ClawHub
Back to skill

Security audit

小蓝进销存

Security checks for vulnerabilities and agentic risk

Overview

This ERP skill is purpose-aligned, but it asks the agent to persist external MCP access, store privileged bearer tokens, and retry business-changing actions without enough user control.

Install only if you trust xiaolan-tech with ERP data and are prepared to manage bearer tokens carefully. Review any MCP configuration change manually, avoid pasting or logging token-bearing config where possible, and require explicit confirmation before the agent changes quantities, approvals, reversals, or other business records.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:39
Finding

Automatic Modification of MCP Client Configuration Without Explicit User Approval

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-48
Vulnerability Type: Unauthorized modification of persistent client configuration
Risk Level: Medium

Relevant Instruction Snippet:

text
1. Check whether MCP is configured

Check whether the current client has configured the `xiaolan-erp` MCP service.

- If it is not configured, write the JSON configuration block into the
  client's MCP configuration file, and then tell the user to reconnect or
  restart the client.
  - Local clients (Kimi CLI / Claude Code / Cursor): the AI automatically
    writes the configuration.
  - Cloud clients: the AI outputs the complete configuration block for the
    user to paste manually.
  - If writing fails, the complete configuration block must be displayed;
    failure must not be silent.
- If it is configured, continue to the next step.

The configuration being installed is:

json
{
  "mcpServers": {
    "xiaolan-erp": {
      "url": "https://xiaolan-tech.com/mcp/erp"
    }
  }
}

Technical Analysis

The Skill instructs the Agent to modify a persistent MCP client configuration automatically when an inventory-related trigger activates it. It does not require an explicit confirmation immediately before the file write.

Adding an MCP endpoint changes the client's persistent trust boundary. Once registered, the remote service can receive subsequent tool requests and user-supplied ERP data. Although the endpoint is openly documented and there is no evidence that it is malicious, persistent registration of an external tool provider should be treated as a security-sensitive configuration operation.

This is classified as T05: Unauthorized Access and Privilege Escalation because the Agent is directed to exercise local configuration-write capabilities without an explicit authorization checkpoint. The finding does not establish operating-system privilege escalation or comprom ...[truncated 1061 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed user approval immediately before changing any MCP configuration file.
  2. Display the exact endpoint, target configuration path, and proposed configuration diff before writing.
  3. Explain what categories of data may be sent to the external service.
  4. Prefer the client's native, permission-scoped MCP registration mechanism instead of directly editing configuration files.
  5. Create a backup before modification and provide a clear removal or rollback procedure.
  6. Restrict the configuration write to the specific MCP entry and preserve unrelated settings.
  7. For broad trigger terms, first ask whether the user wants to enable the integration rather than treating the mention as authorization.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:75
Finding

Privileged Bearer Tokens Are Written to Plaintext Configuration or Exposed in Conversation Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 75-92 and 109-113
Vulnerability Type: Plaintext storage and disclosure of authorization credentials
Risk Level: High

Relevant Instruction Snippet:

text
Response handling:
- The response contains a token with L3 privileges, an organization ID,
  and next steps.
- The token is displayed only once, so the user must be told to store it safely.
- Write the token back into the MCP configuration:

{
  "mcpServers": {
    "xiaolan-erp": {
      "url": "https://xiaolan-tech.com/mcp/erp",
      "headers": {
        "Authorization": "Bearer [returned token]"
      }
    }
  }
}

- Local clients: the AI writes it automatically.
- Cloud clients: output the complete configuration block for the user to paste.
- If writing fails, the complete configuration block must be output.

The multi-user workflow applies the same handling to member credentials:

text
The invitation redemption response returns the member's own token, which is
likewise written back into that member's MCP configuration. Tokens and
invitation codes are displayed only once and the user must be told to store
them safely.

Technical Analysis

The Skill embeds bearer tokens directly in MCP configuration under the Authorization header. It also requires the complete token-bearing configuration to be emitted into the conversation for cloud clients or when automatic writing fails.

A bearer token grants access based solely on possession. Plaintext configuration files can be exposed through permissive file permissions, workstation backups, synchronization services, support bundles, malware, or other local users and processes. Conversation output can additionally be retained in client history, server-side logs, telemetry, screenshots, exported transcripts, or debugging records.

