Security audit

Leafengines

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a remote agriculture MCP connector, but its documentation recommends high-impact external setup and describes broader data collection than the core skill manifest clearly scopes.

Install only if you are comfortable routing agricultural, location, and possibly farm operational data to the LeafEngines remote service. Prefer the declared free-tier MCP endpoint over the README's unpinned global npm install, do not store paid API keys in world-readable config files, and treat the shared test key as non-secret evaluation access only.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:259
Finding: Unpinned Third-Party npm Package Installed Globally
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/install.sh:16
Finding: API Key Configuration Created Without Restrictive File Permissions
Content: View full analysis
"$CONFIG_DIR/config.yaml" << EOF # OpenClaw Configuration # LeafEngines MCP Server added $(date) mcpServers: leafengines: url: https://wzgnxkoeqzvueypwzvyn.supabase.co/functions/v1/mcp-server headers: x-api-key: YOUR_API_KEY_HERE description: Agricultural Intelligence API for soil analysis, weather forecasting, and crop recommendations # Add your API key after getting it from: # https://github.com/QWarranto/leafengines-claude-mcp/issues/new?template=get-api-key.md EOF echo "✅ Created OpenClaw config at $CONFIG_DIR/config.yaml" ``` ### Technical Analysis The installer creates `$HOME/.openclaw/config` and `config.yaml` using the user's current `umask`. It does not explicitly enforce mode `0700` on the configuration directory or mode `0600` on the configuration file. The generated file initially contains a placeholder, but the installation instructions tell users to replace it with an actual paid API key. Consequently, a long-lived credential is stored in plaintext in a file whose confidentiality depends on ambient directory permissions and the user's environment. Under a permissive `umask`, the directory or file may be readable by other local users or processes. Existing parent-directory protections may reduce exploitability on some systems, but the installer does not verify or enforce those protections. ### Attack Path 1. A user runs the installation script in an environment with permissive default permissions. 2. The script creates ...[truncated 1127 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill markets itself as an agricultural intelligence tool, but much of the file is actually setup and remote service onboarding that directs users to configure external MCP endpoints, headers, and paid API-key flows. This mismatch can mislead users into trusting and enabling a remote service with broader data exposure and billing implications than the declared purpose suggests, especially because the functionality is not locally implemented or auditable in the skill.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.
md
description: LeafEngines - Agricultural Intelligence with Free Tier & Founder Pricing. 1,092+ downloads. 3 tools for soil analysis, crop recommendations, and TurboQuant capabilities. Free tier available with x-free-tier header. homepage: https://app.soilsidekickpro.com/mcp source: https://github.com/QWarranto/leafengines-claude-mcp metadata: {"openclaw":{"emoji":"🌱","os":["darwin","linux"],"requires":{"bins":[]},"install":[{"id":"claude-desktop","kind":"manual","steps":["1. Open Claude Desktop settings","2. Navigate to Developer → MCP Servers","3. Add new server with URL: https://wzgnxkoeqzvueypwzvyn.supabase.co/functions/v1/mcp-server","4. Add header: x-free-tier: true (FREE) OR x-api-key: YOUR_PAID_KEY (Paid)"],"label":"Configure in Claude Desktop"},{"id":"openclaw-mcp","kind":"manual","steps":["1. Choose FREE tier (x-free-tier: true) or PAID tier (get API key from Stripe checkout)","2. Configure MCP server in OpenClaw config with appropriate header"],"label":"Configure in OpenClaw"}],"mcp":{"server":"https://wzgnxkoeqzvueypwzvyn.supabase.co/functions/v1/mcp-server","headers":{"x-free-tier":"true"},"tools":[{"name":"analyze_soil","description":"Analyze soil characteristics and get recommendations for a specific location. Requires county_fips parameter (5-digit code).","inputSchema":{"type":"object","properties":{"county_fips":{"type":"string","description":"5-digit county FIPS code (e.g., '13067' for Fulton County, GA)"},"api_key":{"type":"string","description":"Optional API key for paid features (use x-api-key header instead)"}},"required":["county_fips"]}},{"name":"recommend_crop","description":"Get crop recommendations based on soil analysis.","inputSchema":{"type":"object","properties":{"county_fips":{"type":"string","description":"5-digit county FIPS code"},"api_key":{"type":"string","description":"Optional API key for paid features"}},"required":["county_fips"]}},{"name":"check_turboquant","description":"Check if TurboQuant capabilities are available for a ...[truncated 25 chars]

