Security audit

xiaobai-print

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real printing integration, but it gives a local bridge and upload path broad authority over files, bearer tokens, and remote MCP tools without enough containment.

Review this before installing. Use only a dedicated low-privilege token, keep the bridge bound to 127.0.0.1, do not expose it on a network, and upload only files you explicitly intend to print. Treat generated skills as untrusted until reviewed, and prefer adding allowlists for tool names, upload paths, upload destinations, and bridge origins.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/bridge/http.ts:146
Finding: Unauthenticated bridge clients inherit the privileged upstream credential
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/core/upload-file.ts:39
Finding: Arbitrary local files can be uploaded to a destination controlled by the upstream service
Content: View full analysis
); if (!tokenText) { throw new Error("getCosUploadToken returned no text content"); } const storage = JSON.parse(tokenText) as StorageTokenResult; const blob = new Blob([fileData]); const formData = new FormData(); let uploadUrl: string; let cdnUrl: string; if (storage.storagePlatform === "TENCENT_COS") { const token = storage.token as CosToken; formData.append("file", blob, effectiveName); uploadUrl = token.uploadUrl; cdnUrl = `${token.cdn}/${token.key}`; } else { const token = storage.token as ObsToken; formData.append("key", token.key); formData.append("AccessKeyId", token.accessid); formData.append("policy", token.policy); formData.append("signature", token.signature); formData.append("success_action_status", "200"); formData.append("file", blob, effectiveName); uploadUrl = token.host; cdnUrl = `${token.cdn}/${token.key}`; } log(`Uploading to: ${uploadUrl.substring(0, 80)}...`); const response = await fetch(uploadUrl, { method: "POST", body: formData }); ``` The exposed tool accepts a caller-controlled path: ```ts if (name === "uploadFile") { cons ...[truncated 2165 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/generator/generate.ts:130
Finding: Bearer credentials can be transmitted to an arbitrary or plaintext bridge endpoint
Content: View full analysis
{ const headers = new Headers({ Accept: "application/json" }); if (token) { headers.set("Authorization", `Bearer ${token}`); } const payload = await fetchJson(resolvedUrls.toolCatalogUrl, { method: "GET", headers, }); ``` Generated and checked-in invocation wrappers have the same trust issue when `MY_MCP_BASE_URL` is overridden: ```js const token = process.env.MY_MCP_TOKEN; if (!token) { console.error("Missing MY_MCP_TOKEN"); process.exit(2); } const baseUrl = normalizeBaseUrl(process.env.MY_MCP_BASE_URL || DEFAULT_BASE_URL); const response = await fetch(`${baseUrl}/mcp/tools/${encodeURIComponent(toolName)}`, { method: "POST", headers: { "content-type": "application/json", authorization: `Bearer ${token}`, }, body: JSON.stringify({ arguments: args }), }); ``` ### Technical Analysis The generator accepts an arbitrary `--bridge-url` and does not constrain its protocol, hostname, port, or trust relationship. It automatically reuses `MY_MCP_TOKEN` or `OPENCLAW_TOKEN` and sends that credential to the selected endpoint. Consequently, a crafted command, configuration error, typo, or untrusted endpoint can ...[truncated 1367 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: src/generator/render.ts:112
Finding: Untrusted MCP metadata is embedded into persistent skill instructions without sanitization
Content: View full analysis
