ClawHub
Back to skill

Security audit

ToolRouter Gateway

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it advertises a broad live ToolRouter gateway while shipping a mock implementation that can persist tool inputs and results locally in plaintext.

Review carefully before installing. Do not send secrets, customer data, credentials, private targets, or sensitive prompts through this skill unless caching is disabled or redesigned. Treat the advertised 150+ live tools and MCP gateway claims as unsupported by the shipped code, and require clear scoping, authentication, retention controls, and accurate documentation before using it in a real workflow.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/run.py:123
Finding

Tool inputs and results are persisted in a plaintext cache

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill markets itself as a live gateway to 150+ tools with dynamic native exposure, scanning, research, and MCP transport, but the analysis indicates the implementation is largely simulated and only exposes limited wrappers/mock entries. This mismatch is dangerous because users may rely on nonexistent security controls or functional behavior, route sensitive data to a component they misunderstand, or assume vetted tool execution when the real behavior is different.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
80% confidence
Finding

The skill describes capabilities that require environment access, file read/write, and shell/MCP execution, but it does not declare any top-level scope restrictions such as permissions or allowed-tools. That creates an overly broad trust boundary: consumers may enable a gateway that can access secrets, write local cache/log files, and launch an MCP server without explicit policy constraints.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Advertising that users can call any ToolRouter tool after discovery establishes an effectively unbounded execution surface through a remote catalog. In this context, that is dangerous because the available tools can change dynamically, may include risky capabilities such as scanning or scraping, and are not restricted by a documented allowlist or approval boundary.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

Dynamic Tools (examples)

Once catalog is fetched, you can call any ToolRouter tool:

python
# Competitor research

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The described cache and usage log behavior implies persistent storage of data derived from every tool invocation, which may include highly sensitive user-provided content or data returned from third-party services. Even if only hashes are stored for some fields, broad retention of invocation metadata can still enable correlation, forensic recovery, or leakage from the local filesystem.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill documents caching and usage logging but does not warn that tool inputs and related metadata may be retained locally, even when those inputs could contain API targets, research data, prompts, credentials, or other sensitive content. Users may unknowingly send confidential material to third-party tools and also leave durable local traces, increasing exposure and incident impact.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
89% confidence
Finding

Running the gateway as an MCP server so other clients can use all ToolRouter tools further expands the trust boundary and may turn the skill into a general-purpose capability broker. Without authentication, authorization, and tool-level restrictions, this can enable unintended third-party access to broad remote actions under the host's API key and local environment.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

toolrouter-gateway --mcp

text

Other MCP clients can then connect and use all ToolRouter tools as MCP resources.

## Pricing

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md
## Pricing

$49/month. Includes:
- Unlimited tool calls (you pay ToolRouter usage separately; most tools cost fractions of a cent)
- Caching reduces your ToolRouter bill
- Usage analytics
- Priority support

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
def load_config():
    default = {
        "api_url": "https://api.toolrouter.com/mcp",
        "cache_ttl_minutes": 1440,
        "enable_caching": True,
        "timeout_seconds": 60,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
def load_config():
    default = {
        "api_url": "https://api.toolrouter.com/mcp",
        "cache_ttl_minutes": 1440,
        "enable_caching": True,
        "timeout_seconds": 60,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/run.py (reported line 23)May include surrounding context.

python
def load_config():
    default = {
        "api_url": "https://api.toolrouter.com/mcp",
        "cache_ttl_minutes": 1440,
        "enable_caching": True,
        "timeout_seconds": 60,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code stores full tool input data and results in a local cache file by default, without sanitization, minimization, encryption, or explicit user disclosure. In this skill context, inputs may include sensitive research targets, scan targets, creative briefs, or other confidential material, so local persistence increases the risk of data exposure to other local processes, users, or future prompts/tools reading the workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The usage log persistently records tool names, timestamps, and deterministic hashes of request inputs without clear disclosure or retention controls. Although the raw input is not written here, the metadata can still reveal sensitive activity patterns, correlate repeated requests, and expose use of security-related tools in a shared or monitored workspace.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The docstring says the function fetches the ToolRouter tool catalog via MCP or HTTP, which implies live remote retrieval. However, the implementation explicitly returns a static mock catalog and does not perform any MCP or HTTP operation, so the inline documentation contradicts actual behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The function docstring states that it proxies a call to ToolRouter, suggesting a real upstream invocation. In reality, the code never contacts ToolRouter and instead returns a local placeholder result, which is an active contradiction between documentation and behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.