The organization-owner token is explicitly described as L3, which can approve ...[truncated 1556 chars]

Remediation
View remediation

Remediation Suggestions

  1. Store bearer tokens in an operating-system keychain, encrypted credential vault, or client-native secret store.
  2. Reference the stored secret from MCP configuration rather than embedding its value directly.
  3. Never reproduce the complete bearer token in ordinary conversation output, logs, telemetry, or error messages.
  4. If manual setup is unavoidable, use a secure one-time secret-entry interface outside chat and redact the value immediately afterward.
  5. Apply restrictive file permissions to any configuration that may contain credentials.
  6. Issue short-lived, narrowly scoped tokens and use least privilege by default; avoid assigning L3 unless approval privileges are required.
  7. Provide token rotation, immediate revocation, session listing, and compromise-recovery procedures.
  8. Prevent configuration backups and support bundles from including unredacted tokens.
  9. Ensure invite codes and redeemed tokens are independently scoped, single-purpose, and fully invalidated after redemption or rotation.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:144
Finding

Inventory Quantities May Be Changed and Resubmitted Without User Confirmation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 144-158
Vulnerability Type: Unsafe autonomous mutation of business transactions
Risk Level: High

Relevant Instruction Snippet:

text
When the AI receives a structured error, it should self-correct. For example,
if inventory is insufficient, it should automatically adjust the quantity
and retry. If an approved document fails, use reversal and reconstruction.

The error-handling table repeats the behavior:

text
Error: INV.INSUFFICIENT_STOCK
Meaning: Insufficient inventory
AI response: Automatically adjust the quantity and retry, or notify the user.

Technical Analysis

The Skill permits the Agent to alter a user-requested quantity and retry an inventory operation automatically after an insufficient-stock response. Quantity is a material term of an outbound inventory or sales transaction. Changing it is not merely technical error recovery; it changes the business operation authorized by the user.

The alternative wording, “or notify the user,” does not establish when notification is mandatory. As written, an implementation can silently lower the requested quantity and submit the modified transaction. The Skill also mentions reversal and reconstruction for approved documents without defining confirmation, idempotency, or safeguards against duplicate compensating operations.

This is an insecure business-transaction workflow rather than evidence of malicious code. It is classified as T09: Insecure Skill Coding Practices because the instructions authorize unsafe automatic recovery for state-changing ERP operations.

Attack Path

  1. A user requests an outbound or sales transaction for a specific quantity.
  2. The Agent submits the requested transaction to the ERP service.
  3. The service returns INV.INSUFFICIENT_STOCK.
  4. The Agent selects a lower quantity based on available inventory.
  5. Without obtaining confirmation fo ...[truncated 1231 chars]
Remediation
View remediation

Remediation Suggestions

  1. Never change transaction quantities, prices, counterparties, warehouses, or document types without explicit user confirmation.
  2. On insufficient stock, report the requested quantity, available quantity, shortage, and proposed alternatives.
  3. Require confirmation of the exact revised transaction before resubmission.
  4. Distinguish safe technical retries from semantic changes. Only retry automatically when all business parameters remain identical.
  5. Use idempotency keys for every state-changing operation to prevent duplicate documents during retries.
  6. Require explicit approval before reversal, red-entry correction, cancellation, or document reconstruction.
  7. Present a preview of all compensating and replacement entries, including their effect on inventory and accounting records.
  8. Maintain an audit trail containing the original request, server error, proposed change, user approval, and final submitted values.
  9. Apply stricter confirmation requirements when the active token has L3 approval privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation tells the AI to automatically write configuration and potentially credentials without presenting a clear warning about local changes, trust implications, or rollback steps. Users may not realize that enabling the skill can alter client behavior and establish ongoing access to an external MCP endpoint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill directs the AI to persist returned bearer tokens into the client's MCP configuration, causing the model to handle and store credentials locally. This is dangerous because it expands the skill's authority into credential management, risks token leakage or misuse, and normalizes silent persistence of secrets in a place the user may not inspect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list is very broad and includes common business terms such as inventory, supplier, customer, warehouse, and report. Overbroad triggers can cause the skill to activate in unrelated conversations, increasing the chance that its configuration-writing and token-handling instructions run unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation logic says to act whenever users mention broad ERP-related keywords, but it does not define when not to trigger or require confirmation before taking actions. In this context, ambiguous activation is more dangerous because the skill also instructs the AI to modify configuration and manage authentication state.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly instructs the AI to write to the client's local MCP configuration file, which crosses from ERP workflow assistance into local system modification. This creates a supply-chain style risk: a remotely supplied skill can change client configuration without a strong trust boundary, user confirmation, or least-privilege controls.

Content

No source excerpt is available for this finding.