Security audit

Ldm Openclaw Inbox Mcp Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill’s purpose is coherent, but it runs an unpinned npm MCP package with an API key, so the executable code could change after review.

Review and pin the MCP package version before installing, preferably through a lockfile-controlled deployment. Use a narrowly scoped, revocable Inbox Check API key, avoid broad environment exposure to the MCP process, and require explicit approval for paid test creation or deletion.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:33
Finding: Unpinned npm Package Is Downloaded and Executed Automatically
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The publish instructions invoke npx -y clawhub without pinning an exact package version, so whoever runs the command will fetch and execute whatever version is current at that time. If the upstream package is compromised, typo-squatted, or a breaking release is published, this can lead to arbitrary code execution on the operator's machine during login or publish operations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The command npx -y clawhub skill publish ... also executes an unpinned package from the registry, creating a supply-chain risk each time the skill is published. Because publishing often occurs in privileged developer or CI environments, a malicious or compromised package version could exfiltrate credentials, alter the published artifact, or execute arbitrary commands.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The command npx -y clawhub skill publish ... also executes an unpinned package from the registry, creating a supply-chain risk each time the skill is published. Because publishing often occurs in privileged developer or CI environments, a malicious or compromised package version could exfiltrate credentials, alter the published artifact, or execute arbitrary commands.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to run an MCP server directly via npx -y ldm-inbox-check-mcp without pinning a specific version, which causes execution of whatever package version is current at install time. Because MCP servers run code locally and are granted access to sensitive configuration such as INBOX_CHECK_API_KEY, a compromised upstream package, malicious maintainer update, or dependency hijack could lead to arbitrary code execution and secret exfiltration.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill installs and runs an MCP server via npx using the package name ldm-inbox-check-mcp without a pinned version or integrity control. That means future executions can pull whatever package version is currently published, creating a supply-chain risk where a malicious or compromised update could execute arbitrary code and access the configured INBOX_CHECK_API_KEY or manipulate outbound email workflows.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This manifest defines an MCP server configuration but provides no description of when it should be invoked, what user intents it is meant to handle, or any limiting conditions. In manifest files, missing trigger specificity can lead to ambiguous activation behavior because there are no explicit constraints or negative examples documenting intended scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.