T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:31
- Finding
- Overprivileged Third-Party MCP Integration Exposes Messaging and Financial Capabilities## Vulnerability Details **File Location**: `SKILL.md:31-91` **Vulnerability Type**: Excessive delegation of authenticated capabilities to a remote MCP service **Risk Level**: Medium ### Vulnerable Configuration ```json { "mcpServers": { "moltbotden": { "url": "https://api.moltbotden.com/mcp", "headers": { "Authorization": "Bearer YOUR_API_KEY" } } } } ``` ```json { "mcpServers": { "moltbotden": { "transport": "http", "url": "https://api.moltbotden.com/mcp", "headers": { "X-API-Key": "YOUR_API_KEY" } } } } ``` The authenticated integration advertises the following consequential operations: ```text - Send and receive DMs - Send A2A messages - Create checkout sessions - Create payment mandates - Check mandate status - List active mandates ``` ### Technical Analysis The Skill directs users to provide an API key to a third-party remote MCP endpoint and exposes a broad collection of authenticated tools through that connection. These tools include external communications, commerce checkout creation, and payment-mandate management. The configuration does not define a tool allowlist, credential scope, transaction limit, mandatory user-confirmation policy, or restrictions separating read-only operations from consequential write operations. MCP tool definitions and behavior are supplied by the remote endpoint, so the effective capability surface can also change independently of the reviewed local file. This breaks least-privilege principles because clients following the documented configuration may grant access to all authenticated tools even when a user only needs a narrow function such as discovery or marketplace search. The reviewed file does not itself execute payments or contain an explicitly malicious payload; exploitation requires the remote service, a compromised endpoint, or unsafe agent beh ...[truncated 1315 chars]
- Remediation
- ## Remediation Suggestions 1. Provide separate, narrowly scoped API keys for read-only discovery, social messaging, commerce, and payment operations. 2. Configure an explicit tool allowlist and disable all tools not required for the intended workflow. 3. Require an unambiguous human confirmation immediately before sending messages, creating checkout sessions, or creating payment mandates. 4. Enforce server-side transaction limits, recipient restrictions, expiration periods, and idempotency controls for financial operations. 5. Use short-lived, revocable credentials and document a key-rotation and incident-revocation process. 6. Prevent API keys from being logged, displayed in prompts, committed to source control, or exposed to unrelated tools. 7. Document what data is transmitted to the remote endpoint, how it is retained, and which operations produce external side effects. 8. Validate and monitor remote tool schemas. Alert users when tool names, descriptions, parameters, or permission requirements change. 9. Recommend testing the integration with a non-production account and without payment privileges before enabling consequential tools.