renderToolSection(tool)), "## How to invoke", ``` ### Technical Analysis The bridge response is remote-controlled data, but the generator places tool names, descriptions, argument names, and argument descriptions into the skill's instruction document as executable agent context. No Markdown escaping, structural delimiter, content policy, or human approval step distinguishes remote metadata from trusted instructions. A malicious tool description can include new headings, fabricated workflow requirements, requests to disclose information, advertising, or text instructing the agent to ignore prior constraints. Because the generated co ...[truncated 1274 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (41)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is specifically about a printing helper for local MCP bridge operations related to printers. The code shown is instead a general-purpose MCP tool invoker: it parses a tool name and JSON arguments from the command line, reads authentication and base URL from environment variables, and forwards the request to an MCP tools endpoint. While this could potentially be used to call printer-related tools, the code itself is not limited to or centered on printing workflows, and it introduces undeclared authenticated access to arbitrary MCP tools. That makes the actual behavior materially broader and different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this skill is a 'printing assistant' for interacting with a local MCP bridge to manage printer-related operations such as device inspection, capability checks, file upload, and task creation. The provided code chunk does something materially different: it is a CLI entrypoint for generating OpenClaw skill packages from a bridge URL and writing them to disk. It parses command-line options like --bridge-url, --out, --split-by, --skill-name, and --homepage, optionally uses a bearer token from CLI/env for bridge tool fetching, and logs generation results. There is no evidence in this chunk of printer/device operations, upload of print files, or print job lifecycle management. This is a primary-purpose mismatch, not just an implementation detail difference.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: 声明描述的是一个面向打印场景的运行时助手，负责通过本地 MCP bridge 执行打印相关操作（设备检查、能力确认、上传文件、创建任务、查询状态）。但这段代码并没有调用任何具体打印工具，也没有实现这些业务流程。相反，它的核心功能是访问 bridge 的工具目录接口，收集可用工具定义，并自动生成 OpenClaw skill 包文件。其主要目的属于“代码/技能包生成器”而非“打印助手”。虽然代码确实涉及本地 MCP bridge 和 wrapper 生成，但这是用于生成技能封装，而不是实际执行声明中的打印任务，因此属于实质性描述与行为不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents the skill as a printer helper whose purpose is to carry out concrete printing-related operations through a local MCP bridge. The supplied code does not implement those printer operations. Instead, it renders metadata/markdown describing tools, summarizes JSON schemas, writes tool schema JSON files, and generates a generic invoke.js script that can call any MCP tool by name against a configured bridge URL with a token. While this supports a wrapper-based bridge integration at a meta level, the primary behavior of this code chunk is code/document generation and generic tool invocation scaffolding, not the actual printer assistant workflow described. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says the skill is a printer helper that interacts with a local MCP bridge to execute operational printing tasks. However, the supplied code chunk is purely declarative type/interface definitions for a generator system. It models schemas, tool definitions, URLs, and generated skill artifacts, but does not implement any runtime behavior related to printers or MCP bridge operations. This is a material description-behavior mismatch because the actual code’s purpose is infrastructure/type modeling rather than the declared end-user printing workflow.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The script performs authenticated network requests to a configurable base URL using a bearer token, but the capability is not covered by declared permissions. Undeclared network access is security-relevant because it allows the skill to contact services outside its stated trust boundary and, if misconfigured, could send privileged requests or data to an attacker-controlled endpoint.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The script performs authenticated network requests to a configurable base URL using a bearer token, but the capability is not covered by declared permissions. Undeclared network access is security-relevant because it allows the skill to contact services outside its stated trust boundary and, if misconfigured, could send privileged requests or data to an attacker-controlled endpoint.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

