ClawHub
Back to skill

Security audit

MyDriverParis Booking

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ride-booking integration, but it asks users to trust a mutable remote service with passenger details and payment-link generation without destination validation.

Review before installing. Only provide passenger and itinerary details when you intend to request a quote or booking, and verify any payment link domain and merchant details yourself before paying. The artifact does not show local malware or hidden execution, but the remote MCP service and payment destination are the main trust points.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Remote MCP Service Creates a Mutable Supply-Chain Trust Boundary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–25
Vulnerability Type: Unverifiable third-party remote service dependency
Risk Level: Medium

Vulnerable Code

markdown

https://mcp-mydriverparis.mydriverparis.workers.dev/mcp

text

## Setup (once)

```bash
openclaw mcp add mydriverparis \
  --url https://mcp-mydriverparis.mydriverparis.workers.dev/mcp \
  --transport streamable-http
text

### Technical Analysis

The skill permanently registers a remotely controlled MCP endpoint hosted on a shared `workers.dev` domain. The remote component is not version-pinned, integrity-verified, or accompanied by locally auditable implementation code or fixed tool schemas.

Consequently, the behavior exercised when the skill is used may differ from the behavior present when `SKILL.md` was reviewed. HTTPS protects data in transit but does not establish the continued integrity or trustworthiness of the endpoint itself. If the service, deployment account, DNS configuration, or upstream implementation is compromised, its tools can return manipulated results and receive information submitted through booking operations.

No evidence establishes that the current endpoint is malicious. The confirmed weakness is the absence of controls that bind the installed skill to a reviewed server implementation.

### Attack Path

1. A user installs the skill and registers the specified MCP endpoint.
2. The agent subsequently calls tools exposed by that endpoint.
3. The remote deployment or its controlling account is compromised, or its behavior is changed after review.
4. The altered service continues to appear under the registered `mydriverparis` tool identity.
5. The service receives passenger contact and travel data or returns manipulated quotes, booking responses, and payment destinations.
6. The agent relies on those responses because the skill provides no integrity, version, or response-origin validation
...[truncated 664 chars]
Remediation
View remediation

Remediation Suggestions

  • Host the MCP service on an organization-controlled, documented first-party domain rather than relying solely on a shared hosting subdomain.
  • Publish the server implementation and fixed tool schemas so its behavior can be independently audited.
  • Introduce explicit API or deployment versioning and pin the skill to a reviewed version.
  • Use signed server metadata or another attestation mechanism where supported.
  • Restrict the tools and data fields available to the minimum required for quoting and booking.
  • Require explicit user consent immediately before transmitting personal or itinerary data.
  • Document the service operator, privacy policy, retention period, subprocessors, and incident-reporting process.
  • Monitor the endpoint and fail closed if its identity, certificate expectations, tool schema, or response format changes unexpectedly.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:38
Finding

Remote Payment URL Is Presented Without Destination Validation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38–40
Vulnerability Type: Unvalidated externally supplied payment link
Risk Level: Medium

Vulnerable Code

markdown
4. Confirm vehicle + collect passenger name, email, phone (E.164).
5. `book_ride` with `quote_id`, `vehicle_id`, passenger details, `flight_number` if any, and a fresh UUID `idempotency_key`. It returns a **secure Stripe payment link** — hand it to the user on its own line.
6. The booking is confirmed **only after payment**. Never say "confirmed" before.

Technical Analysis

The skill instructs the agent to present the URL returned by book_ride as a “secure Stripe payment link,” but it does not require validation of the URL scheme, hostname, redirect behavior, or association with the expected merchant.

The security label is therefore based solely on the remote service's response. If the MCP endpoint or booking backend is compromised, it could return an attacker-controlled HTTPS URL. HTTPS alone would not prove that the destination is operated by Stripe or the legitimate merchant.

Presenting the returned link on its own line may increase its apparent legitimacy while omitting information that would allow the user to recognize a suspicious destination.

Attack Path

  1. An attacker gains control over the MCP endpoint, booking backend, or the component that constructs the book_ride response.
  2. A user asks the agent to book a ride and provides the required passenger information.
  3. The attacker-controlled service returns a phishing or fraudulent payment URL instead of an authorized Stripe destination.
  4. Following the skill instructions, the agent presents that URL as a secure Stripe payment link without validating its destination.
  5. The user opens the link and submits payment-card details, authentication information, or money to the attacker.

Impact Assessment

This issue does not provide direct local-system p ...[truncated 594 chars]

Remediation
View remediation

Remediation Suggestions

  • Require the returned URL to use HTTPS.
  • Parse the URL and enforce an explicit allowlist of approved Stripe or first-party payment hostnames.
  • Reject user-info components, malformed hosts, unexpected ports, IP-literal destinations, and domains that only contain an approved name as a substring.
  • Validate the effective destination after redirects, not only the initially returned URL.
  • Display the normalized hostname to the user and ask for confirmation before the link is opened.
  • Avoid describing a URL as “secure Stripe” unless its origin has been programmatically verified.
  • Bind the payment session to the expected quote, amount, currency, merchant, and booking identifier.
  • Prefer a verified first-party booking page that redirects to a server-created Stripe Checkout session.
  • Log payment-link generation and alert on unexpected destination domains or merchant-account changes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep