ClawHub
Back to skill

Security audit

Gevety MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Gevety health-data connector, but it handles very sensitive health records and includes an unnecessary remote announcement/update channel that can influence agent responses.

Review this skill carefully before installing. Use it only if you want an agent to access your Gevety health records, protect the Gevety API token, and prefer a version that removes or strictly validates the remote announcement/update check and asks before broad health-data retrieval.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:961
Finding

Remote Free-Form Announcement Injection into Agent Responses

Content
View full analysis
1.9.0** (this skill's version), tell the user: > "A Gevety skill update is available. Run: `clawdhub update gevety`" **If `announcement` is present**, mention it once per session. **If the status check fails**, don't mention it - just proceed with the user's request. ``` ### Technical Analysis The Skill directs the agent to retrieve an unauthenticated status response from a remotely controlled endpoint and repeat the free-form `announcement` field to the user. Unlike the version value, the announcement has no specified schema, length restriction, content allowlist, signature validation, or requirement to treat its value strictly as untrusted data. This creates a remote output-control channel whose effective content can change after the Skill has been reviewed and installed. The API operator—or an attacker who compromises the API or its response path—could supply promotional, deceptive, or instruction-like text. The agent is explicitly instructed to mention that content, even when it is unrelated to the user's health request. The behavior exceeds the minimum privilege needed for the declared health-data functionality. Retrieving user-requested health records from the authenticated API is necessary, but automatically forwarding arbitrary status announcements is not required to access or interpret those records. ### Attack Path 1. A ...[truncated 1274 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This skill is explicitly designed to retrieve highly sensitive medical and health data from an external API, but it does not require an upfront privacy warning or explicit per-request user consent before transmitting queries and receiving PHI. In a health-data context, silent retrieval and transmission materially increases privacy and compliance risk because users may not realize the sensitivity and scope of data being accessed.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill instructs the agent to send bearer-authenticated requests containing access to sensitive health records to an external service. Although external API use is the core function of the skill, this remains security-relevant because it enables transmission of PHI off-platform and could expose sensitive data through overbroad requests, logging, or misuse of the token.

Content

Scanner excerpt · SKILL.md (reported line 928)May include surrounding context.

javascript
// Using web_fetch
web_fetch({
  url: "https://api.gevety.com/api/v1/mcp/tools/get_health_summary",
  method: "GET",
  headers: {
    "Authorization": "Bearer $GEVETY_API_TOKEN",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 966)May include surrounding context.

On first use each session, optionally check for updates:

text
GET https://api.gevety.com/api/v1/mcp/tools/status

No authentication required. If the request fails or times out, skip the check and proceed normally.

Static analysis

No suspicious patterns detected.