DCC-MCP

• Outcome: Pass
• Latest audit: Oct 16, 2026 · 4:16 AM UTC
• Version: 0.19.113

Overview

This is a broad but coherent DCC-MCP integration skill whose app control, setup, gateway use, local path cache, and installer behavior are disclosed and consent-gated.

Install only if you want an agent to operate supported local applications through DCC-MCP. Expect it to run CLI commands, contact a local or explicitly approved gateway, cache application paths you provide, and install verified DCC-MCP components only after consent. Review ambiguous Office or spreadsheet requests before allowing actions, and do not approve downloads, launches, marketplace installs, or UI control unless the named app, target project, and requested operation are clear.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a skill whose purpose is to operate named apps via DCC-MCP and discover tools or marketplace skills. The supplied code instead is a narrow utility for caching local application installation paths and producing consent-oriented prompt strings. It reads and writes a JSON cache on disk, validates absolute local paths, verifies whether cached paths still exist, and exposes a small CLI for cache operations. It explicitly does not start processes or operate applications. Therefore the code’s primary purpose is materially different from the declared behavior, and it includes filesystem access capabilities not reflected in the description. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description suggests an operational skill that uses DCC-MCP to control supported apps and discover tools/marketplace skills for user-requested app tasks. The supplied code does not perform app operations or marketplace skill discovery. Instead, it serves as a local diagnostic/bootstrap script that probes availability of the dcc-mcp CLI and gateway, optionally installs the CLI, invokes health/list commands, and summarizes inventory. The optional install behavior and environment modification are materially undeclared capabilities, and the primary purpose is inspection/setup rather than app operation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says the skill operates named supported apps through DCC-MCP and discovers tools/marketplace skills. The supplied code does not interact with apps, DCC-MCP, DCC-CUA, external tools, or any marketplace. Instead, it performs a narrow local check on a retrieved guide file to verify the presence of a specific contract in Markdown or JSON payload form, then prints a JSON result. This is a materially different primary purpose, so the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises an operational skill for controlling supported apps through DCC-MCP and discovering tools/marketplace skills. The supplied code instead is a diagnostic/reporting helper: it reads JSON evidence files, validates them, consults a local application path cache, checks for a CLI executable with shutil.which, and emits a structured first-run report. It is explicitly read-only and avoids launching CLIs, scanning, or installing. There is no code to operate apps, call DCC-MCP, execute tools, interact with a marketplace, or perform user-requested app tasks. Therefore the actual behavior is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

Operate the requested application and verify its resulting scene, document, or artifact.
Generic image, table, browser, or marketplace requests alone do not select this ecosystem.

<!-- BEGIN GENERATED PRODUCT DISCOVERY ROUTING -->
## Released Product and Application UI Routing

Load `references/PRODUCTS.json` only when released-product support, aliases, or routing are ambiguous; do not load every product record for unrelated tasks. Use typed DCC-MCP tools first.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/UPDATE_INSPECTION.md (reported line 48)May include surrounding context.

md

- The executing CLI version identifies the selected binary, not every copy on
  PATH and not the version of a running gateway or DCC adapter.
- A package manager's installed version is a receipt. It can differ from the
  binary after self-update; preserve the source and the discrepancy.
- Bundled Core identifies the code shipped in the selected build. An adapter's
  declared minimum Core requirement is not its bundled or loaded Core version.
- A runtime version requires evidence from that concrete running process.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

tags: "dcc, dcc-mcp, typed-tools, dcc-cua, ui-control, 3dsmax, aftereffects, blender, c4d, comfyui, freecad, gimp, godot, houdini, illustrator, katana, krita, liquigen, mari, marmoset, material-maker, maya, mobu, nuke, obs, openscad, openusd, photoshop, powerpoint, premiere, renderdoc, shogun, shotgrid, sketchup, substance3d_designer, substance3d_painter, tiled, touchdesigner, unity, unreal, wwise, zbrush, office-suite"
  openclaw:
    emoji: "🖥️"
    homepage: https://github.com/dcc-mcp/dcc-mcp-agent-plugins/blob/main/plugins/dcc-mcp/skills/dcc-mcp/SKILL.md
---

# DCC-MCP

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

Before the first UI observation or input, visibly attest `provider=dcc-cua runtime=<version> pid=<exact-pid> hwnd=<exact-native-hwnd>`. Missing or stale binding data stops the action. For every state-dependent UI action, require fresh observation before every state-dependent action; latest snapshot or semantic reference only; post-action state readback; stop on interruption or permission failure. Stop fail-closed on interruption or permission failure, and hand CAPTCHA, authentication challenge, security challenge to a human instead of bypassing it.

