ClawHub
Back to skill

Security audit

Integrate Claude Agent SDK with You.com MCP server

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward integration guide for Claude Agent SDK and You.com MCP, with expected external API use and dependency-install guidance but no hidden or destructive behavior found.

Install only if you intend to use Anthropic and You.com services together. Review any generated file changes before applying them, avoid sending sensitive prompts or private data through the integration, use least-privilege API keys, and prefer pinned package versions or lockfiles instead of unversioned npm/pip/npx commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:27
Finding

Unpinned Third-Party Dependencies Can Introduce Mutable Supply-Chain Code

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:27-28, SKILL.md:389, SKILL.md:404, and SKILL.md:473
Vulnerability Type: Unpinned and immediately executable third-party dependencies
Risk Level: Medium

Vulnerable Code

At lines 27-28:

bash
pip install claude-agent-sdk
npm install @anthropic-ai/claude-agent-sdk

At line 389:

bash
npx tsx your-file.ts

At line 404:

bash
npm install @anthropic-ai/claude-agent-sdk

At line 473:

bash
npm install -D typescript@latest

Technical Analysis

The Skill directs users to install third-party packages without specifying reviewed, exact versions or integrity constraints. Dependency resolution therefore depends on mutable package-registry state at installation time. The explicit use of typescript@latest guarantees that the selected package version can change over time.

The npx tsx instruction is especially sensitive because, when tsx is not already installed locally, npx may retrieve the currently resolved package from the registry and execute its command immediately. Package installation may also execute lifecycle scripts under the privileges of the developer running the command.

No evidence shows that the named packages are currently malicious. The security defect is that the instructions do not ensure that users receive the same reviewed artifacts, leaving the workflow exposed to registry-account compromise, malicious future releases, compromised transitive dependencies, or dependency-resolution manipulation.

Attack Path

  1. An attacker compromises a publisher or registry account, or introduces malicious code into a future direct or transitive dependency release.
  2. The registry serves the compromised release under the unversioned/default range, the latest tag, or the version dynamically selected by npx.
  3. A developer follows the Skill and runs one of the documented installation or npx co ...[truncated 1033 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace unversioned package commands with exact, reviewed versions. Avoid mutable tags such as latest.
  2. Generate and commit ecosystem lockfiles, such as package-lock.json or an equivalent npm lockfile, and a hash-locked Python requirements file.
  3. In automated environments, use reproducible installation commands such as npm ci rather than commands that can update dependency resolution.
  4. Install tsx as a pinned development dependency and invoke the local locked binary instead of allowing npx to download an unresolved package:
    bash
    npm install --save-dev --save-exact tsx@REVIEWED_VERSION
npm exec --offline -- tsx your-file.ts
  5. Pin the Claude Agent SDK and TypeScript to versions that have been reviewed and tested:
    bash
    npm install --save-exact @anthropic-ai/claude-agent-sdk@REVIEWED_VERSION
npm install --save-dev --save-exact typescript@REVIEWED_VERSION
  6. For Python, use an exact version with verified hashes, preferably through a generated requirements file:
    text
    claude-agent-sdk==REVIEWED_VERSION --hash=sha256:EXPECTED_HASH
  7. Review transitive dependencies, enable registry provenance and integrity verification where available, and run dependency vulnerability scanning in CI.
  8. Disable package lifecycle scripts during installation where they are unnecessary, then explicitly permit only reviewed build steps.
  9. Execute dependency installation with least privilege and avoid exposing unrelated production secrets to development or build processes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (13)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

md
model: 'claude-sonnet-4-5-20250929',
  });

  // Send message to Claude
  await session.send('Search for the latest AI news from this week');

  // Receive and process messages

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 357)May include surrounding context.

Both API keys are required:

bash
# Add to your .env file or shell profile
export YDC_API_KEY="your-you-api-key-here"
export ANTHROPIC_API_KEY="your-anthropic-api-key-here"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
mcp_servers={
             "ydc": {
                 "type": "http",
                 "url": "https://api.you.com/mcp",
                 "headers": {
                     "Authorization": f"Bearer {os.getenv('YDC_API_KEY')}"
                 }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
mcp_servers={
             "ydc": {
                 "type": "http",
                 "url": "https://api.you.com/mcp",
                 "headers": {
                     "Authorization": f"Bearer {os.getenv('YDC_API_KEY')}"
                 }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
mcp_servers={
             "ydc": {
                 "type": "http",
                 "url": "https://api.you.com/mcp",
                 "headers": {
                     "Authorization": f"Bearer {os.getenv('YDC_API_KEY')}"
                 }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 204)May include surrounding context.

md
mcp_servers={
             "ydc": {
                 "type": "http",
                 "url": "https://api.you.com/mcp",
                 "headers": {
                     "Authorization": f"Bearer {os.getenv('YDC_API_KEY')}"
                 }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

md
mcp_servers={
             "ydc": {
                 "type": "http",
                 "url": "https://api.you.com/mcp",
                 "headers": {
                     "Authorization": f"Bearer {os.getenv('YDC_API_KEY')}"
                 }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

md
mcp_servers={
             "ydc": {
                 "type": "http",
                 "url": "https://api.you.com/mcp",
                 "headers": {
                     "Authorization": f"Bearer {os.getenv('YDC_API_KEY')}"
                 }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.

md
mcp_servers={
             "ydc": {
                 "type": "http",
                 "url": "https://api.you.com/mcp",
                 "headers": {
                     "Authorization": f"Bearer {os.getenv('YDC_API_KEY')}"
                 }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 373)May include surrounding context.

md
mcp_servers={
             "ydc": {
                 "type": "http",
                 "url": "https://api.you.com/mcp",
                 "headers": {
                     "Authorization": f"Bearer {os.getenv('YDC_API_KEY')}"
                 }

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly instructs creating or updating user files, including integrating into existing files, but does not warn users to review changes, back up files, or confirm overwrite/edit scope. In an agentic setting, file modification guidance without safety guardrails can lead to unintended code changes or destructive edits in the wrong file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents use of YDC_API_KEY in HTTP Authorization headers to https://api.you.com/mcp and requires prompts and tool traffic to be sent to external services, but it does not clearly disclose this data flow or associated privacy implications. Users may not realize that API keys, prompts, and retrieved content are transmitted off-host to third-party services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.