BasicOps MCP Setup

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:10 AM UTC
• Version: 0.1.1

Overview

The skill is a narrow BasicOps MCP setup helper, with the main caution that one example may expose a bearer token if copied with a live key.

Use this only if you intend to connect BasicOps to the current MCP client. Prefer a least-privilege BasicOps API key, store it through the client’s protected secret mechanism when possible, avoid pasting live tokens into chat or shell commands saved in history, and rotate any key that may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/client-patterns.md:31

Finding

Bearer Token Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: references/client-patterns.md:31-35
Vulnerability Type: Bearer-token exposure through shell command arguments
Risk Level: Medium

bash

openclaw mcp add basicops --transport streamable-http \
  --url https://app.basicops.com/mcp \
  --header "Authorization=Bearer <KEY>"
openclaw mcp probe basicops

Technical Analysis

The documented command instructs users to replace <KEY> with a live BasicOps API key and pass it directly through the --header command-line argument. Secrets supplied this way may be exposed through shell history, terminal session logs, process inspection, command auditing, diagnostic output, or automation logs.

This pattern conflicts with the project's own secret-handling guidance in SKILL.md:44-47, which recommends environment variables, secret storage, or direct configuration placement and advises against echoing bearer tokens.

Attack Path

1. A user follows the documented quick recipe.
2. The user substitutes a live BasicOps API key for <KEY>.
3. The shell, operating system, terminal tooling, audit subsystem, or CI/CD runner records the command or its arguments.
4. A local user, monitoring process, support operator, or log reader retrieves the exposed bearer token.
5. The attacker submits the token to the BasicOps MCP endpoint.
6. The attacker accesses BasicOps resources and operations permitted by that token.

This path requires access to relevant local process data, command history, or logs.

Impact Assessment

Successful exploitation discloses the BasicOps bearer token. The attacker can authenticate with the same BasicOps permissions and organizational scope granted to the compromised token. Potential consequences include unauthorized reads or modifications through the BasicOps MCP tool surface, depending on the token's privileges.

This issue does not itself provide operating-system privilege escalation or persistence. Its scope is bounded by the compromise ...[truncated 35 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the command-line token example with the client's supported secret store, protected credential helper, or interactive secret-input mechanism.
• If supported, reference a protected environment variable without expanding it into process arguments.
• Store credentials in a configuration file only when it has restrictive permissions and the client does not expose the value in logs or status output.
• Explicitly warn users not to paste live API keys into commands retained by shell history.
• Redact authorization headers from command output, diagnostics, audit records, and CI/CD logs.
• Apply least privilege and short expiration periods to BasicOps API keys where supported.
• Document immediate token rotation if a key was entered into an exposed command, terminal recording, or shared automation log.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.