ClawHub
Back to skill

Security audit

Ainative Mcp Builder

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent MCP-building guide with disclosed AINative API examples, but users should handle API keys and remote memory storage carefully.

Install only if you intend to build AINative-backed MCP servers. Use environment variables or a secret manager for AINATIVE_API_KEY, avoid committing .claude/mcp.json or source files containing real keys, pin dependency versions for production use, and do not store confidential prompts, credentials, or private user data in remote memory unless that is deliberate and authorized.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Third-Party Dependencies Allow Unreviewed Package Code

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:24
Finding

Credential Examples Encourage API Keys to Be Stored in Source and Configuration Files

Content
View full analysis
dict: """Get the current user's credit balance.""" return requests.get( f"{BASE}/api/v1/public/credits/balance", headers={"X-API-Key": API_KEY} ).json() ``` The client configuration examples also show a credential placeholder directly in configuration: ```json { "mcpServers": { "my-tools": { "command": "python", "args": ["my_mcp_server.py"], "env": { "AINATIVE_API_KEY": "ak_your_key" } } } } ``` ```json { "mcpServers": { "my-tools": { "command": "npx", "args": ["my-mcp-package"], "env": { "AINATIVE_API_KEY": "ak_your_key" } } } } ``` ### Technical Analysis The values shown are placeholders and are not live credentials. However, the Python example encourages users to replace a source-code literal with a real API key. Source and MCP configuration files are commonly committed to repositories, included in published packages, copied into support requests, or exposed through backups. The Node.js implementation elsewhere in the document uses `process.env.AINATIVE_API_KEY`, which is safer at the application-source level, but the configuration examples still invite users to place the actual secret in a persistent JSON file. Environment-variable configuration does not adequately protect a secret if the value itself is committed in a tracked configuration file. The API key is intentionally transmitted in an `X-API-Key` header over HTTPS to the declared AINative API. No covert credential exfiltration was identified. The vulnerability is the risk of inadvertent secret disclosure through in ...[truncated 1251 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

MCP Config Access

High
Category
Agent Snooping
Confidence
95% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

Configure in Claude Code

json
// .claude/mcp.json
{
  "mcpServers": {
    "my-tools": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
@mcp.tool()
def search_memory(query: str, limit: int = 5) -> dict:
    """Search agent memory semantically."""
    return requests.post(
        f"{BASE}/api/v1/public/memory/v2/recall",
        headers={"X-API-Key": API_KEY},
        json={"query": query, "limit": limit}

External Transmission

Medium
Category
Data Exfiltration
Confidence
71% confidence
Finding

The store_memory example transmits arbitrary content to a remote memory service, which can encourage users to persist sensitive prompts, credentials, or personal data without any cautionary guidance. In an MCP context, agents may pass rich contextual data into tools, so a write-to-remote-memory example is more dangerous than a simple lookup because it can create durable exposure.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
@mcp.tool()
def store_memory(content: str, memory_type: str = "episodic") -> dict:
    """Store a fact or event in agent memory."""
    return requests.post(
        f"{BASE}/api/v1/public/memory/v2/remember",
        headers={"X-API-Key": API_KEY},
        json={"content": content, "memory_type": memory_type}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
server.setRequestHandler('tools/call', async (request) => {
  if (request.params.name === 'get_credits') {
    const resp = await fetch('https://api.ainative.studio/api/v1/public/credits/balance', {
      headers: { 'X-API-Key': process.env.AINATIVE_API_KEY! }
    });
    return { content: [{ type: 'text', text: JSON.stringify(await resp.json()) }] };

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The examples place a live API key directly into source/config snippets (API_KEY = "ak_your_key" and .claude/mcp.json env values) without warning about secret exposure. Users may copy this pattern into tracked files, shared repos, shell history, or screenshots, leading to credential leakage and unauthorized API use.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

Brief description and usage examples.

text

Place in `.claude/skills/my-tool-name/SKILL.md`.

## Publish to npm

Rp1

Low
Category
MCP Rug Pull
Confidence
60% confidence
Finding

pip install without ==version installs the latest release, which could include malicious changes.

Content

No source excerpt is available for this finding.