T09 · Insecure Skill Coding Practices
- Location
scripts/mcp-call.js:92- Finding
Full Parent Environment Exposed to Spawned MCP Servers
- Content
View full analysis
Vulnerability Details
File Location:
scripts/mcp-call.js, lines 92–98
Vulnerability Type: Excessive inheritance of potentially sensitive environment variables
Risk Level: HighVulnerable Code
js const { command, args = [], env: serverEnv = {} } = serverConfig; const childEnv = { ...process.env, ...serverEnv }; const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'pipe'], env: childEnv, });Technical Analysis
The script constructs the child process environment by copying every variable from
process.envand then merging the MCP server's configured variables. Consequently, every invoked MCP executable can read the complete parent environment rather than only the variables required for its operation.Agent and automation environments may contain API keys, cloud credentials, CI/CD tokens, service credentials, and other secrets. Although
SKILL.mdadvises against logging MCP environment variables, that guidance does not prevent a spawned process from reading, using, or transmitting inherited secrets.Exploitation requires a malicious or compromised executable to be referenced by an MCP server configuration and then invoked through this client. No shell command injection is involved because
spawn()receives the command and argument array directly; the weakness is excessive credential exposure to the child process.Attack Path
- An attacker introduces, replaces, or compromises an executable referenced by an entry under
mcp.serversin the user's OpenClaw configuration. - The user or agent invokes that configured server through
scripts/mcp-call.js. - The script starts the executable with an environment containing all values from
process.env. - The child process enumerates the inherited environment and extracts available credentials or tokens.
- If the child has network access, it can transmit those secrets externally; otherwise, it can use them locally to access services available from the host.
...[truncated 669 chars]
- An attacker introduces, replaces, or compromises an executable referenced by an entry under
- Remediation
View remediation
Remediation Suggestions
- Do not pass the complete parent environment to MCP servers.
- Construct a minimal allowlisted environment containing only variables required to launch the configured runtime, such as a controlled
PATH, platform-required variables, and explicitly approved entries fromserverConfig.env. - Require explicit opt-in before forwarding sensitive variables to an individual server.
- Validate configured server commands against a trusted allowlist or record approved executable paths and verify them before execution.
- Resolve executables to trusted absolute paths where practical, reducing the risk of
PATH-based executable substitution. - Prompt for confirmation before the first execution of a newly configured or changed MCP server.
- Document that MCP servers run with the user's operating-system privileges and must be treated as trusted local code.
- Consider launching servers in a sandbox with restricted filesystem and network access to limit the consequences of compromise.
A safer environment construction pattern would resemble:
js const childEnv = { PATH: process.env.PATH, HOME: process.env.HOME, ...serverEnv, }; const child = spawn(command, args, { stdio: ['pipe', 'pipe', 'pipe'], env: childEnv, });The final allowlist should be platform-aware and should exclude credentials unless they are explicitly required by, and approved for, that specific MCP server.