ClawHub
Back to skill

Security audit

Mcp Hello World

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent MCP demo skill that exposes only simple add and greeting tools, with supply-chain hygiene issues users should review before installing.

Before installing, be comfortable with a Node.js MCP demo that installs npm dependencies. Prefer using the official npm registry or a reviewed lockfile, update vulnerable dependencies where possible, and note that the docs and tool messages are Chinese-first.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
package-lock.json:18
Finding

Dependencies Are Locked to a Third-Party npm Mirror

Content
View full analysis

Vulnerability Details

File Location: package-lock.json:18-31; related registry configuration in 开发记录.md:29-30; automatic installation path in start.sh:18-21
Vulnerability Type: Supply-chain exposure through a non-default dependency source
Risk Level: Medium

Vulnerable Code

package-lock.json:18-31:

json
"node_modules/@hono/node-server": {
  "version": "1.19.11",
  "resolved": "https://registry.npmmirror.com/@hono/node-server/-/node-server-1.19.11.tgz",
  "integrity": "sha512-dr8/3zEaB+p0D2n/IUrlPF1HZm586qgJNXK1a9fhg/PzdtkK7Ksd5l312tJX2yBuALqDYBlG20QEbayqPyxn+g==",
  "license": "MIT",
  "engines": {
    "node": ">=18.14.1"
  },
  "peerDependencies": {
    "hono": "^4"
  }
},
"node_modules/@modelcontextprotocol/sdk": {
  "version": "1.27.1",
  "resolved": "https://registry.npmmirror.com/@modelcontextprotocol/sdk/-/sdk-1.27.1.tgz",
  "integrity": "sha512-sr6GbP+4edBwFndLbM60gf07z0FQ79gaExpnsjMGePXqFcSSb7t6iscpjk9DhFhwd+mTEQrzNafGP8/iGGFYaA==",

开发记录.md:29-30:

bash
npm config set registry https://registry.npmmirror.com
npm install @modelcontextprotocol/sdk zod

The same third-party host is used for the remaining dependency archive URLs throughout package-lock.json.

Technical Analysis

The lockfile directs npm to retrieve dependency archives from registry.npmmirror.com rather than the official npm registry. The development documentation also recommends changing npm's persistent registry configuration to that mirror. This expands the installation trust boundary beyond the package authors and official npm infrastructure.

The project startup wrapper invokes npm install when node_modules is absent. Consequently, first-time startup may initiate network retrieval of the locked packages without a separate dependency-review step.

SHA-512 integrity values are present, which materially reduce substitution risk: npm should reject an archive whose conten ...[truncated 2468 chars]

Remediation
View remediation

Remediation Suggestions

  1. Regenerate package-lock.json using the official npm registry:

    bash
    npm config set registry https://registry.npmjs.org/
rm -rf node_modules package-lock.json
npm install

  2. Review the regenerated dependency tree and commit the new lockfile only after verifying that every resolved package URL uses the intended official registry.

  3. Remove the recommendation to persistently change the user's npm registry from 开发记录.md. If a mirror must be offered for regional availability, document it as an explicit optional choice with its trust implications.

  4. Use deterministic installation in automation and startup workflows:

    bash
    npm ci --ignore-scripts

    Confirm compatibility before disabling lifecycle scripts.

  5. Avoid silently installing dependencies as part of server startup. Separate installation from execution so users can review the network operation before launching the Skill.

  6. Pin direct dependencies to exact reviewed versions rather than caret ranges:

    json
    {
  "dependencies": {
    "@modelcontextprotocol/sdk": "1.27.1",
    "zod": "4.3.6"
  }
}

  7. Enable automated dependency vulnerability and provenance checks, and require review for any lockfile or registry-source change.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (24)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

声明描述的主体是“一个 MCP 服务器示例”，重点在提供 add 和 hello_world 工具供调用；但实际代码片段并不是服务器实现，也不是工具实现，而是一个测试 harness/客户端。它会生成子进程运行 server.js，向其发送 initialize、tools/list 和 tools/call 请求，并读取响应进行验证。这说明代码的主要用途是测试或验证 MCP 服务器，而不是实现一个最小 MCP 服务器本身。虽然测试内容确实涉及 add 和 hello_world，但该代码的核心行为与声明的主要目的存在实质偏差，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

声明描述的是一个 MCP 服务器示例及其工具能力（add 和 hello_world），但提供的代码并没有实现服务器或这些工具。相反，它是一个测试脚本，用于本地启动 server.js、收集日志、发送 initialize 请求并在短时间后关闭进程。其主要目的与声明的“服务器示例/工具调用功能”不一致，因此构成明显描述与行为不匹配。

