Skills/PyPI/mcp-openclaw-extensions

mcp-openclaw-extensions@4.1.2

CAUTION· not started

Publisher claims: "138-tool generic MCP server for AI agent firms. Works with Claude Code, Codex, VS Code, Cursor, Antigravity" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher romainsantoli-web · publishing for 256 daysInstalls 66Last detonated 6d ago
What would fix thisWatchDispute verdict

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
FIRM_GATEWAY_TOKENGITHUB_TOKENJIRA_API_TOKENLINEAR_API_KEYMCP_AUTH_TOKENOPENCLAW_GATEWAY_TOKENSESSION_SECRETSLACK_WEBHOOK_URLConfiguration, not credentials: ACP_SESSIONS_PATH, EXPORT_HTTP_TIMEOUT_SECONDS, EXPORT_MAX_BODY_CHARS, FIRM_CONFIG, FIRM_CREDS, FIRM_DIR, FIRM_EXPORT_OUTPUT_DIR, FIRM_GATEWAY_HTTP, FIRM_GATEWAY_URL, FIRM_PLATFORM, FIRM_TIMEOUT_SECONDS, FIRM_TOOL_PREFIX, FIRM_URI_SCHEME, FIRM_WORKSPACE, FLEET_BROADCAST_TIMEOUT_SECONDS, FLEET_CONFIG_PATH, FLEET_HEALTH_TIMEOUT_SECONDS, FLEET_MAX_INSTANCES, HEBBIAN_ALLOWED_DIRS, JIRA_BASE_URL, JIRA_USER_EMAIL, MARKET_RESEARCH_OUTPUT_DIR, MCP_EXT_HOST, MCP_EXT_PORT, NGINX_CONF, OPENCLAW_GATEWAY_HTTP, OPENCLAW_GATEWAY_URL, OPENCLAW_TIMEOUT_SECONDS, TOOL_TIMEOUT_S, VS_BRIDGE_MAX_CONTEXT_BYTES, WORKSPACE_LOCKS_DIR
Where it talks to
no vendor host named in the codeAlso spdx.org, atlassian.net, linear.app, visualstudio.com, cursor.com, windsurf.com, antigravity.dev — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names spdx.org, atlassian.net, linear.app, visualstudio.com, cursor.com, windsurf.com, antigravity.dev as well as its own vendor. The guard injects FIRM_GATEWAY_TOKEN, GITHUB_TOKEN, JIRA_API_TOKEN, LINEAR_API_KEY, MCP_AUTH_TOKEN, OPENCLAW_GATEWAY_TOKEN, SESSION_SECRET, SLACK_WEBHOOK_URL only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- uvx mcp-openclaw-extensions

