osint-mcp

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:18 AM UTC
• Version: 2.4.3

Overview

The skill's OSINT purpose is clear, but its setup asks users to install and persistently run mutable external code from GitHub.

Review and pin the osint-mcp source before installing, prefer an isolated virtual environment or container, and configure only task-specific API keys. Treat person, breach, and geolocation results as sensitive estimates and use the skill only for authorized investigations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Remote Git Dependency Installed and Registered as an MCP Server

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–20
Vulnerability Type: Unpinned dependency from a mutable remote source
Risk Level: Medium

bash

pip install "git+https://github.com/snuri00/osint-mcp"
openclaw mcp add osint-mcp --command osint-mcp-server

Technical Analysis

The installation command retrieves and installs executable Python package content directly from the default branch of a remote GitHub repository. It does not specify an immutable commit hash, a signed release, a fixed package version, or an integrity hash.

Consequently, the code installed by this command can change after the skill has been reviewed. Python package installation may execute attacker-controlled build hooks, while subsequent registration causes the installed osint-mcp-server command to run as an MCP server. The local project does not contain the external implementation, so its behavior could not be verified during this audit.

No evidence establishes that the current upstream repository is malicious. The vulnerability is the unsafe trust model: a future malicious commit, repository compromise, or ownership change could turn the documented setup procedure into a code-execution path.

Attack Path

1. An attacker compromises the referenced GitHub repository, gains control of its publishing workflow, or causes malicious content to be committed to its default branch.
2. The attacker modifies Python build hooks, package initialization logic, or the osint-mcp-server executable.
3. A user follows the setup instructions and runs the unpinned pip install command.
4. pip retrieves the current attacker-controlled repository state and may execute malicious build or installation logic.
5. The user registers the installed executable with OpenClaw.
6. OpenClaw launches the malicious MCP server, allowing the payload to operate with the privileges and environment available to that process.

Impact Assessment

...[truncated 623 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the Git dependency to a specific, reviewed commit hash rather than the repository's mutable default branch:

   bash

   pip install "git+https://github.com/snuri00/osint-mcp@REVIEWED_COMMIT_HASH"
   

2. Prefer a fixed, trusted package release with cryptographic hashes and a lock file. Verify release signatures or provenance where available.
3. Review the pinned source, including packaging metadata, build-system configuration, installation hooks, entry points, and MCP server code.
4. Install the dependency in an isolated virtual environment or container instead of the user's global Python environment.
5. Run the MCP server under a dedicated low-privilege account or sandbox with restricted filesystem and network access.
6. Expose only API keys required for a specific operation. Do not pass unrelated credentials or the user's complete environment to the server.
7. Document an update process requiring explicit review and integrity verification before changing the pinned revision.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

- Authorized, lawful, ethical use only: security research, CTF, journalism, and
  auditing your own footprint.
- Refuse misuse: decline requests whose evident purpose is to stalk, dox,
  harass, surveil, locate, or harm a specific private individual without consent
  (e.g. "find where this person lives", "track my ex"). Explain the boundary and
  offer a legitimate alternative. Treat geolocation/breach results as estimates,
  never as proof — a wrong result can harm an innocent person.

Static analysis

No suspicious patterns detected.