Local application path cache: when the user gives an absolute local software path, record it with `python scripts/app_path_cache.py set --product <id> --path "<path>"` and retain only the normalized path and verification timestamps. On a later launch request, run `python scripts/app_path_cache.py prompt --product <id> --name "<name>"` (add `--install-available` only for an installable route), tell the user the cached path, and ask explicitly whether to start it; never launch from a cached path without confirmation. If the path is stale or missing, guide the user to provide a new absolute path and show `dcc-mcp-cli install --dcc-type <id> --dcc-path "<path>"` when installation is available. See `references/LOCAL_APP_PATH_CACHE.md`.

Discovery and packaging evidence do not claim licensed real-host validation.
<!-- END GENERATED PRODUCT DISCOVERY ROUTING -->

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md

Downloading, installing and launching need user authorization. Carry out
existing explicit authorization for the same software, target and operation
without asking again. `--yes` applies to the approved invocation; it is not a
reason to change persistent consent, security settings or other installations.

For a reviewed CLI build containing the Windows Inkscape archive channel:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/HOST_SOFTWARE_DEPLOYMENT.md (reported line 57)May include surrounding context.

md

Downloading, installing and launching need user authorization. Carry out
existing explicit authorization for the same software, target and operation
without asking again. `--yes` applies to the approved invocation; it is not a
reason to change persistent consent, security settings or other installations.

For a reviewed CLI build containing the Windows Inkscape archive channel:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Office route uses very broad aliases such as "表格", "电子表格", "做表", and especially "spreadsheet", which are common user terms that can ambiguously match many ordinary requests. In an agent-routing context, this can cause unintended invocation of the dcc-mcp-office adapter for prompts that merely mention generic document tasks, expanding the skill’s authority surface and increasing the chance of unsafe or surprising tool execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The launch_prompt function returns all user-facing prompt text in Chinese, which imposes a specific language on users. There is no visible opt-in, fallback, or documentation that this skill is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_cli.py (reported line 20)May include surrounding context.

python

def _run_json(argv: list[str]) -> tuple[bool, dict[str, Any]]:
    try:
        proc = subprocess.run(
            argv,
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dcc_gateway.py (reported line 38)May include surrounding context.

python

def _run_json(argv: list[str]) -> tuple[bool, dict[str, Any]]:
    try:
        proc = subprocess.run(
            argv,
            capture_output=True,
            text=True,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description frames this skill as operating supported apps through DCC-MCP and discovering tools/marketplace skills. This file additionally implements downloading, verifying, and installing an executable into a user-controlled install directory, which is a materially broader behavior than simply using DCC-MCP for app tasks or discovery.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Fetching release metadata from GitHub, downloading a platform-specific binary, marking it executable, and replacing a target path is a software installation capability. That capability is not an obvious requirement of a skill whose stated purpose is to operate named apps through DCC-MCP and discover tools/skills.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/first_run_report.py (reported line 25)May include surrounding context.

python

ID = re.compile(r"[a-z0-9][a-z0-9_-]{0,99}\Z")
VERSION = re.compile(r"v?\d+(?:\.\d+){1,3}(?:[-+][A-Za-z0-9.-]+)?\Z")
MAX_BYTES = 1024 * 1024
RELEASE_API = "https://api.github.com/repos/dcc-mcp/dcc-mcp-core/releases/latest"


def read_object(path: Path) -> dict[str, Any]:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document instructs the agent to ask a specific follow-up question in Chinese: “未发现 <dcc> 的可用实例…”. This is a natural-language locale policy issue because it forces a language choice without indicating that the user prefers Chinese or offering an alternative.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.