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-08 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Auto-update or dynamic fetch configuration; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathssrc/security_audit.py:281 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Fix: ajouter dans .env (et .env dans .gitignore!)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/platform_audit.py:460 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"message": "No auto-update configuration found"}Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Destructive file system command detectedsrc/delivery_export.py:491 · Destructive file system command detectedfile_path = Path(OUTPUT_DIR) / format / filenameFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/config_migration.py:248 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"auto-update can install untrusted code. Specify a concrete version. "Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationsrc/models.py:990 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeclass AutoupdateCheckInput(ConfigPathInput):Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationsrc/platform_audit.py:456 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeupdate_cfg = get_nested(config, "autoUpdate") or get_nested(config, "update") or {}Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Destructive command against a filesystem root or devicetests/test_cov_100d.py:420 · Destructive command against a filesystem root or device"sh": {"mode": "allow-always", "args": ["-c", "rm -rf /"]},Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedsrc/runtime_audit.py:115 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionsrc/a2a_bridge.py:642 · File type combined with upload action — agent may exfiltrate local data files"description": "Generate .well-known/agent-card.json from a SOUL.md file. RC v1.0 compliant with extensions, JCS+JWS signing, defaultInputModes/defaultOutputModes.",Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
URL with embedded credentialstests/test_cov_100c.py:339 · URL with embedded credentials — may be phishing or credential leaking"endpoint": "https://user:[email protected]",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
HIGH
Access to sensitive file pathssrc/security_audit.py:301 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file_path: Path to .env file to check (optional).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_cov_100c.py:808 · Destructive command against a filesystem root or devicecommand="rm -rf /", schedule="* * * * *")))Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive file system command detectedtests/test_cov_100d.py:420 · Destructive file system command detected"sh": {"mode": "allow-always", "args": ["-c", "rm -rf /"]},Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_100a.py:10 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_TRAVERSAL = "../etc/passwd"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/security_audit.py:573 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Returns: severity, secret found?, Docker and .env fix snippets."Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/security_audit.py:285 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtests/test_cov_100c.py:808 · Destructive file system command detectedcommand="rm -rf /", schedule="* * * * *")))Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_100f.py:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSecurityScanInput(target_path="../../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_cov_100e.py:1060 · Auto-update or dynamic fetch configuration — agent may load new code at runtimedef test_autoupdate_no_config(self, tmp_path):Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Slack webhook URLtests/test_cov_100e.py:793 · Slack webhook URL — data will be sent to Slackwith patch("src.delivery_export.SLACK_WEBHOOK_URL", "https://hooks.slack.com/xxx"):Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Slack webhook URLtests/test_cov_100e.py:812 · Slack webhook URL — data will be sent to Slackwith patch("src.delivery_export.SLACK_WEBHOOK_URL", "https://hooks.slack.com/xxx"):Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Auto-update or dynamic fetch configurationtests/test_cov_100e.py:1063 · Auto-update or dynamic fetch configuration — agent may load new code at runtime_parse(firm_autoupdate_check(config_path=cfg))Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/test_cov_100f.py:878 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr = _run(firm_workspace_lock(path="../etc/passwd", action="acquire", owner="me"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_cov_100f.py:1397 · Auto-update or dynamic fetch configuration — agent may load new code at runtimer = _parse(firm_autoupdate_check(config_path=cfg))Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Destructive command against a filesystem root or devicetests/test_cov_100g.py:214 · Destructive command against a filesystem root or devicecommand="echo 'hello world' && rm -rf /",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Destructive command against a filesystem root or devicetests/test_cov_100g.py:170 · Destructive command against a filesystem root or devicer = _run(ab.fleet_cron_schedule(command="rm -rf /", schedule="0 * * * *"))Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_100g.py:368 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"$include": "../../../etc/passwd"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_100g.py:608 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesConfigPathInput(config_path="../../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_cov_100g.py:760 · Auto-update or dynamic fetch configuration — agent may load new code at runtimer = firm_autoupdate_check(config_path=cfg)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/test_cov_100g.py:589 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filestitle="Test", content="x", output_path="../../../etc/shadow"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtests/test_cov_100g.py:214 · Destructive file system command detectedcommand="echo 'hello world' && rm -rf /",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_100g.py:267 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"apply": {"targetPath": "../../../etc/shadow"}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_cov_100g.py:751 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"""Autoupdate without signature verification."""Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
