other
Warning
- Location
SKILL.md:4- Finding
Unverifiable Externally Hosted MCP Service with Sensitive Printer Capabilities
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 4–32
Vulnerability Type: Unverifiable external MCP service trust
Risk Level: MediumThe skill directs users to connect an agent to a fixed, externally hosted MCP endpoint. The project does not contain the MCP server source code, deployment configuration, or other implementation artifacts needed to verify how the server handles bearer tokens, documents, shared-volume files, raw printer payloads, or spooler operations.
markdown metadata: {"clawdbot":{"emoji":"🖨️","requires":{"urls":["https://cyber.talpa-stargazer.ts.net/epson/mcp"]},"install":[{"id":"docker","kind":"docker-compose","label":"Deploy Epson MCP server (Docker)"}]}} # Epson MCP MCP server for the Epson WF-2250 inkjet printer. Connects to the printer over TCP/9100 (ESC/P-R) or LPD, with an optional Windows PowerShell spooler backend. ## Tools - `epson_diag` — Diagnose connectivity and capabilities - `epson_print_text` — Print plain text via ESC/P-R - `epson_print_file` — Print a file from the shared volume (PDF auto-converted) - `epson_print_raw` — Send a base64-encoded ESC/P or PostScript payload - `epson_status` — Re-probe the printer and return a status summary - `epson_ink` — Ink level info (stub — WF-2250 doesn't expose ink over network) - `epson_list_jobs` — List Windows spooler jobs (requires PowerShell) - `epson_cancel_job` — Cancel a Windows spooler job (requires PowerShell) - `epson_scan` — Network scan (stub — WF-2250 doesn't support network scanning) - `epson_copy` — Network copy (stub) ## Setup 1. Deploy the Docker container (see repo README). 2. Expose over Tailnet: `tailscale serve --bg --set-path=/epson http://localhost:18790` 3. Wire into Codex/OpenClaw: ```bash codex mcp add epson --url https://cyber.talpa-stargazer.ts.net/epson/mcp \ --bearer-token-env-var EPSON_MCP_AUTH_TOKENtext ### Technical Analysis The configuration registers a project-specific `ts.net` hostname as an MCP serv ...[truncated 2769 chars]- Remediation
View remediation
Remediation Suggestions
- Include the complete MCP server source code, Docker Compose file, container build files, and referenced README in the auditable project.
- Default to a user-controlled localhost or explicitly configured endpoint rather than a fixed externally operated hostname.
- Pin deployments to a reviewed image digest or signed release, and document how users can verify image provenance and integrity.
- Require explicit user confirmation before transmitting document content, printing shared-volume files, submitting raw payloads, or managing spooler jobs.
- Apply least privilege to the service account, printer network access, shared volume, and Windows spooler permissions.
- Restrict shared-volume operations to a dedicated directory, canonicalize paths, reject traversal and symlink escapes, and enforce file-size and format limits.
- Validate and limit raw ESC/P or PostScript payloads where possible; disable raw printing by default when it is not required.
- Use narrowly scoped, rotatable bearer tokens; avoid logging tokens; document token storage, expiration, revocation, and incident-response procedures.
- Document endpoint ownership, data retention, request logging, transport security, and whether submitted documents are transmitted beyond the user's Tailnet.
- Add server-side authorization checks and auditable logs for job listing, cancellation, and all print operations.