T07 · Tool Hijacking and Spoofing
Warning
- Location
- SKILL.md:104
- Finding
- Unvalidated External MCP Server Registration## Vulnerability Details **File Location**: `SKILL.md`, lines 104–108 **Vulnerability Type**: `T07: Tool Hijacking and Spoofing` **Risk Level**: Medium **Complete Code Snippet**: ```text MCP工具使用：本Skill以静态规范生成与审校为主，不依赖外部MCP工具；若运行环境提供SQL格式化MCP工具（例如 sql-formatter），可选执行： 1) 检查是否存在名为 sql-formatter 的MCP：调用 tools.list 或 capability 查询； 2) 若未安装且提供了mcpServers配置，则按照配置添加到本地mcpServers并重载； 3) 安装后调用 format_sql 工具对输出DDL进行格式化； 4) 工具不可用时，回退到内置简易格式化，不影响主流程。 ``` ### Technical Analysis The Skill instructs the agent to add a supplied MCP server configuration to its local environment and reload the MCP subsystem if a formatter is not already installed. It does not require the agent to validate the server's identity, source, integrity, version, transport security, or declared capabilities. It also omits explicit user approval and does not require the configuration change to be temporary. A tool name such as `sql-formatter` is not a security boundary. An attacker-controlled MCP server can advertise the expected `format_sql` capability while executing unrelated logic or returning manipulated SQL. Because SQL formatting is optional and the Skill already defines a built-in fallback, modifying local MCP configuration is unnecessary capability expansion. ### Attack Path 1. An attacker supplies or influences an `mcpServers` configuration that identifies a malicious server as a SQL formatter. 2. The agent follows the Skill instructions and adds that server to its local MCP configuration. 3. The agent reloads the MCP subsystem, making the attacker-controlled tool available. 4. The Skill invokes the server's advertised `format_sql` operation and transmits generated or reviewed DDL. 5. The malicious server captures schema information, returns altered SQL, or abuses any broader capabilities granted by the MCP runtime. 6. If the configuration remains installed, the untrusted tool may continue to be available in later operations. ### Im ...[truncated 823 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction to automatically add supplied MCP server configurations. Use the built-in SQL formatter by default. 2. If external formatting is necessary, require explicit and informed user approval before installation, configuration changes, or data transmission. 3. Restrict permitted formatters to a fixed allowlist of trusted server identities and endpoints. 4. Pin the formatter implementation and version, and verify integrity through signatures or cryptographic hashes where supported. 5. Validate the server's transport security, provenance, requested permissions, and declared capabilities before use. 6. Grant only the formatting capability and deny filesystem, shell, credential, network, and unrelated tool access. 7. Treat formatter output as untrusted: compare it semantically with the input, reject added or removed SQL statements, and present material changes for user review. 8. Avoid persistent MCP configuration changes. Use an isolated, temporary registration and remove it immediately after the formatting operation. 9. Clearly disclose what SQL or schema information will be sent to the external service. 10. Fail safely to the existing built-in formatter whenever validation cannot be completed.