ClawHub
Back to skill

Security audit

Dune MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed Dune MCP integration that uses a scoped API credential and warns before state-changing or credit-consuming actions.

Install only if you intend to use Dune through UXC. Use a least-privilege Dune API key, understand that authenticated Dune requests can send SQL and query metadata to Dune and may consume credits, and confirm before creating, updating, executing, publishing, or visualizing queries.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The declared description says the skill uses Dune MCP through UXC to interact with Dune for discovery, querying, execution, results, and visualization. However, the actual code chunk only validates repository files and documentation conventions using shell commands like rg, head, and tail. It checks that docs mention commands such as searchTables, createDuneQuery, executeQueryById, and getExecutionResults, but does not itself call Dune MCP, access blockchain data, bind authentication, or consume credits. This is a materially different primary purpose from the declared operational behavior, so it is a mismatch.

External Transmission

Medium
Category
Data Exfiltration
Content
## Core Workflow

1. Confirm endpoint and protocol with help-first probing:
   - `uxc https://api.dune.com/mcp/v1 -h`
2. Configure credential/binding for repeatable auth:
   - `uxc auth credential set dune-mcp --auth-type api_key --header "x-dune-api-key={{secret}}" --secret-env DUNE_API_KEY`
   - `uxc auth credential set dune-mcp --auth-type api_key --header "x-dune-api-key={{secret}}" --secret-op op://Engineering/dune/api-key`
Confidence
83% confidence
Finding
The skill instructs users to bind an API key and interact with an external service, which creates a real data egress and credential-use boundary. Although this is the intended function, it is still security-relevant because prompts or automation built on this skill could send user-supplied queries, metadata, or usage patterns to Dune without sufficient confirmation, and the embedded auth setup normalizes persistent credential binding.

External Transmission

Medium
Category
Data Exfiltration
Content
- `uxc auth binding add --id dune-mcp --host api.dune.com --path-prefix /mcp/v1 --scheme https --credential dune-mcp --priority 100`
3. Use fixed link command by default:
   - `command -v dune-mcp-cli`
   - If missing, create it: `uxc link dune-mcp-cli https://api.dune.com/mcp/v1`
   - `dune-mcp-cli -h`
4. Inspect operation schema before execution:
   - `dune-mcp-cli searchTables -h`
Confidence
86% confidence
Finding
Creating a linked command and host/path auth binding increases the chance of unintended authenticated requests to the external Dune endpoint. This is more sensitive than a mere reference because it operationalizes persistent routing of credentials to a remote service, which can lead to accidental data disclosure or unexpected credit consumption if invoked by downstream automation.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
command -v dune-mcp-cli
uxc link dune-mcp-cli https://api.dune.com/mcp/v1
dune-mcp-cli -h
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
command -v dune-mcp-cli
uxc link dune-mcp-cli https://api.dune.com/mcp/v1
dune-mcp-cli -h
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
command -v dune-mcp-cli
uxc link dune-mcp-cli https://api.dune.com/mcp/v1
dune-mcp-cli -h
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
command -v dune-mcp-cli
uxc link dune-mcp-cli https://api.dune.com/mcp/v1
dune-mcp-cli -h
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.