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High
Category
Supply Chain
Confidence
83% confidence
Finding

fast-uri 3.1.0 is flagged for multiple URI parsing and canonicalization issues, including host confusion and possible SSRF-relevant edge cases. In an MCP/server context where URLs, schemas, or remote resources may be processed, incorrect URI parsing can undermine allowlists and security checks, making this a meaningful vulnerability.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.8 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High
Category
Supply Chain
Confidence
90% confidence
Finding

hono 4.12.8 is reported with numerous advisories affecting cookie handling, routing, and path processing. Because this skill is an MCP server example and likely depends on HTTP request routing behavior provided by Hono, flaws in the framework can directly affect request handling and make the skill more dangerous than a typical unused-library case.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High
Category
Supply Chain
Confidence
80% confidence
Finding

ip-address 10.1.0 has advisories for address parsing ambiguity and XSS in HTML-emitting methods. In this package-lock context it is a transitive dependency of rate limiting, so exploitability depends on whether IP parsing or HTML output methods are actually used, but the parsing ambiguity is still a real security concern where IP-based trust decisions are involved.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High
Category
Supply Chain
Confidence
84% confidence
Finding

path-to-regexp 8.3.0 is flagged for ReDoS and route-pattern DoS issues. Since this skill likely exposes server routes through frameworks that rely on this library, crafted paths could consume excessive CPU or degrade service availability if the vulnerable parsing paths are reachable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The primary descriptive content is presented in Chinese, and the README does not indicate that other languages are supported or that Chinese is required for a region-specific purpose. This can violate a language/locale policy when users are not given an explicit language choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description and the full markdown content consistently force a single language experience. Under the policy, language constraints should either offer user opt-in/choice or be clearly justified as region-specific, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file's comments and all user-visible console output are written in Chinese, including test descriptions and status messages. This imposes a specific language on users without any opt-in or fallback, which matches the policy's language/locale violation criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language descriptions and user-facing tool text are entirely in Chinese, including the server description and tool descriptions. This imposes a specific language on users without any opt-in or documented justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The file presents the skill reference entirely in Chinese, including headings, instructions, and example interaction content, without offering a language choice or documenting a justified locale restriction. This can violate a language/locale policy when users are not given an explicit opt-in or alternative.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The report recommends broad natural-language triggers such as “帮我计算 10 加 20” and “跟我打个招呼” for automatic tool invocation. In an agent environment, vague trigger phrasing can overlap with ordinary conversation and cause unintended tool execution, especially if future tools are more sensitive than this demo server.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

该 markdown 文件的标题、内容结构和结尾说明均默认采用中文输出与沟通方式，但没有说明用户可选择其他语言，也没有声明这是仅面向特定中文地区/团队的文档。根据语言/locale 政策，未经用户选择而固定语言可能构成自然语言策略违规。

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.11 — 2 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low
Category
Supply Chain
Confidence
85% confidence
Finding

The lockfile pins @hono/node-server 1.19.11, and the supplied advisories describe path handling flaws in static file serving and slash normalization. Even if this minimal skill may not explicitly expose static file routes, the vulnerable package is present and may be exercised by the MCP SDK or future code changes, so this is a real supply-chain risk rather than a false positive.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low
Category
Supply Chain
Confidence
72% confidence
Finding

body-parser 2.2.2 is identified as vulnerable to denial of service under invalid limit handling. This is a genuine dependency risk, though its practical impact in this skill is limited because the provided context suggests a minimal MCP server rather than a general-purpose public web API with heavy body parsing exposure.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low
Category
Supply Chain
Confidence
76% confidence
Finding

qs 6.15.0 is reported with several denial-of-service weaknesses involving parsing and stringify edge cases. This is a real vulnerable dependency, though in the context of a minimal MCP hello-world skill the practical exposure is likely limited unless attacker-controlled query/body structures are accepted over HTTP.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description is written only in Chinese ('最小可行 MCP 服务器 - ClawHub Skill'), which can indicate a language-specific constraint without any opt-in or explanation. The policy requires flagging natural-language locale or language restrictions unless the file clearly offers a choice or documents a justified regional scope.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Using a caret version for @modelcontextprotocol/sdk allows installation of newer compatible releases automatically, which can introduce supply-chain risk if a future release is compromised or contains a breaking security regression. In a skill that exposes MCP server functionality, dependency integrity matters because the package is part of the trusted execution path.

Content

Scanner excerpt · package.json (reported line 19)May include surrounding context.

json
],
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.27.1",
    "zod": "^4.3.6"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

Using a caret version for zod permits automatic upgrades within the major version range, increasing exposure to supply-chain compromise or accidental ingestion of a vulnerable downstream release. Although zod is a common validation library, trusting floating versions still weakens build reproducibility and dependency control.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.27.1",
    "zod": "^4.3.6"
  }
}

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This JavaScript file contains natural-language comments and console output in Chinese, including the file header and runtime status messages. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

This shell script presents its user-facing title, status messages, errors, and example arguments entirely in Chinese, including the example name value. The policy for natural-language violations applies to all file types, and there is no indication that the skill is region-specific or that users can opt into another language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

该 markdown 文件从标题、说明到示例注释均仅以中文呈现，没有说明这是面向中文用户的区域化技能，也没有提供用户语言选择或英文替代说明。根据语言/locale 政策，若技能内容强制单一语言而无用户选择或明确正当化，属于自然语言层面的政策问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all user-facing instructions and operational details exclusively in Chinese, with no note that the language is optional, selectable, or intended for a Chinese-only audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The entire skill overview is written in Chinese and does not indicate that other languages are supported or that the Chinese-only presentation is region-specific. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.

Content

No source excerpt is available for this finding.