ClawHub
Back to skill

Security audit

Mgc Database Security

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent documentation for local MGC credential and workflow management, but it needs Review because it normalizes agent-triggered sensitive operations and makes overstrong zero-exposure claims around credentials, scripts, and knowledge.

Install only if you intentionally use MGC Blackbox for local credential, script, workflow, and knowledge storage. Treat the MGC token and any retrieved credential content as secrets, require explicit per-operation approval, and do not rely on the documentation's broad 'zero exposure' language for knowledge or script internals.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The README states that credential-management functionality may be triggered by the 'user or agent' whenever there is a need to 'store or access credentials'. Even though the document claims authorization is required and plaintext is hidden, allowing the agent itself to decide when to initiate credential access materially expands the attack surface and can lead to unauthorized or socially engineered use of secrets-backed actions.

Content

Scanner excerpt · README.md (reported line 177)May include surrounding context.

md
| Document | When to use | Triggered by |
|----------|-------------|--------------|
| `credential_management.md` | Need to store or access credentials | user or agent |
| `script_management.md` | Need to store or run a script/workflow | user or agent |
| `collaboration_management.md` | Need to seal a workflow / skill package to another node | user or agent |
| `knowledge_management.md` | Need to store or read knowledge | user or agent |

Credential Access

High
Category
Privilege Escalation
Confidence
78% confidence
Finding

The phrase 'Need to store or access credentials' combined with 'Triggered by user or agent' normalizes agent-initiated credential handling, which is risky because it can encourage autonomous access attempts to sensitive secrets. Although the document states the AI never sees plaintext and authorization is required, the skill still presents credential access as a routine callable capability rather than a tightly constrained, user-initiated exception.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md
| Document | When to use | Triggered by |
|----------|-------------|--------------|
| `credential_management.md` | Need to store or access credentials | user or agent |
| `script_management.md` | Need to store or run a script/workflow | user or agent |
| `collaboration_management.md` | Need to seal a workflow / skill package to another node | user or agent |
| `knowledge_management.md` | Need to store or read knowledge | user or agent |

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

This section instructs how scripts should access stored credentials, which is sensitive in an agent skill because it normalizes secret retrieval by automation. In context, the danger is amplified by the surrounding misleading assurance that such access is 'zero exposure' even though the example returns decrypted content to the caller.

Content

Scanner excerpt · prompts/credential_management.md (reported line 64)May include surrounding context.

md
# How to Call Credentials with Zero Exposure (Core)

Scripts can safely access credentials, but AI can never see credential content.

Below is the **standard zero-exposure credential call pattern** (pseudocode):

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document repeatedly claims 'zero exposure' and that AI cannot see credential content, but the example get_credential() function reads a local token, calls a sensitive-get API, parses the returned secret, and returns the decrypted credential object to the caller. In an agent skill context, returning plaintext credentials to the calling code defeats the stated security boundary and can expose secrets to downstream model-visible logic or logging.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The code example beginning here operationalizes credential retrieval through a local API and token file, enabling an agent-integrated script to obtain decrypted secrets. In a skill environment, providing executable retrieval logic materially increases the chance that secrets are exposed to model-controlled code paths, logs, or prompt output.

Content

Scanner excerpt · prompts/credential_management.md (reported line 70)May include surrounding context.

Standard Example: Script Internally Accesses Credentials Safely

Scripts access credentials via MGC local API:

python
import requests

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · prompts/credential_management.md (reported line 173)May include surrounding context.

How to Authorize Credential Access (User Must Confirm)

When AI needs to access credentials, it must ask the user:

text
Credential Name: db_warehouse_prod

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · prompts/credential_management.md (reported line 202)May include surrounding context.

How to Authorize Credential Access (User Must Confirm)

When AI needs to access credentials, it must ask the user:

text
Credential Name: db_warehouse_prod

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · prompts/credential_management.md (reported line 210)May include surrounding context.

How to Authorize Credential Access (User Must Confirm)

When AI needs to access credentials, it must ask the user:

text
Credential Name: db_warehouse_prod

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · prompts/credential_management.md (reported line 177)May include surrounding context.

text
Credential Name: db_warehouse_prod
Operation: Access Credential
Authorization Required: YES

Do you authorize accessing this credential? Reply "yes" to proceed or "no" to cancel.

