ClawHub
Back to skill

Security audit

Byted Bytehouse Mcp

Security checks for vulnerabilities and agentic risk

Overview

The skill is for ByteHouse database access, but it downloads changing remote code, gives that process the full local environment, and can run a background service.

Install only if you are comfortable running a ByteHouse MCP server fetched from the referenced GitHub repository at install/run time. Use a dedicated low-privilege, preferably read-only ByteHouse account, run it in a clean environment containing only required BYTEHOUSE_* variables, avoid privileged shells or CI environments with many secrets, and review the service scripts before using start/stop/restart. Treat generated schema/catalog/lineage files and logs as sensitive database metadata.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/mcp_client.py:59
Finding

Mutable Remote MCP Server Code Is Retrieved and Executed

Content
View full analysis
"$LOG_FILE" 2>&1 & ``` ### Technical Analysis The Skill instructs `uvx` to retrieve and execute the ByteHouse MCP server directly from the mutable Git branch `main`. No immutable commit hash, signed release, artifact digest, lockfile, or integrity verification is used. This means that the code executed by the Skill can change after the Skill itself has been reviewed. Any upstream compromise, malicious commit, account takeover, or unintended breaking change can alter the effective local payload without requiring a modification to this repository. The inline dependency declaration also uses `mcp>=1.0.0`, which does not establish a reproducible upper bound or hash-verified dependency set. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or the dependency publication process. 2. The attacker modifies the referenced `main` branch or a transitively resolved package. 3. A user follows the documented workflow or starts one of the included scripts. 4. `uvx` retrieves the current upstream source and executes `mcp_bytehouse`. ...[truncated 857 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/mcp_client.py:55
Finding

Downloaded MCP Process Inherits the Entire Parent Environment

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/stop_mcp_service.sh:30
Finding

Unvalidated PID File Can Cause Termination of Unrelated Processes

Content
View full analysis
/dev/null) if [ -z "$PID" ]; then echo "⚠️ PID file is empty" rm -f "$PID_FILE" exit 0 fi echo "Stopping MCP Server (PID: $PID)..." # Attempt graceful shutdown kill "$PID" 2>/dev/null # Wait for the process to exit for i in {1..10}; do if ! kill -0 "$PID" 2>/dev/null; then echo "MCP Server stopped" rm -f "$PID_FILE" exit 0 fi sleep 1 done # Force termination echo "Process did not respond; forcing termination..." kill -9 "$PID" 2>/dev/null sleep 1 if ! kill -0 "$PID" 2>/dev/null; then echo "MCP Server forcibly stopped" else echo "Unable to stop process (PID: $PID)" exit 1 fi rm -f "$PID_FILE" ``` ### Technical Analysis The stop script trusts the contents of `scripts/mcp_server.pid` without validating that the value is a positive numeric PID or confirming that the referenced process is the expected ByteHouse MCP server. A stale PID can be reused by an unrelated process after the original MCP process exits. When the stop script is later executed, it sends `SIGTERM` and potentially `SIGKILL` to that unrelated process. A manipulated value beginning with a minus sign may also be interpreted by `kill` as an option or process-group selector because the script does not use `kill -- "$PID"`. The PID file is stored inside the project directory rather than a protected runtime directory, increasing the chance that another actor with project write access can modify it. ### Attack Path 1. An attacker with write access to the project directory modifies `scripts/mcp_server.pid` to reference another process, or the genuine PID file becomes stale and its PID is reused. 2. A user invokes `stop_mcp_service.sh` or `restart_mcp_service.sh`. 3. The script reads the untrusted PID without format or owne ...[truncated 756 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · README.md (reported line 131)May include surrounding context.

md
async def main():
    # 设置环境变量（请自行配置）
    env = os.environ.copy()
    env.update({
        'BYTEHOUSE_HOST': '<ByteHouse-host>',
        'BYTEHOUSE_PORT': '<ByteHouse-port>',

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The documentation includes the ability to stop local MCP processes, manage them via PID files, and potentially force-terminate them, while the high-level description focuses on data querying and lineage analysis. Hidden or underemphasized process-killing capability is dangerous because an agent may disrupt unrelated workloads or cause denial of service on the host.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The documentation includes the ability to stop local MCP processes, manage them via PID files, and potentially force-terminate them, while the high-level description focuses on data querying and lineage analysis. Hidden or underemphasized process-killing capability is dangerous because an agent may disrupt unrelated workloads or cause denial of service on the host.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
95% confidence
Finding

Using os.environ.copy() passes the full parent environment into the spawned MCP server process, not just the ByteHouse credentials shown in the example. This can unintentionally expose unrelated secrets such as API keys, tokens, cloud credentials, or proxy settings to a third-party component fetched from a remote Git repository and executed locally.

Content

Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.

md
async def main():
    # 设置环境变量（请自行配置）
    env = os.environ.copy()
    env.update({
        'BYTEHOUSE_HOST': '<ByteHouse-host>',
        'BYTEHOUSE_PORT': '<ByteHouse-port>',

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
95% confidence
Finding

This second use of os.environ.copy() repeats the same secret-spillage risk in another example path. In this skill's context, the danger is amplified because the child process is launched from a remote Git-based package source, so inherited environment variables may be exposed to code outside the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 355)May include surrounding context.

md
async def main():
    # 设置环境变量（请自行配置）
    env = os.environ.copy()
    env.update({
        'BYTEHOUSE_HOST': '<ByteHouse-host>',
        'BYTEHOUSE_PORT': '<ByteHouse-port>',

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
95% confidence
Finding

The code copies the entire parent environment with os.environ.copy() and passes it to the spawned MCP server. In this skill, that is especially risky because the server binary/code is fetched from a remote GitHub source at runtime, so secrets such as API keys, tokens, proxy settings, and cloud credentials may be exposed to untrusted or unexpectedly changed code.

