ClawHub
Back to skill

Security audit

云效 DevOps MCP

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate Yunxiao DevOps MCP skill, but it exposes powerful cloud, repository, and pipeline actions without enough safety scoping around credentials, network exposure, and write operations.

Install only if you intend to let an agent operate Yunxiao DevOps resources. Use least-privileged RAM credentials, prefer short-lived or managed secrets over a plaintext .env file, restrict the MCP server to localhost or a trusted network, verify the Docker image, and require explicit human confirmation before any create, update, file, pipeline, or deployment action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill advertises numerous state-changing capabilities such as creating work items, running pipelines, and file operations, but it does not clearly warn users or downstream agents that these actions can modify production project data, trigger CI/CD jobs, or alter repositories. In an agent context, missing safety cues increases the chance of unintended destructive or costly actions because the interface makes read and write operations appear similarly routine.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The examples list state-changing tools such as `create_work_item`, `update_work_item`, `create_pipeline_run`, and `create_file` without any user-facing warning about confirmation, authorization scope, or potentially irreversible effects. This is dangerous because agents or users may copy these examples into automation flows and unintentionally create records, trigger builds/deployments, or modify repository contents.

Credential Access

High
Category
Privilege Escalation
Content
ports:
      - "3000:3000"
    env_file:
      - .env
    restart: unless-stopped
    command: node dist/index.js --sse
    healthcheck:
Confidence
91% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
start_period: 10s
EOF

cat > .env << 'EOF'
ALIBABA_CLOUD_ACCESS_KEY_ID=<your_access_key_id>
ALIBABA_CLOUD_ACCESS_KEY_SECRET=<your_access_key_secret>
ALIBABA_CLOUD_REGION=cn-hangzhou
Confidence
97% confidence
Finding
.env

VirusTotal

51/51 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.