Security audit

Mcn Toolkit Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent MCN operations helper with no bundled executable code, persistence, or hidden data handling, but users should be careful with social account data and scheduling actions.

Install only from the expected ClawHub source, avoid running install commands with elevated privileges, and treat campaign assets, creator analytics, and scheduling requests as sensitive. Confirm any action that would publish, schedule, or modify content on connected platforms before allowing the agent to proceed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:5
Finding: Unpinned Third-Party Package Execution Through npx
Content: View full analysis
Remediation: View remediation
install mcn-toolkit@ ``` 2. Document the authoritative registry, publisher identity, and expected package provenance so users can detect dependency-confusion or impersonation attempts. 3. Publish and verify package integrity information, such as registry integrity hashes, signed release attestations, or verifiable checksums. 4. Use a lockfile where installation occurs inside a managed project, and require reproducible dependency resolution. 5. Audit the pinned `clawhub` release, the installed `mcn-toolkit` artifact, lifecycle scripts, and transitive dependencies before recommending execution. 6. Prefer an installation process that separates package download and verification from execution. 7. Advise users to install under a least-privileged account and never run the command with administrator or root privileges unless explicitly required and independently justified. 8. Add automated dependency monitoring and release-signing controls so compromised or unexpectedly changed releases can be detected and revoked. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx clawhub install mcn-toolkit without pinning a specific version of the package/tool being executed. This can cause users to fetch and run whatever version is current at install time, increasing supply-chain risk if the package is updated maliciously, compromised, or changed unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The description presents analytics, scheduling, and asset-management capabilities without warning that these functions may access creator performance data, campaign assets, or connected social platform accounts. Because this skill is designed for MCN-scale operations across multiple creators, missing disclosures and safety constraints increase the risk of users unintentionally exposing sensitive business data or authorizing account-affecting actions without understanding the consequences.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The usage examples are broad natural-language triggers that invite the agent to perform multi-step operational actions like generating creator content, comparing performance, and scheduling posts without defining activation boundaries, confirmation requirements, or exclusions. In a skill centered on managing many creators and platforms, this can cause overbroad execution, unintended action on connected accounts, or processing of sensitive campaign and analytics data when a user phrase loosely matches an example.
Content: No source excerpt is available for this finding.