ClawHub
Back to skill

Security audit

ida-reverse

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for IDA reverse engineering, but it deserves Review because its helper can invoke arbitrary IDA MCP tools and can send analysis data to any configured HTTP MCP endpoint.

Install only if you expect the agent to actively control an IDA Pro MCP session. Keep IDA_MCP_URL unset or restricted to trusted loopback unless you have authenticated HTTPS transport, and review batch rename/comment/type operations before use because they persist in the IDA database and project notes.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ida_mcp_client.py:31
Finding

Unrestricted plaintext MCP endpoint permits analysis-data disclosure and response spoofing

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'req' from os.environ.get (line 87, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ida_mcp_client.py (reported line 51)May include surrounding context.

python
req = urllib.request.Request(
        URL, data=json.dumps(payload).encode(), headers=headers, method="POST"
    )
    with urllib.request.urlopen(req, timeout=120) as resp:
        sid = resp.headers.get("Mcp-Session-Id")
        if sid:
            _session_id = sid

Tainted flow: 'req' from os.environ.get (line 87, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/ida_mcp_client.py (reported line 89)May include surrounding context.

python
headers["Mcp-Session-Id"] = _session_id
        req = urllib.request.Request(URL, data=json.dumps(payload).encode(),
                                     headers=headers, method="POST")
        urllib.request.urlopen(req, timeout=30)
    except Exception:
        pass

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose says this is a reverse-engineering workflow/norms skill, but the content instructs use of a generic client that can call arbitrary ida-pro-mcp tools, batch requests, and maintain a session over HTTP/JSON-RPC. That mismatch is dangerous because reviewers or orchestration policy may treat it as passive guidance while it actually enables broad operational control over a local analysis service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The entire skill description is written only in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This creates a language/locale policy concern because the skill effectively forces a specific language without opt-in.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill references network access to a local unauthenticated MCP endpoint and environment-dependent local scripts, but it does not declare any explicit tool scope or allowed-tools boundary. That makes the effective capability broader than the metadata suggests and increases the chance an agent can invoke unintended tooling or access local resources without clear policy constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger condition is extremely broad: essentially any task involving IDA MCP, decompilation, crash analysis, malware analysis, protocol reversing, CTF, or internal audit causes the skill to load. Overbroad activation increases the chance the skill influences unrelated tasks, expands access to local MCP/networked capabilities by default, and makes accidental misuse more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.