ClawHub
Back to skill

Security audit

Wishfinity +W

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to provide the advertised wishlist feature, but its setup runs an unpinned third-party MCP package and its activation language is broad enough to need review before installation.

Review the MCP package and publisher before installing, pin a known-good package version where possible, and run the server with minimal local permissions. Users should also configure the agent to invoke Wishfinity only after clear save-to-wishlist intent, not merely when someone says they like a product.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding
Unpinned Third-Party MCP Package Is Automatically Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24-39 **Vulnerability Type**: Unpinned runtime dependency execution **Risk Level**: Medium ### Vulnerable Code ```json { "agents": { "list": [{ "id": "main", "mcp": { "servers": [{ "name": "wishfinity", "command": "npx", "args": ["-y", "wishfinity-mcp-plusw"] }] } }] } } ``` ### Technical Analysis The documented configuration uses `npx -y` to resolve, download, and execute `wishfinity-mcp-plusw` without specifying an exact version. The `-y` option suppresses the installation confirmation prompt. Because the dependency is not pinned to an audited version and no lockfile, integrity hash, provenance requirement, or vendored artifact is provided, the executable payload can change after the Skill has been reviewed. Security therefore depends on the continuing integrity of the npm package, its publisher account, the registry resolution process, and every transitive dependency. This is a supply-chain exposure rather than evidence that the current package is malicious. Nevertheless, a compromised publisher account, malicious future release, or compromised transitive dependency could cause attacker-controlled JavaScript to execute when OpenClaw starts the MCP server. ### Attack Path 1. An attacker compromises the npm package publisher, a relevant dependency, or another part of the package distribution chain. 2. The attacker publishes a malicious release under the existing `wishfinity-mcp-plusw` package name. 3. A user applies the documented configuration without an exact package version. 4. The user restarts the OpenClaw gateway as instructed. 5. `npx -y` resolves and downloads the attacker-controlled release without requesting confirmation. 6. The package executes as an MCP server with the operating-system permissions and runtime access available to the OpenClaw gateway user. 7. Malicious package code could attemp ...[truncated 885 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the MCP package to a specific, reviewed version: ```json { "name": "wishfinity", "command": "npx", "args": ["wishfinity-mcp-plusw@X.Y.Z"] } ``` 2. Verify the selected release's provenance and npm integrity metadata before deployment. 3. Use a lockfile or an internally mirrored and approved artifact so installations remain reproducible. 4. Remove `-y` where interactive approval is practical, while noting that confirmation alone does not replace version pinning. 5. Review the package and its transitive dependencies before approving upgrades. 6. Run the MCP server in a sandbox or container with: - A dedicated unprivileged account. - Minimal filesystem access. - No unnecessary environment variables or secrets. - Restricted outbound network access. - Read-only mounts wherever practical. 7. Document what product URL data is sent to the MCP server and any external service, including retention and privacy implications. 8. Establish a controlled update process in which new versions are reviewed, tested, and explicitly approved before deployment. ]]>

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger phrases are broad enough to match common conversational language such as 'I want this' or 'Remember this product,' which can cause the agent to promote or initiate a save-flow in situations where the user did not clearly intend to use an external wishlist service. In a shopping-agent context this is more dangerous than in a narrow utility skill because these phrases are likely to appear frequently during ordinary recommendation conversations, increasing the chance of unwanted tool invocation or user redirection to a third-party service.

Static analysis

No suspicious patterns detected.