ClawHub
Back to skill

Security audit

Wikipedia

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Wikipedia lookup skill that runs a local MCP server and sends requested searches to Wikipedia.

Install only if you are comfortable with your queries being sent to Wikipedia through this MCP server. For stronger supply-chain hygiene, prefer a version that explicitly declares network access and pins or tightly bounds the Python dependency.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill explicitly instructs users to install and run an MCP server that makes outbound HTTP requests to Wikipedia, but the skill metadata does not declare any corresponding network permission. This is a real security and governance issue because hidden or undeclared network access reduces transparency for reviewers and users, even though the stated purpose here is a legitimate Wikipedia lookup service.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
Confidence
93% confidence
Finding
requests>=2.28.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.