ClawHub
Back to skill

Security audit

VectorClaw MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly discloses that it installs and runs a Vector robot MCP server for speech, motion, camera, and sensor control, with a supply-chain caution around unpinned dependencies.

Install only if you trust the vectorclaw-mcp PyPI package and the Vector robot control context. For stronger safety, use a pinned reviewed package version, run under a low-privilege account, keep the robot supervised, and be cautious with camera and motion tools.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:9
Finding

Unpinned External PyPI Package Is Installed and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:9-13
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

yaml
install:
  - id: pip
    kind: pip
    package: vectorclaw-mcp
    label: "Install VectorClaw MCP (pip)"

The documentation repeats the unpinned installation procedure at SKILL.md:40-41:

markdown
1. Install package: `pip install vectorclaw-mcp`
2. Configure SDK: `python3 -m anki_vector.configure`

Technical Analysis

The Skill installs vectorclaw-mcp from PyPI without specifying an exact version or verifying an integrity hash. It then configures OpenClaw to execute the installed package using:

yaml
command: python3
args:
  - "-m"
  - "vectorclaw_mcp.server"

The audited project contains only SKILL.md and README.md; it does not contain the source code for vectorclaw_mcp.server. Consequently, the executable behavior cannot be reviewed from this artifact. Because package resolution is mutable, a compromised maintainer account, package repository, build pipeline, or later malicious release could cause users to install and execute code different from the code originally reviewed.

This finding concerns supply-chain integrity. The audit found no direct evidence that the current external package is malicious.

Attack Path

  1. An attacker compromises the package publisher, distribution account, release pipeline, or another relevant supply-chain component.
  2. The attacker publishes a malicious release under the expected vectorclaw-mcp package name.
  3. A user follows the Skill installation process, which requests the package without an exact version or hash.
  4. The package installer resolves and installs the attacker-controlled release.
  5. OpenClaw launches python3 -m vectorclaw_mcp.server.
  6. The malicious package executes with the permissions of the OpenClaw user and receives the config ...[truncated 844 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a reviewed exact version, for example vectorclaw-mcp==X.Y.Z, rather than resolving the latest available release.
  2. Verify package artifacts with approved cryptographic hashes, such as through a locked requirements file used with pip --require-hashes.
  3. Include or link an immutable source revision corresponding exactly to the pinned package artifact.
  4. Audit the complete vectorclaw_mcp.server implementation and all transitive dependencies before deployment.
  5. Use signed releases and verify publisher identity, package provenance, and build attestations where supported.
  6. Run the MCP server as a dedicated, unprivileged account with narrowly scoped filesystem and network access.
  7. Restrict access to robot camera and motion controls to trusted workflows, and require confirmation for safety-sensitive physical actions where appropriate.
  8. Add automated dependency monitoring while requiring explicit review before adopting updated versions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Low
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The skill instructs users to install vectorclaw-mcp from PyPI without pinning a specific version, which makes installations non-reproducible and exposes users to supply-chain risk if a future release is compromised or introduces breaking behavior. In an MCP skill context, this matters because the installed package is then executed as an MCP server and can access environment variables such as VECTOR_SERIAL and interact with local hardware.

Content

No source excerpt is available for this finding.