ClawHub
Back to skill

Security audit

Yingmi MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible Yingmi MCP connector, but it presents itself as read-oriented while exposing a broad generic tool-calling path through an authenticated financial service connector.

Review this before installing if your Yingmi/OOMOL account can access sensitive financial, advisory, or account-changing tools. Use it only when you are comfortable with agents invoking Yingmi MCP tools through `oo`, and require explicit confirmation before any action whose live schema or behavior annotations suggest writes, destructive changes, transactions, or account updates.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill metadata promises a read-oriented integration ('searching and reading data'), but the exposed interface includes a generic `call_tool` action that can invoke arbitrary current Yingmi MCP tools and the document itself acknowledges that some tools may be `[write]` or `[destructive]`. This mismatch can cause downstream agents or users to treat the skill as safe for passive data access while unintentionally triggering state-changing operations through a broad tool-call surface.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The safety section says untagged actions are reads and that state-changing actions will be tagged, but the listed actions do not include any `[write]` or `[destructive]` tags even though `call_tool` can reach whatever live tools exist. That creates a false sense of safety: an agent may assume the listed surface is read-only while the generic dispatcher can expose mutable operations discovered at runtime.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger text says to use this skill for 'ANY Yingmi MCP request,' which is overly broad and can cause the skill to be invoked even when direct API use, narrower skills, or additional approval logic would be more appropriate. In this case, over-invocation is more risky because the skill exposes a generic tool-calling mechanism rather than a tightly scoped read-only interface.

Static analysis

No suspicious patterns detected.