ClawHub
Back to skill

Security audit

TRAECNclaw MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated TraeCN MCP purpose, but its launcher can load server code from environment-influenced locations and should be reviewed before installation.

Install only if you trust the TRAECNclaw server installation and can control the MCP client's working directory, NODE_PATH, and PATH. Prefer a fixed, verified absolute server path or a trusted package install, keep the gateway bound to loopback, and treat command approvals, settings changes, and conversation deletion as high-impact actions.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/start-mcp.js:43
Finding

Environment-Controlled Module Resolution Allows Arbitrary Server Code Execution

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
scripts/start-mcp.js:64
Finding

Unqualified PATH Search Permits MCP Server Spoofing

Content
View full analysis
`traecnclaw-mcp${ext.toLowerCase()}`) : ['traecnclaw-mcp']; for (const entry of pathEntries) { for (const executableName of executableNames) { candidates.push(path.join(entry, executableName)); } } for (const candidate of candidates) { try { if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) { return path.resolve(candidate); } ``` The selected file is loaded directly as a Node.js module: ```js let serverModule; try { serverModule = require(serverPath); } catch (cause) { console.error(`[traecnclaw-mcp] Failed to load mcp-server.js: ${cause.message}`); ``` ### Technical Analysis When repository and package-based candidates are unavailable, the launcher searches each inherited `PATH` directory for a file named `traecnclaw-mcp`. The first regular file found is returned and passed to Node.js `require()`. This treats `PATH` precedence as an executable-code trust decision. The implementation does not verify: - Whether the selected directory is trusted. - Whether the file is owned by an expected account. - Whether the directory or file is writable by an untrusted user. - Whether the selected path is a symbolic link. - Whether the file belongs to the expected package. - Whether its contents match an approved integrity value. The launcher describes the candidate as an executable, but it does not spawn it as a separate executable. It loads it as a JavaScript module. Consequently, any JavaScript file with the expected name can execute top-level code immediately. ### Attack Path 1. An attacker ...[truncated 1443 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description presents the skill as an MCP interface for operating TraeCN, but the body also includes setup and bootstrap behaviors such as validating local installations, generating client configuration, and writing files. This mismatch can cause operators to grant the skill more trust or broader deployment than intended, while hidden setup behaviors expand its effective attack surface into local filesystem and execution-adjacent actions.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
rce checkout. Then run `npm run --silent setup:mcp` from the checkout, or `node scripts/setup-mcp.js` from this Skill directory, to validate the server and prin

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/start-mcp.js (reported line 107)May include surrounding context.

js
process.exit(1);
  }

  // Chdir to repo root so .env and relative file reads resolve correctly.
  try {
    process.chdir(path.dirname(serverPath));
  } catch (cause) {

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill exposes environment-backed capabilities through documented variables like TRAECN_GATEWAY_TOKEN and host/port overrides, but it does not declare an explicit tool scope such as permissions or allowed-tools. That makes the skill's effective authority less transparent to the host and reviewer, increasing the risk of unintended secret access or use of environment-derived connectivity without a clear least-privilege boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The examples for listing and toggling settings rely on the Chinese section label "通用" while another field uses the English label "Auto Save", creating an undocumented locale assumption. This can violate language/locale policy because the skill behavior appears tied to a specific UI language without user opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This JSON manifest/example file includes a locale-specific value, "通用", for the settings section. In a manifest-style reference file, hard-coding a localized label without explaining when this variant applies can make invocation behavior ambiguous across installations that use different UI languages.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/mcp-tool-contracts.json (reported line 456)May include surrounding context.

json
},
    {
      "name": "traecn_decide_approval",
      "description": "Approve or deny the unsafe or ambiguous command card currently visible in TraeCN. Approval revalidates the exact expectedCommand against the card and requires acknowledgeRisk plus an audit reason recorded locally; denial needs only the decision. Never approve beyond the scope the user authorized.",
      "inputSchema": {
        "type": "object",
        "properties": {