Security audit

Mcp Server

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real ChatbotX MCP bridge, but it grants broad live workspace access and includes unsafe remote-authentication patterns that users should review before installing.

Install only if you are comfortable giving an AI agent live access to your ChatbotX workspace, including contacts, conversations, tags, deletes, and message/flow actions. Prefer local stdio mode or a tightly restricted private SSE deployment, avoid putting workspace tokens in URLs, use least-privilege and revocable tokens where possible, restrict network exposure and CORS origins, and review the OpenAPI operations exposed by your ChatbotX instance before enabling agent access.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The README explicitly instructs users to place a long-lived workspace token in the SSE URL query string for ChatGPT.com. Query-string credentials are commonly exposed through browser history, logs, reverse proxies, analytics, screenshots, and referrer leakage, so this creates a real credential-exposure risk rather than a purely theoretical concern.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code fetches a remote OpenAPI spec at runtime from CHATBOTX_API_URL and automatically converts every discovered operationId/path into exposed MCP tools. This creates a dynamic trust boundary: whoever controls that endpoint or spec can change the tool surface without a code update, potentially exposing unexpected high-risk actions to the agent.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: Although described as a ChatbotX marketing skill, the implementation behaves as a generic MCP proxy that discovers and exposes remote API methods dynamically. This broad proxy behavior increases attack surface and can mislead operators or agents about what capabilities are actually being granted.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The server accepts API tokens from URL query parameters (`workspace_token` or `token`). Tokens in URLs are commonly exposed through logs, browser history, proxies, referrers, and monitoring systems, making credential leakage much more likely than header-based authentication. In the context of an authenticated MCP endpoint, this broadens secret exposure without clear necessity.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: CORS is configured with `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Headers: *` on an authenticated endpoint. This allows arbitrary websites to make cross-origin requests to the MCP server, which increases the risk of unauthorized browser-based interaction if a token is exposed or stored in a context reachable by web content. Given this skill exposes chat/marketing platform capabilities, misuse could lead to access to contacts, conversations, or outbound messaging actions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation normalizes credential-in-URL usage without any warning about the security consequences. Because this MCP server exposes broad workspace capabilities—contacts, messages, tags, broadcasts, and other CRM operations—a leaked token could grant substantial read/write access to sensitive customer data and messaging actions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation tells users to set CHATBOTX_ALLOW_SELF_SIGNED_CERT=true without prominently warning that this disables TLS certificate verification. In practice, that enables man-in-the-middle interception of workspace tokens and API traffic, especially for self-hosted or remote deployments.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The request executor forwards user-supplied tool arguments into path, query, and JSON body fields and sends them with a bearer API key to the remote API. Without explicit confirmation gates for destructive operations or sensitive data egress, an agent can be induced to perform unintended external actions against the ChatbotX account.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The request executor forwards user-supplied tool arguments into path, query, and JSON body fields and sends them with a bearer API key to the remote API. Without explicit confirmation gates for destructive operations or sensitive data egress, an agent can be induced to perform unintended external actions against the ChatbotX account.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Accepting API tokens in query parameters without strong disclosure or warnings is dangerous because users may unknowingly place secrets into URLs, which are routinely retained in logs, analytics, caches, and histories. This is not just a documentation issue: the implementation itself creates an unsafe authentication path that encourages accidental secret leakage.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.cjs:4

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.mjs:4