Content

Scanner excerpt · scripts/mcp_client.py (reported line 56)May include surrounding context.

python
"""连接到ByteHouse MCP Server"""
        
        # 从环境变量获取配置
        env = os.environ.copy()
        
        # MCP Server参数
        self.server_params = StdioServerParameters(

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
91% confidence
Finding

The script copies the entire process environment and passes it to a server process launched from a remote GitHub source via uvx. This can expose unrelated secrets in environment variables to the MCP server code and any of its dependencies, which is especially risky because the server package is fetched from @main rather than a pinned trusted version.

Content

Scanner excerpt · scripts/query_top10_tables_mcp.py (reported line 46)May include surrounding context.

python
print()
    
    # 从环境变量获取配置
    env = os.environ.copy()
    
    # MCP Server参数
    server_params = StdioServerParameters(

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
87% confidence
Finding

The script copies the entire parent process environment and passes it to a child process that is launched from a remote GitHub source via uvx. This can expose secrets such as API keys, tokens, database credentials, or proxy settings to the spawned MCP server code, which is especially concerning because the skill's purpose is to connect to a database and the server package is fetched from a mutable remote branch (@main).

Content

Scanner excerpt · scripts/test_list_tables.py (reported line 39)May include surrounding context.

python
print("=" * 80)
    
    # 从环境变量获取配置
    env = os.environ.copy()
    
    # MCP Server参数
    server_params = StdioServerParameters(

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
89% confidence
Finding

os.environ.copy() forwards the entire parent environment to the spawned MCP server process. In this skill context, that likely includes sensitive ByteHouse credentials and possibly unrelated tokens, so any remotely fetched server code or its dependencies can read, misuse, or exfiltrate secrets far beyond what is strictly needed for operation.

Content

Scanner excerpt · scripts/test_mcp_server.py (reported line 48)May include surrounding context.

python
print()
    
    # 从环境变量获取配置
    env = os.environ.copy()
    
    # MCP Server参数
    server_params = StdioServerParameters(

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly instructs users to generate and persist schema, catalog, and lineage JSON files derived from a live database, but it does not warn that these outputs may contain sensitive metadata such as table names, column names, business domains, and inferred relationships. In a data-warehouse context, this metadata can materially aid reconnaissance, expose regulated data structure, and lead to unintentional local retention or later exfiltration.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill documents code capabilities involving environment variables and MCP server interaction, but it does not declare an explicit tool scope such as permissions or allowed-tools. That makes the skill's operational boundary unclear and increases the chance of unintended access to local secrets or external services when invoked by an agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill can access a database and generate local output files containing schema, catalog, and lineage data, but the description does not clearly warn users that potentially sensitive metadata may be read and written to disk. In a data-platform context, schema and lineage information can reveal internal systems, table names, business domains, and other sensitive structure even when row data is not exposed.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are broad, including generic phrases like ByteHouse, MCP, query database, or look at tables. Overbroad triggers can cause the skill to activate in contexts where the user did not intend local service startup, database access, or metadata extraction, increasing the risk of accidental sensitive operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code file contains natural-language instructions and descriptions only in Chinese, including the module docstring and class/function descriptions. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy violation when no alternative or justification is provided.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The client starts an MCP server by invoking uvx --from git+https://github.com/volcengine/mcp-server@main..., which fetches and executes code from a remote repository at runtime. Because it tracks the mutable main branch and passes the full process environment into that server, any upstream compromise or unexpected update could execute attacker-controlled code locally and access credentials or data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script launches the MCP server by invoking uvx --from against a live GitHub URL on the main branch, which fetches and executes code at runtime without pinning to an immutable version or verifying integrity. This creates a supply-chain execution path where a compromised repository, force-push, dependency hijack, or MITM of the fetch path could lead to arbitrary code execution on the host running the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is described as locally starting a ByteHouse MCP server, but the implementation includes an undisclosed remote code retrieval-and-execution capability. That broader capability expands trust boundaries and means the host may execute unreviewed code from the network, which is especially risky in an agent skill that may run in privileged local environments with database credentials present in environment variables.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script uses uvx --from git+https://github.com/volcengine/mcp-server@main#subdirectory=... to fetch and execute MCP server code from a remote GitHub repository at runtime. Because it tracks the mutable main branch rather than a pinned commit or verified artifact, anyone who can modify that repository or its dependency chain could cause arbitrary code execution on the local machine with access to the caller's environment, including ByteHouse credentials.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language instructions, headings, and operational guidance are presented only in Chinese, which effectively forces a specific language on users. The file does not indicate that the skill is region-specific or provide an alternative language option, so it may violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest description is written entirely in Chinese and does not indicate that other languages are supported or that the user may choose their preferred language. This can constitute a language policy issue when a skill implicitly constrains interaction to a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file contains natural-language strings and comments entirely in Chinese, including the module docstring and runtime output. Under the policy rule, forcing a specific language without user opt-in or a documented region-specific justification is a locale-policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This shell script contains multiple user-facing comments and runtime messages in Chinese, which imposes a specific language on users without opt-in. The policy for natural-language violations applies to all file types, and there is no indication that this skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The comments and all user-facing status messages are in Chinese, including operational guidance and error output. This imposes a specific language on users without any opt-in or indication that the skill is intentionally limited to a Chinese-speaking environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This shell script includes natural-language comments and user-facing status messages only in Chinese, such as the stop banner and warning text. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This Python file contains natural-language strings and docstrings entirely in Chinese, including the script description and runtime status messages. That imposes a specific language on users without any visible opt-in or alternative, which matches the locale/language policy violation criterion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.