ClawHub
Back to skill

Security audit

Convertible Bond Research

Security checks across malware telemetry and agentic risk

Overview

This appears to be a disclosed external MCP integration that requires a user-provided bearer token, with no evidence of hidden or destructive behavior.

Install only if you trust the Anchor Data MCP service and are comfortable with relevant prompts, tool requests, and results being handled by that service. Use a least-privilege token if available, avoid sharing configs that contain the bearer token, and rotate or revoke the token if it may have been exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
{
  "mcpServers": {
    "anchor-bond": {
      "url": "https://api.anchor-data.cn/api/mcp",
      "headers": {
        "Authorization": "Bearer anchor_xxxxxx"
      }
Confidence
84% confidence
Finding
The skill instructs the user to configure an external MCP endpoint and place a bearer token in a local config file, which results in data and credentials being transmitted to a third-party service. In context this is an expected integration, but it still expands the trust boundary and can expose sensitive prompts, research targets, or credentials if the service, configuration, or logs are mishandled.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.