ClawHub
Back to skill

Security audit

Mcp Client

Security checks for vulnerabilities and agentic risk

Overview

This MCP client has a coherent purpose, but it ships unsafe defaults and credential-handling issues that could let connected tools act without the user control the documentation promises.

Review carefully before installing. Do not use the packaged GitHub token; revoke it if you control it. Pin MCP server package versions, remove wildcard auto-approval, require approvals to fail closed, avoid passing the full environment to child MCP servers, and treat all connected MCP servers as privileged programs that can read files or act with configured account credentials.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)

T09 · Insecure Skill Coding Practices

Error
Location
src/mcp-config.json:24
Finding

Hardcoded GitHub Personal Access Token in Tracked Configuration

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
src/secure-client.js:211
Finding

Approval Controls Warn but Do Not Prevent Unapproved Tool and Resource Execution

Content
View full analysis
super.callTool(serverId, toolName, args, false), MCPErrorCode.TOOL_EXECUTION_FAILED, `工具执行失败：${toolName}` ); } ``` The equivalent base-client behavior is: ```javascript if (requireApproval && !this.approvedTools.has(toolKey) && !this.config.autoApprove) { console.warn(`[MCP] 工具调用需要批准：${toolName}`); } const result = await connection.client.callTool({ name: toolName, arguments: args }); ``` The CLI additionally disables approval globally: ```javascript const skill = new OpenClawMCPSkill({ autoApprove: true, requireApproval: false, autoApprovePatterns: ['*'] }); ``` ### Technical Analysis `shouldRequireApproval()` returns `true` when authorization has not been granted. `SecureMCPClient.callTool()` responds only by writing a warning and then deliberately calls the base implementation with `requireApproval` set to `false`. Consequently, an unapproved call proceeds immediately. `readResource()` follows the same fail-open pattern: a required approval produces a warning, followed by `super.readResource(..., false)`. The base client is also independently vulnerable because its approval branch only logs a warning before invoking the MCP server. There is no callback, interactive confirmation, approval token, pending-r ...[truncated 1884 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
src/client.js:75
Finding

All Parent-Process Environment Variables Are Exposed to Spawned MCP Servers

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
src/mcp-config.json:5
Finding

Runtime Execution of Unversioned Packages Through npx

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
src/client.js:83
Finding

Arbitrary SSE Destinations Permit Internal-Network Requests and Insecure HTTP Transport

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
src/mcp-skill.js:182
Finding

Sensitive-Path Protection Is Not Applied to Filesystem Tool Calls

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
src/client.js:190
Finding

Tool Arguments and Resource Contents Are Exposed Through Logging and Events

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (69)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 96)May include surrounding context.

批准流程

javascript
// 首次调用需要批准
await client.callTool('filesystem', 'read_file', { path: './secret.txt' });
// ⚠️ 警告：工具调用需要批准

// 批准后无需重复确认

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

This example shows persistent approval of the read_file tool followed by direct access to secret.txt, effectively demonstrating how sensitive file reads can proceed without repeated user confirmation. In an MCP client connected to local filesystem servers, broad durable approval materially increases the chance of credential or secret exfiltration if the client or server is misused.

Content

Scanner excerpt · README.md (reported line 101)May include surrounding context.

// 批准后无需重复确认 client.approveTool('filesystem', 'read_file'); await client.callTool('filesystem', 'read_file', { path: './secret.txt' }); // ✅ 工具已批准，直接执行

text

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
import { OpenClawMCPSkill } from './src/mcp-skill.js';

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md
import { MCPClient, MCPServerConfig, MCPClientConfig } from './src/client.js';

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
import { SecureMCPClient } from './src/secure-client.js';

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High
Category
Supply Chain
Confidence
90% confidence
Finding

fast-uri 3.1.0 has multiple URI parsing and canonicalization advisories, including host confusion and possible SSRF-relevant edge cases. Since it is used by ajv in the dependency tree, exploitation depends on whether untrusted schemas, URIs, or references are processed, but the underlying dependency issue is real and potentially serious in systems that validate attacker-supplied structured data.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.8 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High
Category
Supply Chain
Confidence
95% confidence
Finding

hono 4.12.8 is listed with numerous advisories spanning cookie handling, routing, and path-processing behavior. Because Hono is a core web framework in the transitive stack, these issues can materially affect request handling and security boundaries if the skill uses the SDK's HTTP/server features, making this more dangerous than a rarely used utility package.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High
Category
Supply Chain
Confidence
84% confidence
Finding

ip-address 10.1.0 carries advisories for parsing ambiguity and HTML-emitting XSS behavior. This is a real dependency concern, but impact in this skill is context-dependent: it becomes significant if user-supplied IP literals are parsed for allowlists/SSRF protection or if any HTML output from the library is rendered.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High
Category
Supply Chain
Confidence
91% confidence
Finding

path-to-regexp 8.3.0 has reported ReDoS/DoS issues tied to complex route patterns. As a router dependency, this is a legitimate risk if request paths can trigger expensive pattern evaluation, especially in services exposed over HTTP where attackers can send repeated crafted requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The CLI instantiates the skill with autoApprove enabled, requireApproval disabled, and autoApprovePatterns set to '*', which effectively authorizes every tool invocation without user review. In a skill that can connect to filesystem and GitHub MCP servers, this removes the primary safeguard against destructive or sensitive actions and contradicts the apparent security model implied elsewhere in the code.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

