process that includes vulnerability scanning and source-change assessment.
  5. Verify lockfile integrity in CI and reject unreviewed dependency-tree modifications.
  6. Consider disabling dependency lifecycle scripts during installation when they are not required.

T09 · Insecure Skill Coding Practices

Warning
Location
mcp-server.ts:17
Finding

Bearer Credential Can Be Sent to an Untrusted or Plaintext API Endpoint

Content
View full analysis

Vulnerability Details

File Location: mcp-server.ts, line 17 and lines 91-110
Vulnerability Type: Insufficient destination and transport validation for sensitive network data
Risk Level: Medium

Vulnerable Code

API endpoint selection at line 17:

ts
const API_URL = process.env.YUNDIAN_WOO_IMPORTER_API_URL || "http://localhost:3000"; // Note: Use the actual port where the app is running

Credential and import-data transmission at lines 91-101:

ts
const response = await fetch(`${API_URL}/api/v1/import`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": `Bearer ${API_KEY}`
  },
  body: JSON.stringify(request.params.arguments)
});
const data = await response.json();
return {
  content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
};

Credential and request-ID transmission at lines 104-110:

ts
const { requestId } = request.params.arguments as any;
const response = await fetch(`${API_URL}/api/v1/status?requestId=${requestId}`, {
  headers: {
    "Authorization": `Bearer ${API_KEY}`
  }
});
const data = await response.json();

Technical Analysis

Supplying the API key to the Yundian+ service is necessary for the Skill's declared import functionality, and SKILL.md documents the intended endpoint as https://ydplus.net. However, the implementation trusts an arbitrary value from YUNDIAN_WOO_IMPORTER_API_URL and does not validate the URL scheme, hostname, port, or origin before attaching the Bearer credential.

The fallback endpoint uses plaintext HTTP. Although loopback HTTP may be acceptable in a strictly local development configuration, the code does not verify that the resulting URL remains loopback-only. An unsafe or attacker-controlled environment value can therefore redirect the API key, submitted product links, Shopify or Wix store URLs, and status request IDs to another server.

At

...[truncated 1430 chars]

Remediation
View remediation

Remediation Suggestions

  1. Default to the documented production origin, https://ydplus.net, rather than plaintext HTTP.
  2. Parse the configured value with new URL() and reject unsupported schemes.
  3. Require HTTPS for all non-loopback destinations.
  4. Enforce an explicit allowlist of approved API origins before attaching the Authorization header.
  5. If local development is required, permit HTTP only when the parsed hostname is exactly a recognized loopback address such as localhost, 127.0.0.1, or ::1.
  6. Reject URLs containing unexpected credentials, paths, query strings, fragments, or ports.
  7. Apply short request timeouts and explicit redirect handling. Avoid forwarding credentials across redirects or origins.
  8. Use narrowly scoped and revocable API keys, and rotate any key suspected of having been transmitted to an untrusted endpoint.
  9. Document precisely what information is sent to Yundian+ and obtain user confirmation before transmitting sensitive or private source URLs.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill provisions executable components (npx, tsx, Node) and network/API access via environment-provided credentials, but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent may invoke capability-bearing infrastructure without clear policy boundaries, increasing the chance of unintended code execution, secret exposure, or outbound requests beyond what a reviewer expects from the manifest alone.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill repeatedly instructs the agent to import products directly into WooCommerce, which is a state-changing operation affecting production store data, but it does not warn about destructive or business-impacting consequences or require confirmation. In an autonomous or semi-autonomous agent context, this can lead to accidental bulk imports, duplicate catalog entries, unwanted publication, or operational disruption from a casual user request.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency is specified with a caret range (^1.0.0), which permits newer minor and patch releases to be installed without explicit review. This weakens build reproducibility and can unintentionally pull in a vulnerable or breaking version from the supply chain, especially significant for an MCP-facing skill that depends on protocol and transport behavior.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json
"description": "Yundian+ WooCommerce Importer Skill",
  "main": "mcp-server.ts",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.0.0"
  }
}

Unverifiable Dependency: @modelcontextprotocol/sdk has 3 known advisory(ies) (CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport); CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
87% confidence
Finding

The manifest references @modelcontextprotocol/sdk without pinning an exact version, and the package has known advisories including cross-client data leakage, ReDoS, and missing DNS rebinding protections in some releases. Because the actual installed version is not fixed, the skill may resolve to an affected release, creating avoidable exposure in a component that likely handles external tool/server communications.

Content

No source excerpt is available for this finding.