ClawHub
Back to skill

Security audit

Lingxing MCP

Security checks across malware telemetry and agentic risk

Overview

This skill is a Lingxing ERP connector wrapper, but its read-focused description under-discloses that its generic tool call can update ERP data.

Review this skill before installing if your Lingxing account can create, update, delete, or overwrite ERP data. It is not clearly read-only; use it only when you are prepared to inspect the live tool schema and explicitly confirm any action that could change business records.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest and description frame the skill as being for 'searching and reading data', but the documented `call_tool` action can invoke arbitrary Lingxing ERP MCP tools, including ones that may create or update data. This mismatch can cause downstream agents or users to treat the skill as read-only and invoke it without the higher-friction confirmation expected for write-capable operations.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The safety section says untagged actions are reads, yet `call_tool` is untagged even though its own description admits some Lingxing tools create or update ERP data. That inconsistency is dangerous because an agent may rely on the tag model or the 'untagged = safe' rule and execute `call_tool` as if it were read-only, enabling unintended state changes in ERP systems.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger phrase 'Use this skill for ANY Lingxing MCP request' is overly broad and can cause automatic routing for all Lingxing-related tasks, including ones that may be better handled with safer, narrower skills or direct review. In combination with the generic `call_tool` capability, broad auto-selection increases the chance of accidental invocation of write-capable operations under an apparently read-focused skill.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.