ClawHub
Back to skill

Security audit

MCP Server Pack

Security checks across malware telemetry and agentic risk

Overview

This skill is purpose-related, but it can lead users to run MCP servers with file, credential, database, cloud, and persistence access without enough scoping or safety guidance.

Review carefully before installing. Enable only the MCP servers you need, avoid default-all configs, pin and verify Docker images or npm packages, restrict filesystem mounts to narrow paths, use least-privilege credentials, and avoid sending sensitive data through the hosted cloud option unless you trust the provider.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The manifest exposes only two read-only tools, but the documentation says the skill can download binaries/images and manage server lifecycle locally. That mismatch is dangerous because it obscures the real operational behavior of the skill and can cause users or downstream agents to authorize or trust actions that go beyond the declared permission model.

Vague Triggers

Low
Confidence
74% confidence
Finding
The configuration-generation tool accepts a free-form list of server names without clearly constraining allowed values or documenting validation behavior. In a skill that emits executable client configuration, underspecified scope can lead to unsafe assumptions, accidental inclusion of unintended backends, or future parameter injection if implementation trusts arbitrary names.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The self-hosted workflow describes downloading images/binaries and managing lifecycle, but it does not prominently warn that this causes local system changes and execution of external components. That omission increases the risk that users or agents treat the workflow as harmless config generation when it may pull and run code on the host.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.