ClawHub
Back to skill

Security audit

Mcp Client

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent MCP bridge, but it gives agents broad access to locally configured MCP servers and forwards the full environment to those processes without enough scoping or user-control requirements.

Install only if you trust the MCP servers in your OpenClaw config and are comfortable with them receiving your agent process environment. Review tool calls carefully, especially anything that can edit files, drive a browser, change memory, or touch databases/accounts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This skill is explicitly designed to invoke arbitrary MCP tools that may modify files, browser state, databases, or memory, yet it does not require an explicit user warning or confirmation before performing destructive actions. In this context, that omission is materially risky because the skill bridges into installed local MCP servers with potentially powerful capabilities, making accidental or socially engineered state changes more likely.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script spawns an arbitrary MCP server command from user-controlled local configuration and passes the full parent environment into that child process, augmenting it with any server-specific variables. This can expose sensitive secrets such as API tokens, cloud credentials, SSH-related variables, and other privileged runtime state to any configured MCP server, which is especially risky because this skill is explicitly designed to launch third-party servers for file access, browser automation, memory, and database operations.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/mcp-call.js:88