ClawHub
Back to skill

Security audit

Open Ontologies

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for ontology work and discloses its external MCP server, but users should pin and verify that dependency before running it.

Before installing, prefer a pinned command such as the declared 0.5.1 version with locked dependencies, verify any downloaded release artifact if checksums or signatures are available, and run the MCP server with only the filesystem and network access needed for your ontology task.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding

Unpinned and Unverified Third-Party MCP Server Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24-26
Vulnerability Type: Supply-chain exposure through an unpinned, integrity-unverified executable dependency
Risk Level: Medium

Complete Code Snippet:

yaml
mcp:
  - name: open-ontologies
    description: >
      Oxigraph-backed MCP server providing all onto_* tools.
      Install: cargo install open-ontologies OR download binary from
      https://github.com/fabio-rovai/open-ontologies/releases

The same unsafe installation guidance is repeated at lines 50-52:

markdown
**Install:** `cargo install open-ontologies` or download from [GitHub releases](https://github.com/fabio-rovai/open-ontologies/releases)

Technical Analysis

The skill instructs users to install and execute the third-party open-ontologies package without pinning the declared skill version (0.5.1), using Cargo's locked dependency resolution, or verifying the downloaded binary with a cryptographic checksum or signature.

The generic GitHub releases URL also does not identify an exact release asset or trusted digest. Consequently, the executable installed at audit time can differ from the executable installed later. The package becomes an MCP server through open-ontologies serve and exposes tools that can read, write, import, ingest, save, and transmit ontology data. Because the server implementation is not included in this project, its actual behavior cannot be verified from the audited artifact.

This is a supply-chain weakness rather than evidence that the referenced package is currently malicious.

Attack Path

  1. An attacker compromises the package registry account, upstream repository, release process, or downloadable release asset.
  2. The attacker publishes a modified open-ontologies package or binary under the expected package identity.
  3. A user follows the skill's unpinned installation command or downloads the unverified release.
  4. T ...[truncated 978 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the package to the intended version and preserve its dependency lock:
    bash
    cargo install open-ontologies --version 0.5.1 --locked
  2. Reference an exact release tag and asset rather than the generic releases page.
  3. Publish a trusted SHA-256 or stronger digest for each supported asset and require verification before execution.
  4. Prefer signed release artifacts and document signature verification against a separately distributed, trusted public key.
  5. Record verifiable source provenance, build instructions, and release attestations such as SLSA provenance where available.
  6. Run the MCP server with least privilege in a sandbox or container, restricting filesystem access, environment variables, and outbound network connectivity.
  7. Allow outbound access only when remote pull or push functionality is explicitly required, and apply destination allowlists where practical.
  8. Update both installation references in SKILL.md so they provide the same pinned and integrity-verified procedure.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.