T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mcp_bridge.mjs:49- Finding
Caller-Controlled Local File Exfiltration to an Arbitrary Network Destination
- Content
View full analysis
- Remediation
View remediation
Security audit
Outline MCP
Security checks for vulnerabilities and agentic risk
Overview
Review before installing: this Outline integration is coherent overall, but its upload helper can read any process-readable local file and send it to an agent-supplied URL.
Install only in a trusted, least-privileged environment. Use a minimally scoped Outline API key, restrict what local files the OpenClaw process can read, verify OUTLINE_URL is an HTTPS trusted Outline origin, and avoid enabling the upload or bulk-sync paths unless you are comfortable with agent-directed local file uploads. The publisher should add URL allowlisting, file path restrictions, and explicit permission declarations before this is treated as routine install material.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mcp_bridge.mjs:11- Finding
Outline Bearer Token Can Be Transmitted to an Untrusted or Plaintext Endpoint
- Content
View full analysis
{ const headers = new Headers(init.headers || {}); headers.set("Authorization", `Bearer ${apiKey}`); headers.set("Accept", "application/json, text/event-stream"); headers.set("Content-Type", "application/json"); return fetch(input, { ...init, headers }); }; ``` ### Technical Analysis `OUTLINE_URL` determines the destination that receives `OUTLINE_API_KEY`, but the scripts do not enforce HTTPS or validate the destination against an expected Outline hostname. The direct API flow derives ...[truncated 2097 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more
High
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
fast-uri 3.1.0 is associated with multiple URI parsing and canonicalization flaws, including host confusion and SSRF-adjacent issues. In an MCP bridge that may fetch remote resources, process URLs, or connect to Outline/SSE endpoints, malformed URLs could bypass host validation or redirect requests to unintended internal/external targets.
- Content
Known Vulnerable Dependency: hono==4.12.9 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
hono 4.12.9 has numerous published advisories affecting routing, cookies, and request handling. Because this skill is an MCP bridge exposed over SSE/HTTP and may mediate document management plus filesystem-assisted uploads, framework-level routing or cookie flaws can meaningfully expand attack surface, potentially enabling auth bypass, path confusion, or unsafe response behavior depending on implementation.
- Content
Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
ip-address 10.1.0 is flagged for address parsing inconsistencies and an XSS issue in HTML-emitting helpers. In this project, the most relevant concern is parsing ambiguity if IP-based trust, rate limiting, or SSRF protections rely on this library transitively; the XSS angle is less likely unless the application renders library-produced HTML.
- Content
Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)
High
- Category
- Supply Chain
- Confidence
- 83% confidence
- Finding
path-to-regexp 8.3.0 is reported vulnerable to ReDoS/DoS through crafted route patterns or path inputs. In an HTTP/SSE-facing MCP service, this can allow unauthenticated attackers to tie up CPU and degrade availability if affected matching paths are reachable.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill requires sensitive environment variables (
OUTLINE_API_KEY,OUTLINE_URL) and also exposes filesystem-capable operations, but it does not declare any explicit tool scope such aspermissionsorallowed-tools. That omission weakens least-privilege controls and makes it easier for an agent or operator to enable the skill with broader capabilities than intended, increasing the chance of unauthorized data access or misuse.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code performs an HTTPS POST to an external Outline API using a bearer token and transmits the requested document ID, but there is no user-facing notice, confirmation, or explanatory comment/docstring describing that remote data access occurs. For code files, outbound network calls that transmit user or system data should include some form of disclosure unless the warning is clearly provided elsewhere.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The upload path accepts an arbitrary upload URL and a caller-supplied local filePath, then reads the file from disk and POSTs it to that remote endpoint with no validation, allowlisting, or user confirmation. In the context of an MCP bridge that explicitly exposes local filesystem access, this increases the risk of an agent or prompt-influenced workflow exfiltrating sensitive local files to attacker-controlled infrastructure, not just to trusted Outline storage.
- Content
Known Vulnerable Dependency: @hono/node-server==1.19.11 — 2 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The lockfile pins @hono/node-server 1.19.11, and the cited advisories affect static file serving behavior, including repeated-slash middleware bypass and Windows path traversal in serve-static. In this skill’s context, the risk is elevated because the MCP bridge explicitly includes local filesystem access and likely exposes HTTP/SSE endpoints; if static serving is used anywhere in the runtime, these bugs could enable unauthorized file access or bypass of intended protections.
- Content
Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)
Low
- Category
- Supply Chain
- Confidence
- 77% confidence
- Finding
body-parser 2.2.2 is flagged for a denial-of-service condition involving invalid limit handling. This is a real dependency risk, but its practical impact here is limited to service instability rather than direct compromise, assuming the application accepts attacker-controlled HTTP request bodies.
- Content
Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)
Low
- Category
- Supply Chain
- Confidence
- 74% confidence
- Finding
qs 6.15.0 is associated with denial-of-service and parsing edge-case issues. This is a real supply-chain weakness, but in this context it most likely affects robustness of query/body parsing rather than confidentiality or privilege boundaries unless attacker-controlled nested parameters are heavily processed.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "license": "ISC", "type": "commonjs", "dependencies": { "@modelcontextprotocol/sdk": "^1.27.1" } }
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The script reads OUTLINE_API_KEY from the environment and immediately uses it to authenticate outbound API requests, but the file contains no comment, docstring, or user-visible message explaining that a credential is required and will be used. Access to sensitive environment variables is in scope for missing-warning findings when no disclosure is present.
- Content
Static analysis
No suspicious patterns detected.