ClawHub
Back to skill

Security audit

Key Vault Manager Free

Security checks for vulnerabilities and agentic risk

Overview

This skill is a secret-management helper, but it asks users to run unreviewed local MCP code with broad access to credentials, files, and arbitrary outbound API destinations.

Review carefully before installing. Do not give this skill access to real API keys unless the MCP implementation is included or pinned and independently trusted, and only use it if destinations are restricted to approved API providers. Avoid write-back on files containing secrets without a backup and explicit review of the final content.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:112
Finding

Unverified Remote Payload Retrieval and Local Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 112–118
Vulnerability Type: Remote payload retrieval followed by local MCP registration and execution
Risk Level: High

Vulnerable Code

bash
git clone https://example.com/key-vault-manager.git
bash
/mcp add key-vault-manager node /path/to/key-vault-manager/key-vault-manager.js

Technical Analysis

The installation procedure directs users to clone an external repository and register a downloaded JavaScript file as a local MCP tool. The project under audit contains only SKILL.md; it does not include the referenced JavaScript implementation, an immutable commit identifier, a cryptographic checksum, a package signature, or other integrity-verification material.

Consequently, the code that receives local MCP privileges is outside the reviewed artifact and can differ from the content assessed during this audit. The placeholder example.com address also does not establish an authenticated official distribution source.

Registration through /mcp add allows the downloaded Node.js program to execute locally when its tools are invoked. Based on the documented purpose, that program would be expected to access environment variables, secret-bearing files, writable paths, and external networks. A compromised or subsequently modified repository could abuse those capabilities.

Attack Path

  1. A user follows the installation instructions in SKILL.md.
  2. The user clones code from the external repository without verifying an immutable revision or signature.
  3. The user registers key-vault-manager.js as an MCP executable.
  4. The Agent invokes one of the registered key-management operations.
  5. The downloaded program executes with the permissions of the local Agent process.
  6. A malicious payload can read accessible secrets or files, transmit data over the network, modify writable files, or execute additional local commands.

Imp

...[truncated 508 chars]

Remediation
View remediation

Remediation Suggestions

  • Include the complete, reviewable MCP source code inside the distributed skill artifact.
  • If external retrieval is unavoidable, pin an immutable commit or version rather than a mutable repository state.
  • Publish and verify cryptographic hashes or signatures before registration or execution.
  • Replace the placeholder repository with an authenticated, documented official distribution source.
  • Require explicit user review and confirmation before registering the downloaded executable.
  • Run the MCP server in a sandbox with narrowly scoped filesystem, environment-variable, process-execution, and network permissions.
  • Provide a dependency lockfile and reproducible build instructions.
  • Fail closed if integrity verification cannot be completed.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:137
Finding

Secret-Bearing Requests Can Be Sent to a Caller-Controlled URL

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 137–140 and 166–169
Vulnerability Type: Unrestricted destination combined with local secret injection
Risk Level: High

Vulnerable Code

text
call_api({
  key_name: "OPENAI_API_KEY",
  url: "https://api.openai.com/v1/models",
  method: "GET"
})

The documented interface defines both key_name and url as caller-provided string parameters, with optional caller-controlled HTTP method and body parameters.

Technical Analysis

The call_api design combines selection of a local secret with selection of an outbound request destination. The documentation does not specify any of the controls required to make this pattern safe, including:

  • Binding each credential to an approved origin
  • Restricting destinations to a hostname allowlist
  • Enforcing HTTPS and certificate validation
  • Blocking loopback, link-local, private, and cloud metadata addresses
  • Preventing cross-origin redirects
  • Preventing credentials from being forwarded after redirects
  • Requiring user confirmation for previously unapproved destinations
  • Restricting how the selected credential is inserted into the request

An attacker who can influence Agent instructions could select a valuable key and supply an attacker-controlled URL. If the MCP implementation injects the selected key into that request as documented, the remote endpoint may receive the credential. The same unrestricted proxy could potentially be used for server-side request forgery against services reachable from the user's device.

The implementation is absent from the audited project, so the presence or absence of undocumented runtime controls cannot be verified. The vulnerability is confirmed at the documented interface and security-design level.

Attack Path

  1. The user configures a valuable API credential in an environment variable.
  2. Malicious prompt content, indirect prompt injection, or ...[truncated 1199 chars]
Remediation
View remediation

Remediation Suggestions

  • Bind every credential to an explicit set of approved schemes, hosts, ports, and path prefixes.
  • Replace arbitrary URLs with fixed provider adapters or predefined endpoint identifiers.
  • Enforce HTTPS and strict certificate validation for all credential-bearing requests.
  • Reject loopback, link-local, private, multicast, and reserved destination addresses after DNS resolution.
  • Revalidate destinations after every DNS lookup and redirect to mitigate DNS rebinding.
  • Disable redirects for authenticated requests or strip credentials before any redirect is followed.
  • Require explicit user approval when adding or changing a credential's permitted origin.
  • Restrict each key to the minimum required HTTP methods and request fields.
  • Add an audit log that records the key identifier, approved destination, method, time, and result without recording secret values.
  • Add automated tests proving that credentials cannot be sent to unapproved origins.
  • Fail closed when destination validation or origin binding cannot be completed.

other

Warning
Location
SKILL.md:36
Finding

Absolute Claims Misrepresent the Credential Trust Boundary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36, 180, and 260
Vulnerability Type: Misleading security guarantee
Risk Level: Medium

Vulnerable Documentation

The documentation repeatedly claims, in substance, that the key value never leaves the user's device. It also states that the local proxy injects the key into an outbound API request and returns only the API response to the Agent.

