Mcp Client

• Outcome: Review
• Latest audit: May 28, 2026 · 11:22 AM UTC
• Version: 0.1.1

Overview

The skill is a plausible MCP client, but it ships with a hardcoded GitHub token and its advertised approval controls do not actually block sensitive actions.

Do not install this version without review. Revoke and remove the embedded GitHub token, use your own least-privilege credentials from environment variables or a secret manager, restrict filesystem roots, avoid the default CLI approval-bypass path, and verify unapproved tool/resource access is actually blocked before connecting sensitive MCP servers.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The README makes a security claim that all tool calls require user approval by default, but the documented usage and approval flow are inconsistent enough to mislead integrators about when remote actions will execute. In an MCP client context, this matters because tools can perform file access or other external actions, so inaccurate documentation can cause developers to deploy the client with weaker approval gates than they expect.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The code presents tool/resource access as approval-gated, but in both callTool and readResource it only logs a warning and then proceeds with the remote action anyway. This defeats the intended security boundary and can lead to unauthorized tool execution or data access even when approval is supposedly required.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This config grants GitHub API access in addition to local filesystem access, but the surrounding descriptions do not justify that broader capability. In an agent skill, unnecessary external-service access expands the attack surface and can enable repository reads, writes, or data exfiltration if the skill or agent is abused.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: A live GitHub token appears to be hardcoded directly in the configuration while the description claims a token still needs to be configured. Hardcoded credentials are highly dangerous because anyone with access to this file can reuse the token to access GitHub resources, impersonate the owner within granted scopes, and potentially pivot into source code, secrets, or supply-chain compromise.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The CLI explicitly instantiates the skill with autoApprove enabled, requireApproval disabled, and a wildcard autoApprovePatterns of ['*'], which removes the core safeguard around MCP tool execution. Because this CLI can invoke filesystem and GitHub-backed tools, any user or upstream workflow using the CLI can perform sensitive operations without review, materially increasing the risk of unauthorized reads, writes, and external actions.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The code advertises approval-gated security controls for tool calls and resource reads, but in both callTool() and readResource() it only emits a warning when approval is required and then proceeds to invoke the underlying operation anyway. This creates a fail-open authorization bypass: sensitive tools/resources that should be blocked pending approval can still be executed/read, undermining the entire security model.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README encourages connecting to high-risk MCP servers such as filesystem, GitHub, PostgreSQL, and Slack without clearly warning that these integrations may read local files, access credentials, query databases, or send data to external services. In a skill designed to broker remote tool execution, missing trust-boundary and data-exposure warnings increases the chance of unsafe deployment and inadvertent data leakage.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: Tool arguments are sent directly to the connected MCP server, and results are handled without any user-facing disclosure that data is leaving the local trust boundary. In a skill context, tool arguments may contain prompts, secrets, file paths, or user data, so silent transmission to remote servers can cause unintended data exposure.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: Resource reads are performed against connected MCP servers without clearly warning the user that content is being fetched from a remote endpoint. In this context, resource URIs and returned content may reveal sensitive internal identifiers or bring untrusted remote content into downstream processing.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The CLI auto-approves every tool invocation without warning, creating an unsafe execution path that bypasses the 'secure' client approval model. In this context, broad MCP tool access can translate into unrestricted filesystem operations or external API actions, making accidental misuse or abuse much more likely.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

// 创建技能实例
const skill = new OpenClawMCPSkill({
  autoApprove: false,        // 是否需要用户批准
  requireApproval: true,     // 强制要求批准
  autoApprovePatterns: ['*:read_*'],  // 自动批准模式
  blockedPatterns: ['*:delete_*']     // 禁止模式

• Confidence: 92% confidence
• Finding: autoApprove

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

const skill = new OpenClawMCPSkill({
  autoApprove: false,        // 是否需要用户批准
  requireApproval: true,     // 强制要求批准
  autoApprovePatterns: ['*:read_*'],  // 自动批准模式
  blockedPatterns: ['*:delete_*']     // 禁止模式
});

• Confidence: 90% confidence
• Finding: autoApprove

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

// 基础客户端
const client = new MCPClient(new MCPClientConfig({
  name: 'my-client',
  autoApprove: true
}));

// 安全客户端（带审计和重试）

• Confidence: 97% confidence
• Finding: autoApprove

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

async function cli() {
  const args = process.argv.slice(2);
  const skill = new OpenClawMCPSkill({ 
    autoApprove: true,
    requireApproval: false,
    autoApprovePatterns: ['*']
  });

• Confidence: 98% confidence
• Finding: autoApprove

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

const skill = new OpenClawMCPSkill({ 
    autoApprove: true,
    requireApproval: false,
    autoApprovePatterns: ['*']
  });

  try {

• Confidence: 99% confidence
• Finding: autoApprove

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

const client = new SecureMCPClient(new MCPClientConfig({
    name: 'openclaw-github-test',
    version: '0.1.0',
    autoApprove: true // 测试模式
  }), {
    requireApproval: false,
    autoApprovePatterns: ['*']

• Confidence: 94% confidence
• Finding: autoApprove

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

autoApprove: true // 测试模式
  }), {
    requireApproval: false,
    autoApprovePatterns: ['*']
  });

  try {

• Confidence: 97% confidence
• Finding: autoApprove

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

Static analysis

No suspicious patterns detected.