ClawHub
Back to skill

Security audit

OpenUI Workspace Delivery

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent, but it asks users to run mutable external code and place a Gemini key in local MCP configuration, so it should be reviewed before use.

Install only after reviewing or pinning the external OpenUI MCP Studio repository and its dependencies. Use a dedicated, restricted Gemini API key, avoid committing host config files, prefer a secret store or inherited environment variable where supported, and run the MCP server with only the workspace access needed for the UI task.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning
Location
references/INSTALL.md:7
Finding

Unpinned Remote Repository Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: references/INSTALL.md:7-14
Supporting Locations: commands/openui-install.md:6-8, references/TROUBLESHOOTING.md:5-10
Vulnerability Type: Mutable remote payload retrieval followed by npm lifecycle and build-script execution
Risk Level: Medium

Vulnerable Code

markdown
1. Clone the public repository:

```bash
git clone https://github.com/xiaojiou176-open/openui-mcp-studio.git
cd openui-mcp-studio
npm install
npm run build
text

### Technical Analysis

The installation procedure clones the current default branch of an external GitHub repository without selecting an immutable commit or verified release. It then executes `npm install` and `npm run build`.

Because no commit hash, signed tag, checksum, or dependency integrity data is specified by this skill packet, the executable content can change after the packet has been reviewed. `npm install` may execute package lifecycle scripts, while `npm run build` explicitly runs repository-controlled code. The generated JavaScript is subsequently configured as a local MCP server.

The external repository and its dependency graph were not included in the audited artifact. Therefore, this finding does not establish that the current remote code is malicious; it establishes that the instructions create an unpinned remote-code execution channel whose future payload cannot be determined from the reviewed files.

### Attack Path

1. An attacker compromises the external repository, its maintainer account, or one of its npm dependencies.
2. The attacker introduces malicious installation, lifecycle, or build code into the mutable version fetched by the documented command.
3. An operator follows the skill and clones the repository without pinning a reviewed commit.
4. `npm install` or `npm run build` executes the attacker-controlled code with the operator's privileges.
5. The resulting build output is registered as an MCP server and may continue to run wheneve
...[truncated 975 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin installation to a reviewed, immutable Git commit rather than the repository's current default branch:
bash
git clone https://github.com/xiaojiou176-open/openui-mcp-studio.git
cd openui-mcp-studio
git checkout --detach REVIEWED_COMMIT_SHA
  1. Publish a signed release and verify its signature or checksum before executing any repository code.
  2. Include and review a dependency lockfile, then use npm ci instead of npm install.
  3. Review all npm lifecycle scripts and initially install with npm ci --ignore-scripts where project requirements permit.
  4. Run installation and build steps in a restricted container or sandbox without unrelated credentials or sensitive workspace access.
  5. Inspect and verify the generated MCP entry point before registering it with a host.
  6. Document the server's minimum filesystem and network permissions.
  7. Require explicit operator approval before updating the pinned commit or dependency lockfile.

T09 · Insecure Skill Coding Practices

Warning
Location
references/INSTALL.md:20
Finding

Gemini API Key Stored in Plaintext Host Configuration

Content
View full analysis

Vulnerability Details

File Location: references/INSTALL.md:20-22
Supporting Locations: references/OPENCLAW_MCP_CONFIG.json:9-11, references/OPENHANDS_MCP_CONFIG.json:8-10, references/TROUBLESHOOTING.md:12-15
Vulnerability Type: Plaintext secret storage in persistent configuration
Risk Level: Medium

Vulnerable Code

Installation instructions:

markdown
3. Replace the placeholder server path in the host config snippets with the real
   local checkout path, and replace `GEMINI_API_KEY` with a real local secret
   before attach.

OpenClaw configuration:

json
"env": {
  "GEMINI_API_KEY": "your_key"
}

OpenHands configuration:

json
"env": {
  "GEMINI_API_KEY": "your_key"
}

Technical Analysis

The distributed examples contain only a placeholder and do not expose a real credential. However, the installation guide explicitly instructs operators to replace that placeholder with a real API key in the host configuration.

This causes the secret to be stored as plaintext in a persistent JSON file. Such a file may be accidentally committed to source control, copied into backups, shared during troubleshooting, included in diagnostic archives, or read by other local users and processes with access to the configuration.

The configured key is also passed directly into the externally built MCP server's environment. This increases the impact of the remote supply-chain risk because any compromised server implementation can read the key from its process environment.

Attack Path

  1. An operator copies one of the supplied MCP configuration examples.
  2. Following the installation instructions, the operator replaces "your_key" with a real Gemini API key.
  3. The configuration is saved as a persistent plaintext file.
  4. The file is committed, backed up, shared, included in diagnostics, or read by another local process.
  5. An unauthorized party extracts the key and submits Gemini API requests under the operator's accoun ...[truncated 856 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not instruct operators to place a real secret directly in copied JSON configuration.
  2. Use the host platform's supported secret store or OS credential manager.
  3. Where supported, reference an inherited environment variable without embedding its value in the configuration.
  4. Store secrets in a dedicated local environment file only when necessary, restrict permissions to the owning user, and ensure the file is excluded from source control.
  5. Add relevant configuration and secret-file paths to .gitignore.
  6. Use a dedicated, least-privileged API key for this MCP server.
  7. Restrict the key by API, project, quota, and other controls supported by the provider.
  8. Document credential rotation and immediate revocation procedures.
  9. Avoid passing the key to MCP tools or subprocesses that do not require it.
  10. Add startup validation that checks for the presence of the credential without printing or logging its value.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger "UI shipping" is a broad natural-language phrase that could be used in many general product or design discussions, making unintended activation more likely. The file does not provide narrowing constraints or negative examples to clarify when this trigger should and should not invoke the skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.