ClawHub
Back to skill

Security audit

智谱调用MCP，需要开通coding plan

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to provide the advertised Zhipu AI tools, but it runs unpinned npm/MCP packages with a local API key and inherited environment, which needs review before installation.

Review before installing. Use only a least-privilege Zhipu API key, avoid sending confidential screenshots, proprietary code, customer data, or internal URLs, and prefer a version-pinned release that does not pass the full parent environment to runtime npm tools.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
mcporter.json:4
Finding

Unpinned MCP server package is downloaded and executed through npx

Content
View full analysis

Vulnerability Details

File Location: mcporter.json, lines 4-10
Vulnerability Type: Unpinned runtime dependency execution
Risk Level: Medium

Vulnerable Code

json
"zai-mcp-server": {
  "type": "stdio",
  "command": "npx",
  "args": ["-y", "@z_ai/mcp-server"],
  "env": {
    "Z_AI_API_KEY": "$env:ZAI_MCP_API_KEY",
    "Z_AI_MODE": "ZHIPU"
  }
}

Technical Analysis

The configuration launches @z_ai/mcp-server through npx -y without specifying an exact version. No package lockfile or integrity hash is present in the audited project.

When the package is not already available in the applicable local cache or installation, npx can retrieve it from the configured package registry. Because no version is pinned, the code executed on future invocations can differ from the code that was previously reviewed. The -y option suppresses the installation confirmation, allowing the package to be retrieved and executed without an explicit user approval step.

The MCP server also receives the Zhipu API credential through Z_AI_API_KEY. Consequently, malicious code introduced through a compromised package release or dependency chain would execute with the invoking user's operating-system permissions and receive that credential.

Attack Path

  1. An attacker compromises the registry account, publication pipeline, or dependency chain associated with @z_ai/mcp-server.
  2. The attacker publishes a malicious package version under the same package name.
  3. A user invokes the zai-mcp-server integration.
  4. npx -y @z_ai/mcp-server resolves and, where necessary, downloads the unpinned package version.
  5. The malicious package executes with the user's privileges.
  6. It reads the supplied Z_AI_API_KEY environment variable and may access other resources available to the user.
  7. The credential or accessible local data can then be transmitted to an attacker-controlled destination.

Imp

...[truncated 590 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin @z_ai/mcp-server to an exact, reviewed version rather than relying on the registry's current version.
  2. Install dependencies during a controlled deployment step instead of downloading them when the Skill is invoked.
  3. Add and enforce a package lockfile containing registry-resolved integrity hashes.
  4. Use deterministic installation commands such as npm ci in the build or installation process.
  5. Invoke the installed package from a fixed local path rather than using runtime npx -y resolution.
  6. Review package provenance, publisher identity, release signatures, and transitive dependencies before upgrades.
  7. Run the MCP server in a restricted environment with only the required API credential and minimal filesystem and network access.
  8. Rotate the Zhipu API key if an untrusted or compromised package version may already have been executed.

T08 · Insecure Dependencies

Warning
Location
scripts/zai-mcp.js:37
Finding

Unpinned mcporter package executes with the complete inherited environment

Content
View full analysis

Vulnerability Details

File Location: scripts/zai-mcp.js, lines 37-48
Vulnerability Type: Unpinned runtime dependency execution with excessive environment exposure
Risk Level: Medium

Vulnerable Code

js
process.env.ZAI_MCP_API_KEY = apiKey;

const args = process.argv.slice(2);
try {
  const result = execFileSync("npx", ["--prefix", SKILL_DIR, "mcporter", "--config", MCP_CONFIG, ...args], {
    env: process.env,
    stdio: "inherit",
    maxBuffer: 10 * 1024 * 1024,
  });
} catch (e) {
  process.exit(e.status || 1);
}

Technical Analysis

The wrapper invokes the mcporter package through npx without an exact version. The audited project contains no package manifest or lockfile that fixes the package to a reviewed release and verifies its integrity. Therefore, npx may resolve and download a package version whose contents can change after this Skill has been audited.

The child process receives env: process.env. Immediately before execution, the wrapper places the Zhipu API key in that environment as ZAI_MCP_API_KEY. Passing the entire inherited environment also exposes any unrelated environment variables present in the parent process to the unpinned package.

execFileSync avoids shell interpretation of the argument array, so no shell-command injection was identified here. The risk instead arises from trusting mutable third-party package code and executing it with credentials and the user's existing privileges.

Attack Path

  1. An attacker compromises the package registry entry, publisher account, build pipeline, or dependency tree for mcporter.
  2. A malicious version is made available under the expected package name.
  3. A user runs scripts/zai-mcp.js.
  4. The wrapper reads the Zhipu API key from the OpenClaw authentication profile and stores it in process.env.ZAI_MCP_API_KEY.
  5. npx resolves and, where necessary, downloads the unpinned mcporter package.