At CLI startup, approval safeguards are silently disabled with no explicit warning or consent from the user. Because the CLI exposes generic tool execution and shortcuts for filesystem and GitHub operations, users may unknowingly run a mode that permits immediate execution of sensitive actions, increasing the chance of accidental data modification, deletion, or remote side effects.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code presents approval as a security control, but in both callTool and readResource it only emits a warning when approval is required and then still executes the operation by calling the parent method. This creates a fail-open authorization bypass: sensitive tool invocations and resource reads can proceed without any actual user confirmation despite comments and API semantics implying enforcement.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test/security.test.js (reported line 126)May include surrounding context.

js
assertTrue(canAccess);
});

test('敏感路径检测 - .env 文件', () => {
  const security = new MCPSecurityController();
  const isSensitive = security.isSensitivePath('/app/.env');
  assertTrue(isSensitive);

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test/security.test.js (reported line 128)May include surrounding context.

js
test('敏感路径检测 - .env 文件', () => {
  const security = new MCPSecurityController();
  const isSensitive = security.isSensitivePath('/app/.env');
  assertTrue(isSensitive);
});

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

md
test('敏感路径检测 - passwd', () => {
  const security = new MCPSecurityController();
  const isSensitive = security.isSensitivePath('/etc/passwd');
  assertTrue(isSensitive);
});

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test/security.test.js (reported line 140)May include surrounding context.

js
test('敏感路径检测 - passwd', () => {
  const security = new MCPSecurityController();
  const isSensitive = security.isSensitivePath('/etc/passwd');
  assertTrue(isSensitive);
});

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test/security.test.js (reported line 148)May include surrounding context.

js
test('敏感路径检测 - passwd', () => {
  const security = new MCPSecurityController();
  const isSensitive = security.isSensitivePath('/etc/passwd');
  assertTrue(isSensitive);
});

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire skill description, usage guidance, and safety notes are written in Chinese, and the document does not state that the skill is region-specific or provide an opt-in language/locale choice. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The README markets default user approval as a safety property but also documents an auto-approval mode that removes that protection. In an MCP client, approval bypass weakens the trust boundary around remote tool execution and can normalize unsafe configuration, increasing the chance of unintended file access or side-effecting actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The README instructs users to launch an MCP server with npx and no pinned version, which causes retrieval and execution of the latest package at runtime. In an MCP client context, that creates a supply-chain risk because a compromised upstream release or typosquatted package could immediately gain local code execution and access to files or credentials exposed through the server.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

This example executes the unpinned GitHub MCP server via npx, implicitly trusting whatever package version is current at invocation time. Because such a server may handle repository data and authentication tokens, an upstream compromise could lead to credential theft or unauthorized API actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The PostgreSQL server example also relies on unpinned remote package execution, which is especially risky because it is paired with direct database connectivity. A malicious or compromised package could exfiltrate connection strings, query data, or modify databases when users follow the documented command.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents the skill description in Chinese, and the rest of the document continues in that locale without any opt-in or alternative language. The policy requires flagging language or locale constraints when the skill forces a specific language without user choice or clear justification.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The documented autoApprovePatterns setting (':read_') authorizes a broad class of read operations without user confirmation. In an MCP context, seemingly read-only tools can expose sensitive local files, repository secrets, tokens, or private remote resources, so wildcard-based automatic approval reduces an important trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
const skill = new OpenClawMCPSkill({
  autoApprove: false,        // 是否需要用户批准
  requireApproval: true,     // 强制要求批准
  autoApprovePatterns: ['*:read_*'],  // 自动批准模式
  blockedPatterns: ['*:delete_*']     // 禁止模式
});

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
92% confidence
Finding

This example initializes the base MCP client with autoApprove: true, which can permit tool execution and resource access without human confirmation. Because this skill is specifically designed to connect to external MCP servers over stdio/SSE and invoke tools/resources/prompts, automatic approval substantially increases the risk of unauthorized file access, data exfiltration, or destructive operations if a server is malicious, misconfigured, or overly privileged.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md
// 基础客户端
const client = new MCPClient(new MCPClientConfig({
  name: 'my-client',
  autoApprove: true
}));

// 安全客户端（带审计和重试）

Static analysis

No suspicious patterns detected.