ClawHub
Back to skill

Security audit

MCP Server Development & Monetization Guide: Build, Publish, and Profit from the Tool Integration Standard

Security checks for vulnerabilities and agentic risk

Overview

This is mostly an educational MCP guide, but it unnecessarily requests a Stripe payment API key despite having no executable runtime need for it.

Review this before installing because it asks for STRIPE_API_KEY even though it is only a guide. Do not provide a live Stripe key for this skill; treat payment and deployment snippets as examples, use test credentials, pin dependency versions, and avoid copying any config-export code that writes secret values in plaintext.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:14
Finding

Non-Executable Guide Unnecessarily Requests a Stripe API Credential

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:2128
Finding

Portable Configuration Exports Environment Secrets in Plaintext

Content
View full analysis
dict: """Export as Claude Desktop configuration format.""" mcp_servers = {} for s in self.servers: if not s.enabled: continue config = {"command": s.command, "args": s.args} if s.env: config["env"] = s.env mcp_servers[s.name] = config return {"mcpServers": mcp_servers} def to_cursor_config(self) -> dict: """Export as Cursor IDE configuration format.""" return { "mcp": { "servers": { s.name: { "command": s.command, "args": s.args, "env": s.env, } for s in self.servers if s.enabled } } } def to_json(self) -> str: """Serialize to portable JSON.""" return json.dumps({ "team": self.team_name, "version": self.version, "servers": [ { "name": s.name, "command": s.command, "args": s.args, "env": {k: v for k, v in s.env.items()}, "env_secrets": s.env_secrets, "enabled": s.enabled, "required_groups": s.required_groups, } for s in self.servers ], }, indent=2) ``` ### Technical Analysis All three export paths copy the complete `env` mapping into generated configuration output. The data model separately tracks `env_secrets`, but that list is not used to redact, omit, encrypt, or replace sensitive values. Environment mappings commonly contain API keys, access tokens, database passwords, and cloud credentials. The `to_json` method explicitly converts all such values into a portable plaintext string. The Claude Desktop and C ...[truncated 1297 chars]
Remediation
View remediation
dict[str, str]: secret_names = set(server.env_secrets) return { key: ( f"${{{key}}}" if key in secret_names else value ) for key, value in server.env.items() } ``` 3. Use the sanitized mapping consistently in every export method. 4. Prefer dedicated secret references such as Vault paths, cloud secret identifiers, or deployment-platform secret bindings. 5. Reject serialization if a variable marked as secret contains a plaintext value. 6. Add tests verifying that representative passwords, tokens, and API keys never appear in serialized output. 7. Apply restrictive file permissions to locally generated configuration files. 8. Add secret scanning to CI and provide credential-rotation instructions for accidentally exported values. ]]>

T08 · Insecure Dependencies

Note
Location
SKILL.md:420
Finding

Unpinned Package Installation and Immediate Execution Through npx

Content
View full analysis
Remediation
View remediation
" npm install "@modelcontextprotocol/sdk@" npm install --save-dev "@modelcontextprotocol/inspector@" ``` 2. Replace implicit `npx` retrieval with execution of a previously installed, locked dependency: ```bash npx --no-install @modelcontextprotocol/inspector python minimal_server.py ``` 3. Commit Python hash-locked requirements and an npm lockfile. 4. Use `pip --require-hashes` where practical and `npm ci` for reproducible npm installations. 5. Review package provenance, publisher identity, release signatures, and transitive dependencies before updating versions. 6. Run development utilities without administrator privileges and in an isolated environment. 7. Configure dependency scanning and controlled update review rather than automatically consuming mutable latest releases. ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

A live payment-processing credential is unjustified for a non-executable educational skill and creates avoidable exposure of highly sensitive financial API access. If a user provides a real Stripe key because the manifest requests it, the key could be leaked to other tools, logs, prompts, or future skill changes, leading to unauthorized payment operations or financial data access.

Content

No source excerpt is available for this finding.

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 859)May include surrounding context.

md
:
    """Tests for SQL validation."""

    def test_valid_select(self):
        result = validate_sql("SELECT * FROM users")
        assert result.valid is True
        assert result.sanitized_value == "SELECT * FROM users"

    def test_rejects_empty(self):
        result = validate_sql("")
        assert result.valid is False
        assert "empty" in result.error.lower()

    def test_rejects_drop(self):
        result = validate_sql("DROP TABLE users")
        assert result.valid is False
        assert "DROP" in result.error

    def test_rejects_delete(self):
        result = validate_sql("DELETE FROM users WHERE id = 1")
        assert result.valid is False

    def test_rejects_multiple_statements(self):
        result = validate_sql("SELECT 1; DROP TABLE users")
        assert result.valid is False
        assert "Multiple" in result.error

    def test_allows_trailing_semicolon(self):
        result = validate_sql("SELECT * FROM users;")
        assert result.valid is True

MCP Config Access

High
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 1582)May include surrounding context.

md
### The MCP Registry Ecosystem

The official MCP registry at registry.modelcontextprotocol.io is the central directory where developers publish and discover MCP servers. As of April 2026, it lists over 10,000 servers across categories like databases, APIs, developer tools, productivity, and AI/ML. Clients like Claude Desktop, Cursor, Windsurf, and VS Code with Copilot can install servers directly from the registry.

Publishing to the registry makes your server discoverable. When a user asks an AI client "Can you help me query my Postgres database?", the client can search the registry for relevant servers, suggest installation, and connect automatically. This is the distribution channel for MCP servers.

MCP Config Access

High
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 2416)May include surrounding context.

md
- **The official MCP registry**: Free to list, no revenue share. You handle billing directly.
- **AI client marketplaces**: Cursor, Windsurf, and other IDEs are building in-app marketplaces where developers can purchase premium MCP servers. Revenue share varies from 15% to 30%.
- **Enterprise marketplaces**: Azure API Center and similar platforms list MCP servers for enterprise customers. Higher deal sizes but longer sales cycles.

### Strategy 5: Combining MCP with x402 for Pay-Per-Use

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest declares a non-executable educational markdown guide, yet it requires a live STRIPE_API_KEY credential and includes monetization/payment implementation material. Requesting sensitive billing credentials for a non-executable guide expands the trust boundary unnecessarily and can normalize exposing production payment secrets where they are not needed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
65% confidence
Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 1790)May include surrounding context.

md
When a single developer installs an MCP server on their laptop, security is a personal responsibility. When an enterprise deploys MCP servers across thousands of developer workstations, security becomes a governance challenge. Which servers are allowed? Who authorized them? What data can they access? What happens when a server is compromised? Enterprise MCP governance answers these questions.

The stakes are significant. An MCP server has the same access as the process it runs in. A malicious or compromised server can read local files, access environment variables (which often contain API keys and credentials), make network requests, and execute arbitrary code. In enterprise environments where developers work with proprietary code, customer data, and production credentials, ungoverned MCP servers are a data exfiltration risk.

### SSO Integration for Server Access

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Low
Category
MCP Rug Pull
Confidence
60% confidence
Finding

pip install without ==version installs the latest release, which could include malicious changes.

Content

No source excerpt is available for this finding.