Mqtt Client

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:18 AM UTC
• Version: 1.0.7

Overview

This MQTT skill has a real purpose, but it overreaches by subscribing to every broker topic, printing full message contents, and loading credentials through an unsafe shell-sourced .env file.

Review before installing. Use only with a dedicated least-privileged MQTT account, avoid production brokers until the subscription honors a narrow topic, disable raw payload logging, require TLS for non-local connections, and replace shell-sourcing of .env with safe parsing of named configuration keys.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bootstrap.sh:3

Finding

Executable credential file loaded through Bash source

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/run.py:12

Finding

Global MQTT subscription exposes and logs unrelated message data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/run.py:10

Finding

MQTT credentials and messages can be transmitted without TLS

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose says the skill is a simple MQTT client, but the detected behavior goes beyond connecting: it authenticates with credentials from the environment, subscribes broadly, and receives or logs broker message contents. This mismatch is dangerous because it can conceal sensitive data collection and network activity behind an understated description, preventing informed consent and increasing the risk of overbroad message exposure.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Referencing and sourcing a .env file in a bootstrap script strongly suggests credential material may be loaded from disk at runtime, and because it is sourced, those contents are also executable in the shell. This creates both credential exposure risk and command-execution risk if secrets or the file itself are mishandled, especially in an MQTT client where broker usernames, passwords, or tokens are likely to be present.

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 3)May include surrounding context.

sh

#!/usr/bin/env bash
source /home/jc/.openclaw/workspace/skills/mqtt-client/venv/bin/activate
source /home/jc/.openclaw/workspace/skills/mqtt-client/.env
python3 /home/jc/.openclaw/workspace/skills/mqtt-client/scripts/run.py

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares no explicit tool scope or permissions even though it relies on environment-provided connection details. That omission reduces transparency and control, making it easier for the skill to access sensitive configuration implicitly and for users or orchestrators to invoke it without understanding its environmental dependencies.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The activation and usage description is vague about when the skill should run and what actions it performs once started. Ambiguous invocation guidance is dangerous for a background networked skill because it can lead to accidental execution, persistent broker subscriptions, and unintended monitoring of message traffic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation omits a clear warning that running bootstrap.sh will automatically load connection details from .env and initiate a live MQTT connection. This is risky because users may trigger external network access and credential use unintentionally, which can expose secrets or connect to production infrastructure without meaningful notice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script executes source on a .env file, which treats the file as shell code rather than as passive key/value configuration. If the .env file is modified by an attacker or contains unexpected shell syntax, arbitrary commands will run with the privileges of the script, and any secrets loaded from the file may also be exposed implicitly. In a skill/bootstrap context this is more dangerous because startup scripts are often run automatically and trusted by users.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims to be a simple MQTT client, but it ignores scoped topic configuration and subscribes to '#', which captures all broker topics. In a skill context, this turns the client into a broad message monitor that can collect unrelated or sensitive data from the broker and materially exceeds the stated behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code defines MQTT_TOPIC but never uses it, instead always subscribing to all topics via '#'. This mismatch is dangerous because operators may believe they have constrained the client's visibility when in reality it still receives every message on the broker.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The message handler logs every received payload in plaintext, which can expose secrets, personal data, or operational telemetry to stdout and any downstream log aggregation systems. Combined with the wildcard subscription, this can create large-scale unintended data capture from the entire broker.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script accesses MQTT_USERNAME and MQTT_PASSWORD from environment variables to authenticate to the broker. There is no accompanying comment, docstring, or documentation warning that the skill consumes credentials from the environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.