MCP Development Kit: Guide + Server Templates + Registry Configs

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:42 AM UTC
• Version: 1.3.1

Overview

This is a non-executable documentation bundle, but it requests high-value credentials without showing a need for them.

Review before installing. Do not provide Stripe keys, signing keys, wallet details, or platform API keys to this bundle unless the publisher explains why each value is needed and how it is scoped; for the current artifact, those secrets appear unnecessary.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:13

Finding

Unnecessary Declaration of High-Value Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–20
Vulnerability Type: Excessive credential access violating least privilege
Risk Level: Medium

Vulnerable Code

yaml

credentials: [STRIPE_API_KEY, GREENHELIX_API_KEY, AGENT_SIGNING_KEY, WALLET_ADDRESS]
metadata:
  openclaw:
    requires:
      env:
        - STRIPE_API_KEY
        - GREENHELIX_API_KEY
        - AGENT_SIGNING_KEY
        - WALLET_ADDRESS
    primaryEnv: STRIPE_API_KEY

Technical Analysis

The manifest declares access to a Stripe API key, a GreenHelix API key, an agent signing key, and a wallet address. However, the audited package contains only a 34-line documentation manifest and is explicitly marked executable: false. It contains no scripts, templates, network operations, or other implementation that requires these credentials.

Requiring payment and signing credentials without a demonstrated functional need violates the principle of least privilege. STRIPE_API_KEY and AGENT_SIGNING_KEY are particularly sensitive because their effective privileges may include payment-platform operations and cryptographic authorization, depending on how the credentials are configured.

The current package contains no code that reads, transmits, or misuses these values, so active credential theft or exfiltration is not established. The risk arises from unnecessarily making high-value secrets available to the Skill context, increasing the consequences of future package changes, prompt injection, or a compromised execution component.

Attack Path

1. A user installs or loads the Skill based on its manifest.
2. The host attempts to satisfy the declared environment requirements.
3. The host exposes the listed payment, API, and signing credentials to the Skill context or associated runtime.
4. A later malicious package update, injected instruction, or compromised runtime component accesses those unnecessarily exposed val ...[truncated 1010 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all entries from credentials and metadata.openclaw.requires.env because the current documentation-only package does not use them.
2. Remove primaryEnv: STRIPE_API_KEY unless executable functionality with a documented Stripe integration is added.
3. If future functionality legitimately requires authentication, request only the specific credential needed by that operation.
4. Use narrowly scoped, short-lived tokens instead of unrestricted or long-lived API keys.
5. Do not expose private signing keys directly to a general Skill runtime. Use a dedicated signing service, hardware-backed keystore, or approval-gated signing interface.
6. Separate optional integrations so credentials are requested only when the corresponding feature is invoked.
7. Document each credential's purpose, required scope, storage expectations, and rotation procedure.
8. Add validation to release review processes to reject non-executable or documentation-only Skills that declare unnecessary secrets.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This bundle is explicitly marked non-executable and described as documentation, guides, and templates, yet it declares four sensitive credentials as required environment variables. Requiring payment, platform, signing, and wallet secrets for static content creates unnecessary secret exposure risk during installation, indexing, or runtime by agent platforms that may provision these values automatically.

Content

No source excerpt is available for this finding.