ClawHub
Back to skill

Security audit

api-to-typemcp

Security checks for vulnerabilities and agentic risk

Overview

The skill discloses and gates its sensitive actions, but this package appears to have a reliability defect that prevents generation.

Treat optional agent installation as a real local configuration change and review the exact plan paths before approving. Also verify the package is fixed before relying on it, because the inspected version appears unable to generate due to a missing template file.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares no explicit permissions, yet its documented behavior includes reading files, writing files, inspecting environment variables, invoking shell commands, and performing network-dependent package installation during verification. This creates a real trust and review gap: a caller may assume a narrower capability set than the skill actually uses, increasing the chance of unintended file access, config mutation, or external connectivity in sensitive environments.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The stated purpose focuses on converting supplied API sources into a TypeMCP project, but the skill also documents home-directory client discovery, native MCP client config modification, external CLI invocation, and npm/node execution. That mismatch is security-relevant because users may consent to code generation while not realizing the skill can inspect local agent installations or alter client configurations, which expands the attack surface into persistence and local environment modification.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill's stated purpose is to turn supplied API sources into a TypeMCP project, but this file also exposes install-plan, install-approve, install-export, and install-apply commands that extend into agent discovery and configuration changes. Expanding scope from project generation into modifying external client setup increases the attack surface and can cause users or higher-level agents to grant broader filesystem/config access than the advertised capability requires.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
The install-apply path invokes native installation logic that writes to agent client configuration files under a user-supplied home directory, which is a privileged side effect unrelated to simple project generation. In a skill advertised as 'safe TypeMCP project' creation, this can mislead operators or orchestrators into allowing configuration mutation that enables persistence, command execution hooks, or redirection of external clients to attacker-chosen servers.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The CLI description says the engine is 'deterministic, local-only,' but the install commands operate on the user's home directory and modify agent configuration, which is a materially broader and more sensitive capability. Mislabeling security-relevant behavior can cause unsafe approvals by users or automation that rely on metadata and descriptions to determine whether a tool is permitted to run.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
install-apply performs configuration changes and only returns mutated paths after completion, without a strong user-facing warning at the point of execution that files in agent config locations will be changed. Even with plan-digest confirmation, the absence of an explicit mutation warning increases the risk of accidental or socially engineered execution, especially in an agent skill expected to generate code rather than alter user environment settings.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def run_cli(args: list[str], env_extra: dict[str, str] | None = None) -> subprocess.CompletedProcess[str]:
    env = os.environ.copy()
    env["PYTHONIOENCODING"] = "utf-8"
    if env_extra:
        env.update(env_extra)
Confidence
82% confidence
Finding
Copying the full parent environment into a subprocess can expose sensitive credentials, tokens, proxy settings, or CI secrets to the generated CLI and any code it invokes during E2E execution. In this skill context, the test intentionally generates a project and may later interact with external tooling or package installation flows, so inherited secrets broaden the blast radius if the generated code or dependencies are compromised.

Unvalidated Output Injection

High
Category
Output Handling
Content
) -> dict[str, Any]:
    """Run a command and capture the result."""
    try:
        r = subprocess.run(
            cmd,
            cwd=cwd,
            env=env,
Confidence
80% confidence
Finding
The verifier executes package-defined tooling against untrusted generated projects, including 'npm run build' and binaries resolved via npx. Although lifecycle scripts are disabled for install and the environment is scrubbed, build/test/typecheck commands still run attacker-controlled project code, which can consume resources, access the provided base URL, and act on any network reachable from the host.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"test": "vitest run"
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.30.0",
    "@theorvane/type-mcp": "0.3.2",
    "zod": "^4.4.3"
  },
Confidence
91% confidence
Finding
The dependency uses a caret range, which permits automatic installation of newer minor and patch releases. In a template that will be reused to generate projects, this weakens build reproducibility and increases supply-chain exposure if a future upstream release is compromised or introduces breaking behavior.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "@modelcontextprotocol/sdk": "^1.30.0",
    "@theorvane/type-mcp": "0.3.2",
    "zod": "^4.4.3"
  },
  "overrides": {
    "@hono/node-server": "2.0.12"
Confidence
91% confidence
Finding
The zod dependency is specified with a caret range, allowing the resolved version to change over time. That creates non-reproducible installs and a supply-chain risk window if a later allowed release is malicious, vulnerable, or incompatible with the generated code.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/test_policy.py:13

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
tests/fixtures/petstore.openapi.json:4

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
tests/test_manifest.py:115