YunoHost MCP

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:30 AM UTC
• Version: 0.8.3

Overview

This skill is a narrow YunoHost MCP setup helper with a disclosed supply-chain caution around running an unpinned setup package.

Install only if you trust the yunohost-mcp-connect package and its publisher. For stronger safety, pin or review the package version before running setup, back up your OpenClaw config, use the intended OPENCLAW_CONFIG_PATH, and never share the generated private key.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Third-Party Package Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21–23
Vulnerability Type: Unpinned dependency dynamically retrieved and executed through uvx
Risk Level: Medium

sh

uvx --from yunohost-mcp-connect yunohost-mcp-connect setup \
  --server https://your-yunohost-domain/mcp \
  --client openclaw

Technical Analysis

The skill directs the agent to retrieve and immediately execute the third-party yunohost-mcp-connect package without specifying an audited version, immutable artifact, or integrity hash. Consequently, the code executed by this command can change after the skill has been reviewed.

The package runs with the invoking user's privileges. According to the surrounding instructions, it is expected to generate Nostr identity material and modify ~/.openclaw/openclaw.json or the file selected through OPENCLAW_CONFIG_PATH. This gives the dynamically retrieved package access to sensitive authentication material and local configuration.

Attack Path

1. An attacker compromises the package registry entry, maintainer account, build pipeline, or a subsequently published package release.
2. The user or agent follows the skill and invokes the documented uvx command.
3. uvx retrieves the currently available package rather than a fixed, previously audited artifact.
4. The compromised package executes locally with the user's permissions.
5. Malicious package code can read accessible files, capture generated identity material, alter OpenClaw configuration, or execute other commands within the user's privilege boundary.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user running the setup. The affected scope includes files readable or writable by that user, OpenClaw configuration, generated Nostr credentials, environment variables, and accessible network resources.

The command does not explicitly request elevated privileges, so sy ...[truncated 195 chars]

Remediation

View remediation

Remediation Suggestions

• Pin yunohost-mcp-connect to a specifically reviewed version rather than resolving the latest available release.
• Use an immutable, trusted artifact and verify its cryptographic hash before execution.
• Maintain a lock file or controlled package manifest containing exact versions and integrity metadata.
• Document the approved package registry and reject alternative or untrusted indexes.
• Review the selected package release and its transitive dependencies before updating the pinned version.
• Back up the OpenClaw configuration before setup and verify that unrelated settings remain unchanged afterward.
• Ensure generated private-key files and configuration files have user-only permissions.
• Where feasible, execute initial setup in a restricted environment with only the filesystem and network access required for configuration.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill instructs users to execute uvx --from yunohost-mcp-connect without pinning an exact package version or immutable source reference. This creates a supply-chain risk: a newer or compromised package release could be fetched and executed at runtime, and because the tool performs setup for authentication/configuration, a malicious update could steal keys, alter OpenClaw config, or redirect connections.

Content

No source excerpt is available for this finding.