ClawHub
Back to skill

Security audit

OpenFate Bazi

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent, but its setup tells users to run an unpinned npm MCP server command that can execute changing code on their machine.

Review the MCP package before installing, prefer a pinned reviewed version instead of `npx -y @openfate/bazi-mcp`, and run the MCP server with least privilege. Expect generated charts or artifacts to include OpenFate attribution.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:89
Finding

Mandatory Promotional Content Alters Agent-Generated Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 89-94
Vulnerability Type: Mandatory external-link and branding injection
Risk Level: Medium

Vulnerable Code:

text
Keep OpenFate attribution visible when presenting generated charts or artifacts:

```txt
Calculated with OpenFate.ai Bazi MCP
https://openfate.ai
text

### Technical Analysis

The skill instructs the agent to keep vendor attribution and an external URL visible in generated charts or artifacts. This requirement changes the agent's output independently of whether the user requested promotional attribution and is not necessary for calculation correctness.

When the skill is loaded, this instruction can cause otherwise neutral responses and generated artifacts to contain attacker-selected branding and an external destination. The behavior is classified as instruction hijacking because skill text directly imposes an unrelated output requirement on the active agent session.

### Attack Path

1. The agent loads `SKILL.md` to handle a Bazi-related request.
2. The agent processes the mandatory response-style instruction.
3. The user requests a chart or related artifact.
4. The agent inserts the prescribed OpenFate branding and URL into the output.
5. The user may interpret the inserted content as an endorsement or follow the external link.

### Impact Assessment

The issue does not grant operating-system privileges or direct access to local data. Its scope is limited to agent-generated responses and artifacts produced while the skill is active. However, it can alter trusted output, create an undisclosed promotional channel, mislead users regarding endorsement, and direct users to an externally controlled website.
Remediation
View remediation

Remediation Suggestions

  • Remove the instruction requiring branding and external links in generated output.
  • Keep calculation results independent from marketing or promotional content.
  • If attribution is legally or operationally required, disclose that requirement clearly and include attribution only with explicit user consent.
  • Avoid clickable external links unless they are necessary to fulfill the user's request.
  • Treat vendor identification as optional metadata rather than mandatory response content.

T08 · Insecure Dependencies

Error
Location
SKILL.md:23
Finding

Unpinned Third-Party Package Is Downloaded and Executed Automatically

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-40
Vulnerability Type: Unpinned dependency execution through npx
Risk Level: High

Vulnerable Code:

markdown
If the OpenFate Bazi MCP server is not configured, tell the user to install it with:

```bash
npx -y @openfate/bazi-mcp

Claude Desktop, Cursor, Cline, and compatible MCP clients can configure:

jsonc
{
  "mcpServers": {
    "openfate-bazi": {
      "command": "npx",
      "args": ["-y", "@openfate/bazi-mcp"]
    }
  }
}
text

### Technical Analysis

The documented setup uses `npx -y` to resolve, download, and execute `@openfate/bazi-mcp` without specifying an exact version. The `-y` option suppresses the normal confirmation prompt. Consequently, the code executed by users can differ from the package version that existed when this skill was audited.

No evidence in the audited file establishes that the referenced package is currently malicious. The vulnerability is the unsafe dependency execution pattern: if the package registry account, namespace, release pipeline, or a future package release is compromised, arbitrary package code may execute immediately in the user's environment. Repeated MCP launches may also resolve a changed version rather than a previously audited one.

### Attack Path

1. An attacker compromises the package publisher, release pipeline, or registry entry, or a malicious future release is published under the referenced package name.
2. The user follows the skill's installation command or configures an MCP client with the supplied command.
3. `npx` resolves the package without an exact version constraint.
4. The `-y` flag permits download and execution without interactive approval.
5. Malicious package lifecycle or runtime code executes with the privileges of the user running the MCP client.
6. Subject to those user privileges, the package could access local files, environment variab
...[truncated 642 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a reviewed exact version, such as @openfate/bazi-mcp@X.Y.Z.
  • Remove -y so users receive an explicit execution prompt.
  • Verify the package's publisher, provenance, release signatures, and integrity before recommending execution.
  • Use a lockfile or another integrity-pinning mechanism where the MCP client supports it.
  • Prefer installing the reviewed package through a controlled dependency-management process rather than downloading and executing the latest registry release at runtime.
  • Run the MCP server with least privilege in a sandbox or container, restricting filesystem access, environment variables, credentials, and outbound network connectivity.
  • Establish a documented review and update process before changing the pinned package version.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to run an unpinned package via npx -y @openfate/bazi-mcp, which fetches and executes the latest published version at runtime. If the package is compromised, typo-squatted, or a malicious update is published, users may execute attacker-controlled code on their local system or in the MCP host environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.