ClawHub
Back to skill

Security audit

MCP Business Integration

Security checks for vulnerabilities and agentic risk

Overview

This MCP integration guide is purpose-aligned, but it needs review because it teaches broad business-data and write-capable integrations using insecure examples and limited safety scoping.

Review before installing or using this skill. It is not malicious, but users should treat its code blocks as illustrative only: add path containment, least-privilege credentials, explicit authorization checks, confirmation gates for writes or budget changes, destination allowlists, redacted logging, and clear cache/retention controls before implementing any MCP server based on it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:94
Finding

Path Traversal in MCP Filesystem Integration Example

Content
View full analysis
Remediation
View remediation
Path: requested = Path(path) if requested.is_absolute(): raise ValueError("Absolute paths are not permitted") resolved = (DOCUMENT_ROOT / requested).resolve() if resolved != DOCUMENT_ROOT and DOCUMENT_ROOT not in resolved.parents: raise ValueError("Path escapes the document directory") return resolved @server.resource("file://documents/{path}") async def read_document(path: str): safe_path = resolve_document_path(path) return safe_path.read_text() @server.tool("write_document") async def write_document(path: str, content: str): safe_path = resolve_document_path(path) safe_path.write_text(content) return {"status": "written"} ``` ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:290
Finding

Sensitive MCP Inputs and Outputs Logged Without Redaction

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description includes broad trigger phrases like 'business data' and 'agent integration', which can cause the skill to activate in overly broad contexts and expose users to data-accessing capabilities unexpectedly. In a skill focused on MCP connections to databases, files, CRM, and ads systems, overbroad invocation increases the chance of unintended sensitive operations being suggested or used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document demonstrates access to databases, files, external APIs, CRM records, and write-capable operations without explicit warnings about authorization, privacy, destructive effects, or data handling boundaries. Because this skill is about connecting agents directly to business systems, omission of safety guidance materially increases the risk of accidental exfiltration, unauthorized writes, and privacy violations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
- Query databases and APIs
- Access files and resources
- Execute tools and functions
- Maintain context across sessions

## Why MCP Matters

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md
# MCP Server for REST API
@server.resource("api://customers")
async def get_customers():
    response = await httpx.get("https://api.example.com/customers")
    return response.json()

@server.tool("create_customer")

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
# MCP Server for REST API
@server.resource("api://customers")
async def get_customers():
    response = await httpx.get("https://api.example.com/customers")
    return response.json()

@server.tool("create_customer")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
@server.tool("create_customer")
async def create_customer(data: dict):
    response = await httpx.post(
        "https://api.example.com/customers",
        json=data
    )

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The debug example logs full input and output payloads, which may include customer data, CRM records, analytics, API tokens, or other business-sensitive content. In MCP integrations, logs often become centralized and long-lived, so plain-language payload logging can turn routine debugging into a secondary data exposure channel.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.