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 3)May include surrounding context.
md
# LeafEngines ClawHub Skill ## 🚀 FREE TIER: NO API KEY NEEDED!nn**Immediate access with test key:** `leaf-test-370df0a2e62e`nn### ✅ Try It Now (No Waiting):nn1. **Use test key:** `leaf-test-370df0a2e62e`n2. **Immediate access** to all featuresn3. **No forms, no waiting, no approval**n4. **Works across all platforms**nn**Test key gives you:**n- Full soil analysis capabilitiesn- Crop recommendationsn- Weather datan- Environmental impact assessmentn- All free tier featuresnn---nn**Want higher limits or commercial use?** Get instant API keys via [Stripe checkout](https://buy.stripe.com/14A7sL30y8bR2F4fbgaMU02) (Starter: $49 Founder Pricing). 🌱 **Patent-Protected Agricultural Intelligence for OpenClaw Agents** - The only MCP server with patented algorithms. 755+ developers agree.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · README.md (reported line 9)May include surrounding context.
md
# LeafEngines ClawHub Skill ## 🚀 FREE TIER: NO API KEY NEEDED!nn**Immediate access with test key:** `leaf-test-370df0a2e62e`nn### ✅ Try It Now (No Waiting):nn1. **Use test key:** `leaf-test-370df0a2e62e`n2. **Immediate access** to all featuresn3. **No forms, no waiting, no approval**n4. **Works across all platforms**nn**Test key gives you:**n- Full soil analysis capabilitiesn- Crop recommendationsn- Weather datan- Environmental impact assessmentn- All free tier featuresnn---nn**Want higher limits or commercial use?** Get instant API keys via [Stripe checkout](https://buy.stripe.com/14A7sL30y8bR2F4fbgaMU02) (Starter: $49 Founder Pricing). 🌱 **Patent-Protected Agricultural Intelligence for OpenClaw Agents** - The only MCP server with patented algorithms. 755+ developers agree.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The README publicly exposes a shared test API key and explicitly encourages anyone to use it immediately. Even if intended for free-tier evaluation, embedding a reusable credential in public documentation invites abuse, quota exhaustion, attribution confusion, and accidental reliance on a non-personal secret across agents and users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The configuration section instructs users to send requests to a remote Supabase-hosted endpoint and to set an API key, but it provides no warning that agent inputs, coordinates, and other operational data will be transmitted to a third-party service. In an agent context, this omission can lead operators to unknowingly route sensitive environmental, location, or business data off-platform without consent or review.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest description presents the skill in very general terms such as agricultural intelligence, soil analysis, and crop recommendations, but does not define specific activation phrases, contexts, or exclusions. In systems that use manifest text to infer routing, this broad wording could overlap with many ordinary agriculture-related requests and cause unintended invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented endpoints collect sensitive operational data such as precise geolocation, farm size, budget, planting practices, and base64-encoded photos, but the reference provides no privacy, retention, sharing, or security-handling notice. In an agricultural context, this can expose commercially sensitive information and images of fields or crops without users understanding how their data is stored, processed, or shared.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The API reference exposes a materially broader feature set than the skill metadata suggests, including pest detection, irrigation scheduling, yield prediction, market prices, sustainability scoring, and farm planning. This capability mismatch can mislead users and reviewers about what data the skill collects and what actions it enables, weakening informed consent and security review coverage.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/install.sh (reported line 15)May include surrounding context.
sh
exit 1 fi # Create configuration directory CONFIG_DIR="$HOME/.openclaw/config" mkdir -p "$CONFIG_DIR"

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The file header says 'LeafEngines MCP Server installation script' but immediately states 'For OpenClaw skill installation,' which describes a different integration target than the manifested LeafEngines skill identity. This creates documentation-level ambiguity about what is actually being installed and for whom.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes the skill as providing soil analysis, crop recommendations, and TurboQuant capabilities. The installer writes a config description claiming 'soil analysis, weather forecasting, and crop recommendations,' adding weather forecasting while omitting TurboQuant, so the documented behavior presented to users does not match the stated manifest scope.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: README.md:179