ClawHub
Back to skill

Security audit

Shulan MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it can create paid or recurring research tasks without a built-in confirmation step.

Review this before installing if the connected ShuLan account has real billing enabled. Only use shulan_create_task after an explicit user decision about cost, recurrence, data sources, and scope; prefer read-only tools until the user confirms they want a paid task created.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The tool exposes a backend action that can create paid one-off tasks and recurring subscriptions, yet the skill is described broadly as research/report generation without clearly surfacing that invocations may incur charges. In an agent setting, this is dangerous because a model or user may trigger billable operations unintentionally, leading to unauthorized spending or recurring costs.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The manifest provides broad, marketing-style descriptions for a data-research skill but does not define clear activation boundaries, allowed user intents, or cost-sensitive guardrails for when tools should be invoked. In an agent ecosystem, this ambiguity can cause overbroad routing or unsolicited invocation of external data operations, increasing the chance of unnecessary data disclosure, unintended task creation, or surprise billing.

Missing User Warnings

High
Confidence
98% confidence
Finding
The tool description explicitly states that creating a research task triggers automatic billing, yet the manifest does not require an explicit user confirmation step or present a strong warning at selection/invocation time. This is dangerous because an agent could create paid tasks based on an inferred request, resulting in unauthorized charges, repeated subscription costs, or abuse through prompt manipulation that steers the agent into billable actions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"prepublishOnly": "npm pack --dry-run"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.0",
    "zod": "^3.24.1"
  }
}
Confidence
91% confidence
Finding
Using a caret range for @modelcontextprotocol/sdk allows resolution to newer dependency versions that may change behavior unexpectedly across installs, reducing build reproducibility and complicating supply-chain review. In an MCP server context, dependency drift is more sensitive because the package mediates tool access and external data flows.

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.12.0",
    "zod": "^3.24.1"
  }
}
Confidence
84% confidence
Finding
Using a caret range for zod weakens reproducibility and can introduce unreviewed transitive changes on fresh installs. While zod itself is typically lower risk than network-facing infrastructure code, unpinned versions still increase supply-chain uncertainty.

Known Vulnerable Dependency: @modelcontextprotocol/sdk==1.12.0 — 3 advisory(ies): CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport); CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)

High
Category
Supply Chain
Confidence
96% confidence
Finding
The file references @modelcontextprotocol/sdk 1.12.0, which is flagged with multiple advisories including cross-client data leakage, ReDoS, and missing DNS rebinding protections. Because this skill is an MCP server that wraps a data platform for use by clients like Claude Code, Cursor, and ChatGPT Actions, exploitation could expose data between clients, enable denial of service, or weaken network trust boundaries in a particularly sensitive integration point.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
mcp-server/server.js:14