ClawHub
Back to skill

Security audit

全球法规MCP连接器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local read-only MCP search connector for bundled regulatory Markdown files, with no artifact-backed evidence of hidden network, credential, write, or destructive behavior.

This appears acceptable to install if you want a local regulatory-reference MCP tool. Use a virtual environment, review the bundled references for accuracy, and only set REG_HUB_REFS to a directory whose Markdown contents you are comfortable exposing to your MCP client. Treat its regulatory and product-classification answers as reference material and verify important decisions against current official sources.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill claims 'zero network' and 'read-only', but the documentation explicitly describes environment-variable input (`REG_HUB_REFS`), file reads from arbitrary local directories, and operation as an MCP server process. The static finding is justified because these capabilities are not formally declared, which can mislead users and hosts about the actual trust boundary; if the underlying code also permits network access via Python/runtime dependencies, the mismatch increases risk.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The script presents itself as enforcing an environment-variable whitelist, but it only searches for `os.environ.get(...)` string patterns and therefore misses other access forms such as `os.getenv`, `os.environ[...]`, imported aliases, or dynamic access. In a security self-check tool, overstating coverage can create false assurance and allow prohibited environment-variable use to go undetected.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The script concludes '本地只读、零凭据、无外发' as if proven, but its implementation is only a narrow regex heuristic over source lines. An adversarial or simply different coding style can evade these checks, so the script may certify unsafe code as safe, which is dangerous in this skill because it is explicitly marketed as a security self-check.

Static analysis

No suspicious patterns detected.