Technical Analysis

The claim that a credential “never leaves the user's device” is incompatible with the documented proxy behavior. An API credential inserted into an outbound HTTP authorization request necessarily leaves the device and is disclosed to the destination service unless a separate challenge-response or token-exchange protocol is used. No such protocol is documented.

A more accurate guarantee would be that the raw credential is not exposed to the LLM or included in the Agent-visible tool response, while still being transmitted locally by the MCP component to a specifically approved API provider.

The unrestricted url parameter further weakens the stated guarantee because the documented interface does not limit transmission to the legitimate issuer of the selected credential. Moreover, the actual MCP implementation is absent, so masking, request handling, response filtering, and file-writing protections cannot be independently verified.

Attack Path

  1. A user relies on the absolute claim that credentials never leave the device.
  2. The user grants the externally obtained MCP component access to sensitive environment variables or files.
  3. The user or Agent invokes the documented API proxy.
  4. The proxy transmits credential-bearing request data to the configured remote destination.
  5. If the destination is incorrect, compromised, redirected, or attacker-controlled, the credential may be disclosed outside the intended trust boundary.

Impact Assessment

The misleading guarantee can cause users ...[truncated 503 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace absolute claims with a precise statement that credentials are hidden from the LLM but transmitted by the local MCP service to explicitly approved API origins.
  • Document all trust boundaries, including the Agent, MCP process, local environment, network path, API provider, redirect targets, and response channel.
  • Clearly disclose which request fields may contain credential material.
  • State that remote API providers necessarily receive authentication information.
  • Include the complete MCP implementation in the audited package.
  • Add tests demonstrating masking of Agent-visible output and enforcement of destination restrictions.
  • Document residual risks involving compromised providers, TLS interception, redirects, local process compromise, and malicious Agent instructions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

An overly broad, unrelated trigger condition can cause the agent to invoke this skill in contexts where secret-handling or exec-capable tooling is unnecessary. In a skill with read, write, and exec access, inappropriate invocation increases the chance of unintended file modification, command execution, or exposure of sensitive local data.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
git clone https://example.com/key-vault-manager.git
# ...
# 示例
cp .env.example .env
# ...
# 在Agent中注册MCP工具
/mcp add key-vault-manager node /path/to/key-vault-manager/key-vault-manager.js

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md
git clone https://example.com/key-vault-manager.git
# ...
# 示例
cp .env.example .env
# ...
# 在Agent中注册MCP工具
/mcp add key-vault-manager node /path/to/key-vault-manager/key-vault-manager.js

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill’s display name, summary, and all user-facing instructions are presented only in Chinese, with no indication that the user can choose another language. This is a natural-language locale constraint that is not documented as region-specific or offered as an opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The document presents the skill as a focused local key-vault and proxy, but the capability description expands into generic create/query/modify/delete, import/reset, and export/save/convert operations. This scope creep weakens least-privilege expectations and can cause an agent or user to authorize broader file/config manipulation than intended for a secret-handling tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill advertises write-back functionality that modifies files on disk, but it does not prominently warn the user that local files may be changed as part of operation. For a secret-management tool, silent or under-emphasized write behavior is risky because it can overwrite scripts or reinsert live credentials into files without clear consent boundaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

text
调用: read_file_masked({ file_path: "（请参考skill目录中的脚本文件）" })
返回: {
  content: "curl -H 'Authorization: Bearer {{OPENAI_API_KEY}}' https://api.openai.com/v1/chat/completions"
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

text
调用: read_file_masked({ file_path: "（请参考skill目录中的脚本文件）" })
返回: {
  content: "curl -H 'Authorization: Bearer {{OPENAI_API_KEY}}' https://api.openai.com/v1/chat/completions"
}

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill claims strict local-only secret handling, but later documents automatic execution of ping and retry behavior during failures. That introduces undocumented command execution and network activity beyond the narrowly described key-protection function, which can mislead users about the skill’s actual behavior and trust boundary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

L101-L103 将技能触发条件写成“需要项目管理、任务规划、进度跟踪、团队协作时使用”，这与全文关于密钥验证、脱敏读取和本地 API 代理的定位完全不符。虽然这更像文档误配，但它确实宣示了一个与技能上下文不相称的用途范围。

Content

No source excerpt is available for this finding.