...[truncated 1023 chars]

Remediation
View remediation

Remediation Suggestions

  1. Declare mcporter as an exact-version project dependency and commit a lockfile with integrity hashes.
  2. Install dependencies through a controlled, reproducible process such as npm ci.
  3. Invoke the verified local executable directly, for example through the project's node_modules/.bin directory, rather than resolving it through runtime npx.
  4. Do not pass process.env wholesale. Construct a minimal environment containing only required variables, such as:
    js
    const childEnv = {
  PATH: process.env.PATH,
  HOME: process.env.HOME,
  ZAI_MCP_API_KEY: apiKey,
};
  5. Where practical, supply credentials only to the specific subprocess that requires them and prevent intermediary tooling from receiving them.
  6. Restrict the subprocess with filesystem, process, and network sandboxing appropriate to the deployment platform.
  7. Audit package provenance and transitive dependencies before each deliberate upgrade.
  8. Rotate all potentially exposed credentials if an untrusted package version may have run through this wrapper.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents reading an API key from a local auth file and using network-capable commands, but it does not declare a restrictive tool scope such as permissions or allowed-tools. In an agent environment, missing scope boundaries can let the skill be invoked with broader filesystem/environment access than users expect, increasing the chance of credential access or unintended external actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest-style read_when list includes generic terms such as "截图", "画图", "生图", "视频生成", and "代码搜索" without contextual constraints or exclusion conditions. These broad triggers can overlap with ordinary requests and may cause unintended invocation of this skill outside a clearly defined Zhipu/MCP context.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
72% confidence
Finding

The metadata indicates execution via npx without a clearly pinned package/version for the referenced MCP components, which creates supply-chain risk if a dependency is updated or replaced upstream. In agent skills, unpinned remote package resolution can lead to execution of unexpected code under the user's context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill extensively documents sending images, videos, URLs, web content, and repository queries to external services, but it does not give clear user-facing privacy warnings or data-handling guidance. In this context, users may unknowingly transmit sensitive screenshots, proprietary code, internal URLs, or documents to third-party endpoints.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This example performs an authenticated external HTTP request to a third-party image generation API using a locally retrieved bearer token. While expected for the feature, it is security-relevant because prompts and account-linked credentials are sent off-host, and the skill does not pair this with strong disclosure or minimization guidance.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

bash
API_KEY=$(jq -r '.profiles."zai:default".key' ~/.openclaw/agents/main/agent/auth-profiles.json)
curl -s https://open.bigmodel.cn/api/paas/v4/images/generations \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "cogview-3-plus", "prompt": "一只在草地上晒太阳的小猫，水彩画风格"}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This example sends user-supplied prompt content to an external video generation endpoint with bearer-token authentication. The risk is contextual rather than covert: users may expose sensitive text or metadata to a third party without realizing the transmission implications.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md
API_KEY=$(jq -r '.profiles."zai:default".key' ~/.openclaw/agents/main/agent/auth-profiles.json)

# 文本生成视频
curl -s https://open.bigmodel.cn/api/paas/v4/videos/generations \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This example can transmit an image URL or base64 image plus prompt to an external video-generation API, which is more sensitive because images may contain screenshots, personal data, or proprietary material. The skill context makes this more dangerous because visual inputs are a primary feature and are likely to include user-captured local artifacts.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

md
# 返回 {"id": "...", "task_status": "PROCESSING"}

# 图像生成视频（image_url + prompt 至少传一个）
curl -s https://open.bigmodel.cn/api/paas/v4/videos/generations \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The one-click script automates submission, polling, and download for a third-party video service, making repeated external transmission and retrieval easy with minimal user friction. Automation increases the likelihood of accidental sharing or large-scale use of sensitive prompts and generated assets without adequate review.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

md
OUT="/root/.openclaw/workspace/downloads/video.mp4"

# 提交任务
TASK_ID=$(curl -s https://open.bigmodel.cn/api/paas/v4/videos/generations \
  -H "Authorization: Bearer $API_KEY" -H "Content-Type: application/json" \
  -d "{\"model\":\"$MODEL\",\"prompt\":\"$PROMPT\",\"size\":\"$SIZE\"}" | jq -r '.id')
echo "Task: $TASK_ID"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The wrapper forwards arbitrary user-supplied arguments directly into mcporter via npx, which makes the script a generic command surface rather than a narrowly constrained interface to the declared AI tools. In the context of an agent skill, this expands capability beyond the stated purpose and can let a caller invoke unintended subcommands, configurations, or behaviors exposed by mcporter/the local package set while also inheriting the loaded API key in the environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script reads a Zhipu API key from ~/.openclaw/.../auth-profiles.json and injects it into the child process environment, even though this credential-harvesting behavior is not evident from the skill description. Secret loading from an external auth store increases the blast radius of the wrapper and can expose credentials to unintended commands or logs if the invoked tooling is misused.

Content

No source excerpt is available for this finding.