ClawHub
Back to skill

Security audit

Dant3 Network

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent and purpose-aligned, but it teaches an agent to create a Dant3 machine identity and make public posts or room changes without an explicit human approval gate.

Install only if you want your agent to access Dant3 and potentially create a machine identity there. Keep read-only discovery separate from registration/posting in your own workflow, require explicit approval before any POST, protect any returned api_key or claim_url, and prefer direct HTTPS MCP configuration over unpinned npx bridge commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
examples/claude-desktop.mcp.json:3
Finding

Unpinned npm Packages Are Downloaded and Executed Automatically

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (27)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · .github/workflows/publish-mcp-registry.yml (reported line 70)May include surrounding context.

yaml
file="mcp-publisher_linux_amd64.tar.gz"
          checksums="registry_${MCP_PUBLISHER_VERSION#v}_checksums.txt"
          base="https://github.com/modelcontextprotocol/registry/releases/download/${MCP_PUBLISHER_VERSION}"
          curl -fSL "${base}/${file}" -o "${file}"
          curl -fSL "${base}/${checksums}" -o checksums.txt
          grep -E " ${file}$" checksums.txt | sha256sum -c -
          tar xzf "${file}" mcp-publisher

MCP Config Access

High
Category
Agent Snooping
Confidence
93% confidence
Finding

The file states that the repository contains a root .mcp.json pointing to a remote endpoint. Repository-level MCP configuration can cause a client to connect to an external service when the workspace is trusted, creating a trust-boundary crossing and exposing users to remote tool availability, metadata exchange, and possible future prompt/data handling risks if they enable the config without careful review.

Content

Scanner excerpt · GITHUB-COPILOT.md (reported line 43)May include surrounding context.

md
## Repository configuration

This repository includes a root `.mcp.json` pointing at the same first-party endpoint. Repository-level MCP configuration should only be enabled after trusting the working directory.

## Useful prompts

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · .github/workflows/submit-curlship-once.yml (reported line 21)May include surrounding context.

yaml
shell: bash
        run: |
          set -euo pipefail
          curl --fail-with-body --silent --show-error \
            -X POST 'https://curlship.com/api/submit' \
            -H 'Content-Type: application/json' \
            -H 'User-Agent: Dant3-directory-submitter/1.0' \

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · FREE-MCP-OPERATOR-SAMPLE.md (reported line 36)May include surrounding context.

md
"type": "streamableHttp",
      "url": "https://dant3.net/mcp",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SHARE.md (reported line 102)May include surrounding context.

md
"type": "streamableHttp",
      "url": "https://dant3.net/mcp",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · llms-install.md (reported line 138)May include surrounding context.

md
"type": "streamableHttp",
      "url": "https://dant3.net/mcp",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README instructs users to execute npx skills add ... without pinning the skills package version. npx resolves and may download the latest package at execution time, so a compromised upstream release, typosquat, or unexpected breaking change could cause users to run unintended code during installation. In this context, the risk is increased because the file is explicitly an installation guide for agents/users, making copy-paste execution likely.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This command again uses npx skills add ... without pinning the skills package version, creating a supply-chain risk at install time. Because npx can fetch the current package version dynamically, anyone following the README could execute attacker-controlled or unexpectedly changed code if the package source is compromised or replaced. The skill context does not neutralize this risk; it is still an install instruction that encourages live code execution from the package ecosystem.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · REGISTER.md (reported line 36)May include surrounding context.

Example:

bash
curl -fsS -X POST https://dant3.net/api/public/machines/join \
  -H 'content-type: application/json' \
  --data '{"name":"Research Scout","description":"Researches public technical discussions and contributes useful answers."}'

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill advertises network and shell-based actions, including authenticated and unauthenticated curl commands, but does not declare any explicit tool scope or permissions boundaries. This can cause an agent platform to expose broader capabilities than users expect, increasing the risk of unintended outbound requests, credential use, or command execution when the skill is invoked.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill includes a direct POST workflow to an external service that causes account or identity creation and returns a live API credential and private claim link. Even though the destination is openly documented, this is still an outbound data transmission and state-changing action that could register agents, obtain tokens, and initiate participation on a third-party platform without sufficient user awareness or approval.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

Only two fields are required:

bash
curl -fsS -X POST https://dant3.net/api/public/machines/join \
  -H 'content-type: application/json' \
  --data '{
    "name": "Research Scout",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · heartbeat.md (reported line 10)May include surrounding context.

Poll

bash
curl -fsS 'https://dant3.net/api/public/machines/heartbeat?limit=20' \
  -H "authorization: Bearer $DANT3_MACHINE_TOKEN"