Category: Supply Chain
Confidence: 88% confidence
Finding: fast-uri 3.1.0 is reported with multiple URI parsing issues including host confusion and possible SSRF-adjacent parsing flaws. In a skill that uploads files and talks to a local bridge, incorrect URI canonicalization could become dangerous if any user-controlled endpoint, callback URL, or upstream address is ever parsed or validated using this library through the MCP SDK stack.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.7 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

Category: Supply Chain
Confidence: 93% confidence
Finding: hono 4.12.7 is associated with numerous advisories affecting routing, cookie handling, and path processing. Because this skill includes an HTTP bridge binary and likely relies on web request handling through the MCP SDK stack, framework-level flaws can materially affect request isolation, route matching, cookie safety, or path security if the bridge is exposed beyond a tightly controlled local context.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: ip-address 10.1.0 is flagged for address parsing inconsistencies and an XSS issue in HTML-emitting methods. In this lockfile-only context, the package is a transitive dependency of rate limiting and there is no evidence the HTML-emitting methods are used, so practical exploitability is likely limited; however, parser inconsistencies can still matter if IP-based trust or filtering decisions are made by the bridge stack.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

Category: Supply Chain
Confidence: 90% confidence
Finding: path-to-regexp 8.3.0 is reported as vulnerable to ReDoS/DoS via crafted route patterns or pathological matching scenarios. Since this skill ships an HTTP bridge path stack through Express/Router/Hono-related dependencies, an exposed service using attacker-reachable route matching could suffer request amplification or CPU exhaustion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file describes sending Authorization: Bearer <token> requests and falling back to environment-stored tokens, which affects user credentials and privacy. The README explains how to configure the token but does not warn users that the bridge will transmit authentication credentials to a remote MCP service or that they should protect these secrets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to upload local files to a CDN and then submit them to a printing service, but it does not require an explicit consent or privacy warning before transmitting potentially sensitive local documents. In a printing context this is materially risky because users may assume the assistant operates locally, while the workflow actually sends document contents to remote infrastructure and possibly exposes filenames and metadata as well.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file claims to belong to a printing assistant skill, but the embedded metadata instead describes a different skill, search-docs-skill, with a document-search tool exposed through a localhost MCP bridge. This mismatch can cause incorrect routing or activation of capabilities, making it easier for an agent to invoke unintended local tools under false context and weakening trust boundaries around sensitive local bridge access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation text, 'Use this skill when the user needs capabilities exposed by the local MCP bridge,' is overly broad and effectively delegates arbitrary local bridge capabilities whenever a request might fit. In the context of localhost bridge access, broad matching increases the chance of unintended tool invocation, privilege overreach, or prompt-routing mistakes that expose local resources beyond the user’s actual intent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script exposes arbitrary remote tool invocation by taking user-controlled toolName and JSON arguments, then forwarding them with authentication to the MCP bridge. In the context of a printer assistant, this is more dangerous because the implementation grants a generalized privileged proxy capability unrelated to the narrow advertised purpose, increasing the risk of misuse, privilege expansion, and unauthorized actions on other tools.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code posts to a generic /mcp/tools/{toolName} endpoint and accepts the tool name from the command line, which permits invoking any exposed MCP tool rather than a printer-specific operation. This broad dispatch conflicts with the stated printer-assistant purpose and expands the reachable attack surface if the wrapper or caller can supply arbitrary tool names.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill manifest says this skill is a print helper that uses a local MCP bridge for device checks, capability confirmation, file upload, task creation, and short status checks. In package metadata, the description and exposed binaries add an 'OpenClaw skill generator' capability, which is a distinct function not reflected in the stated print-focused purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to upload local files and then use the returned CDN URL for printing, but it does not require explicit user notice or consent that the file will leave the local environment and be transmitted to an external bridge/CDN. This creates a real data-handling risk because users may reasonably believe they are printing locally while sensitive documents are actually being exfiltrated to third-party infrastructure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest’s natural-language descriptions are entirely in Chinese and present the skill as operating in that language, but there is no indication that users may choose another language or that the locale restriction is required for a region-specific purpose. That can violate a language/locale policy requiring user choice or documented justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The uploadFile tool accepts an absolute local file path and returns an uploaded CDN URL, creating a direct path for exfiltrating arbitrary local files if an agent is induced to call it on sensitive paths. Because the schema does not constrain allowed directories, file types, or user-confirmation conditions, the local MCP bridge becomes a capability for reading and exporting host files beyond the user's likely intent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description limits the skill to device check, capability confirmation, file upload, task creation, and short status confirmation. The declared tool set also exposes orderCancel, which adds a distinct destructive control path not mentioned in the stated workflow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest describes a printer helper that uses an in-repo wrapper to call a local MCP bridge for device checks, uploads, task creation, and brief status confirmation. This config code also sources credentials and remote endpoint configuration from process environment variables, introducing secret access and dynamic remote targeting capabilities that are not stated in the skill description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code uploads a local file via uploadLocalFile and invokes remote tools via callRemoteTool, both of which can transmit user or system data off-host. In this file there is no confirmation prompt, user-facing log/print, or explanatory comment/docstring disclosing these network-affecting actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill metadata says it uses a local wrapper/bridge, but this code directly opens an HTTP connection to a remote MCP server and authenticates with a bearer token. That is a material trust-boundary change: data, tool calls, and credentials leave the local environment, which increases exfiltration and remote-command risk, especially because the skill’s stated purpose is a local printing helper.
Content: No source excerpt is available for this finding.