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill explicitly teaches scripts how to access stored credentials during execution. In an adversarial or overly permissive agent setting, this materially increases the chance of unauthorized secret retrieval and use, especially because the surrounding document frames the mechanism as routine and safe.

Content

Scanner excerpt · prompts/script_management.md (reported line 195)May include surrounding context.

md
# 5. How Scripts Zero-Exposure Call Credentials Internally

**MGC implementation**: Scripts are stored in MGC; at runtime MGC decrypts and executes the script locally. If the script needs to access credentials, it calls a local API to fetch them internally.

## Standard Example: Script Safely Accesses Credentials Internally

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

The example instructs reading a persistent access token from a fixed local filesystem path, creating a reusable bearer credential for further secret access. Exposing this pattern in a skill is dangerous because it provides a ready-made recipe for harvesting and using a sensitive local token if an agent follows the instructions.

Content

Scanner excerpt · prompts/script_management.md (reported line 202)May include surrounding context.

python
import os, requests, json

# Read MGC access token (fixed path, do not change)
with open(os.path.expanduser("~/.mgc/database/mgc_black_box/.mgc_token")) as f:
    MGC_TOKEN = f.read().strip()

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation table explicitly allows the skill documents to be triggered by the 'agent' under broad conditions like 'need to store or access credentials' or 'need to store or run a script/workflow'. This creates excessive agent autonomy around sensitive operations, increasing the chance that an LLM invokes privileged credential, execution, or sealing workflows without a narrowly scoped user request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The usage table allows prompt modules to be triggered by either the user or the agent with very broad conditions, which increases the chance that an autonomous agent invokes sensitive capabilities without a narrowly scoped user request. In a skill that manages credentials, scripts, and sealed packages, ambiguous activation criteria can lead to overreach or unintended sensitive operations even if later steps claim authorization is required.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · prompts/credential_management.md (reported line 94)May include surrounding context.

md
print("Token not found!")
        return None

    resp = requests.post(
        f"{BASE_URL}/api/mgc/sensitive/get",
        headers={"X-MGC-Token": token, "Content-Type": "application/json"},
        json={

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document makes a strong security claim that the AI cannot see plaintext knowledge, but later describes workflows where the AI reads and uses retrieved knowledge content after authorization. This inconsistency can mislead users into believing sensitive knowledge never reaches the model when, in practice, authorized retrieval appears to expose the content to the AI for processing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The security features section repeats that AI cannot see plaintext, yet the rest of the document instructs the AI to read and apply knowledge content in analysis after authorization. Such contradictory assurances create a documentation-driven security vulnerability by encouraging users to store sensitive material under false assumptions about model exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document claims that script content is never exposed to AI, yet later instructs use of mgc_save(..., content="<your script content>"), which would require plaintext script submission through the AI/tooling path. This contradiction can mislead users into disclosing proprietary code or embedded secrets under a false expectation of zero exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · prompts/script_management.md (reported line 63)May include surrounding context.

md
raw = query_data()
    cleaned = clean_data(raw)
    result = analyze_data(cleaned)
    # Write result to file or MGC; never return it
    with open("output/report.xlsx", "wb") as f:
        f.write(result)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guidance provides concrete instructions for reading a local token file and using it to retrieve credentials, but does not prominently warn that this token and returned secrets are highly sensitive. In a prompt/skill context, such examples normalize secret-access behavior and may induce an agent or user to handle credentials unsafely or expose them in logs, outputs, or follow-on prompts.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · prompts/script_management.md (reported line 208)May include surrounding context.

md
def get_credential(info_owner="db_warehouse_prod"):
    """Fetch credential from MGC"""
    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": MGC_TOKEN},
        json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · prompts/script_management.md (reported line 208)May include surrounding context.

md
def get_credential(info_owner="db_warehouse_prod"):
    """Fetch credential from MGC"""
    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": MGC_TOKEN},
        json={

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · prompts/script_management.md (reported line 208)May include surrounding context.

md
def get_credential(info_owner="db_warehouse_prod"):
    """Fetch credential from MGC"""
    resp = requests.post(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        headers={"X-MGC-Token": MGC_TOKEN},
        json={

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:31