ClawHub
Back to skill

Security audit

coros-mcp

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real COROS login helper, but it also stores COROS tokens locally and lets the agent make broad authenticated MCP tool calls, so it should be reviewed before installation.

Install only if you intend to let OpenClaw authenticate to COROS, save COROS tokens locally, and allow the agent to list and call COROS MCP tools on your behalf. Prefer the browser login flow, avoid the legacy password mode unless necessary, review tool schemas before sensitive actions, and use the provided logout command to clear saved local login state when done.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding
The skill declares no permissions while instructing the agent to run Python scripts, invoke the OpenClaw CLI, access local cache files, and make network requests to COROS endpoints. This is a real security issue because the operator and any policy engine are not given an accurate view of the skill's capabilities, reducing informed consent and weakening permission-based controls.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The declared purpose says the skill installs or refreshes a COROS MCP connection, but the instructions also enable broader post-authentication behavior: listing tools, inspecting schemas, invoking arbitrary MCP tools with user-supplied JSON, persisting session state, and supporting a legacy username/password flow. This mismatch is dangerous because a user or reviewer may approve a seemingly narrow login helper without realizing it can perform authenticated actions against the remote service and store additional sensitive state locally.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The skill is presented as a login/install helper, but it also exposes generic MCP enumeration and invocation capabilities through list_tools, describe_tool, and call_tool. That materially expands the trust boundary: once authenticated, the script can be used as a general remote action client against the MCP server, which exceeds the stated purpose and increases the chance of misuse or unexpected privileged operations.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
call_tool allows arbitrary remote MCP tool execution with attacker-controlled tool names and arguments, using the stored bearer token. In a skill whose declared purpose is only to install or refresh a COROS MCP connection, this is an unjustified remote execution capability that could trigger sensitive server-side actions, data access, or state changes under the user's authorization.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_skill_script.py:31