ClawHub
Back to skill

Security audit

test

Security checks across malware telemetry and agentic risk

Overview

This MCP-building guide is coherent, but its bundled evaluator can let Claude call any tool on a connected MCP server and send tool results to Anthropic without enforcing read-only limits.

Install only if you intend to build and evaluate MCP servers. Run the evaluator only against test or read-only MCP servers, avoid connecting it to real accounts with write-capable tools, and assume tool outputs may be sent to Anthropic during evaluation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill text directs the agent to create MCP servers, fetch remote documentation, and produce artifacts such as evaluation XML files, which implies external connectivity and file-writing behavior without any declared permissions. This creates a trust-boundary problem: a caller or platform may assume the skill is documentation-only while it can induce actions with side effects.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The declared description presents the skill as a guide for building MCP servers, but the detected behavior extends into acting as an MCP client, invoking remote tools, calling Anthropic APIs, parsing evaluation XML, and running automated evaluations with reporting. This mismatch is dangerous because users and orchestrators may authorize the skill under a much narrower mental model than its real operational reach.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The invocation text is broad enough that the skill could trigger for many generic software, API, or integration tasks, not just tightly scoped MCP server authoring. Over-broad activation increases the chance the skill is used in contexts where its instructions to fetch remote resources, build tools, or create files are inappropriate or risky.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The guide includes an example that solicits an API key via `ctx.elicit(..., input_type="password")` and immediately uses it, but it does not warn implementers to avoid logging, persisting, or broadly reusing the credential, nor to prefer existing secure auth flows where possible. In a developer-facing reference, this can normalize unsafe secret-handling patterns that lead to credential exposure or misuse in downstream MCP servers.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.