URL with embedded credentialstests/test_cov_100g.py:951 · URL with embedded credentials — may be phishing or credential leaking"endpoint": "https://user:[email protected]/v1",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Access to sensitive file pathstests/test_cov_100g.py:615 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file_path="../../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtests/test_cov_100g.py:170 · Destructive file system command detectedr = _run(ab.fleet_cron_schedule(command="rm -rf /", schedule="0 * * * *"))Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_deep.py:897 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_extreme.py:259 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr = _run(firm_gateway_auth_check("../../../etc/passwd"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_deep.py:906 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_extreme.py:335 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr = _run(firm_webhook_sig_check("../../../etc/passwd"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_cov_100h.py:979 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"autoUpdate": {"enabled": True, "channel": "stable"}Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Slack webhook URLtests/test_cov_deep.py:530 · Slack webhook URL — data will be sent to Slackpatch("src.delivery_export.SLACK_WEBHOOK_URL", "https://hooks.slack.com/test"):Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Access to sensitive file pathstests/test_cov_extreme.py:472 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_100i.py:781 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesresult = no_path_traversal("../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_100h.py:661 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesKnowledgeGraphCheckInput(graph_data_path="../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_extreme.py:57 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"secrets": {"apply": {"targetPath": "../../../etc/passwd"}}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL with embedded credentialstests/test_cov_final.py:603 · URL with embedded credentials — may be phishing or credential leakingcfg = {"otel": {"endpoint": "https://user:[email protected]/v1/traces"}}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Access to sensitive file pathstests/test_cov_extreme.py:366 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesr = _run(firm_log_config_check("../../../etc/passwd"))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_final.py:854 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescfg = {"nested": {"$include": "../../../etc/passwd"}}Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagetests/test_cov_mid.py:1732 · npx invocation of non-well-known package — may execute untrusted code- run: npx tsc --noEmitFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/test_cov_mid.py:437 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL with embedded credentialstests/test_cov_mid.py:141 · URL with embedded credentials — may be phishing or credential leaking"endpoint": "https://user:[email protected]",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
AWS access key pattern detectedtests/test_cov_hebbian.py:56 · AWS access key pattern detected — possible hardcoded or harvested keyassert "[REDACTED_AWS_KEY]" in _strip_pii("AKIAIOSFODNN7EXAMPLE is the key")Fix: Never read or enumerate credential locations; accept a documented environment variable instead.
AST03
MEDIUM
Access to sensitive file pathstests/test_cov_final.py:764 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_mid.py:565 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"$include": "../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_mid.py:507 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"apply": [{"targetPath": "../../etc/passwd"}],Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_mid.py:452 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_hebbian.py:83 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_validate_hebbian_path("/etc/passwd", "test")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_ultra.py:894 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesHebbianHarvestInput(session_jsonl_path="../../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_smoke.py:3816 · Auto-update or dynamic fetch configuration — agent may load new code at runtimedef test_autoupdate_no_config(self, mcp_server):Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/test_smoke.py:403 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"target_path": "../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_handlers.py:1016 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_patch_3_1.py:493 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesAcpxVersionCheckInput(config_path="../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Destructive file system command detectedtests/test_smoke.py:585 · Destructive file system command detected"command": "rm -rf /; echo pwned",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_ultra.py:900 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesSecurityScanInput(config_path="../../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_models.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesA2aCardGenerateInput(soul_path="./ok.md", base_url="https://example.com", output_path="/tmp/../../../etc/shadow")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_cov_mid.py:768 · Auto-update or dynamic fetch configuration — agent may load new code at runtimer = firm_autoupdate_check(config_path=cfg)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedtests/test_smoke.py:43 · Python subprocess execution detectedproc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Access to sensitive file pathstests/test_cov_ultra.py:860 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesExportDocumentInput(objective="test", content="code", output_path="../../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_smoke.py:646 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"path": "../../etc/shadow",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_cov_mid.py:755 · Auto-update or dynamic fetch configuration — agent may load new code at runtimer = firm_autoupdate_check(config_path=cfg)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/test_hebbian_memory.py:56 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filessession_jsonl_path="../../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Auto-update or dynamic fetch configurationtests/test_cov_ultra.py:725 · Auto-update or dynamic fetch configuration — agent may load new code at runtimecfg = _write_config(tmp_path, {"autoupdate": {"enabled": True, "channel": "stable"}})Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Auto-update or dynamic fetch configurationtests/test_handlers.py:504 · Auto-update or dynamic fetch configuration — agent may load new code at runtimedef test_autoupdate_check(self, firm_config):Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/test_smoke.py:296 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"output_path": "../../etc/passwd",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
URL with embedded credentialstests/test_smoke.py:2567 · URL with embedded credentials — may be phishing or credential leaking"endpoint": "https://admin:[email protected]",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST07
MEDIUM
Auto-update or dynamic fetch configurationtests/test_handlers.py:53 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"autoupdate": {"enabled": False, "channel": "stable"},Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Access to sensitive file pathstests/test_smoke.py:459 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_models.py:44 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesA2aCardGenerateInput(soul_path="../../../etc/passwd", base_url="https://example.com")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Slack webhook URLtests/test_smoke.py:1566 · Slack webhook URL — data will be sent to Slackmonkeypatch.setattr(mod, "SLACK_WEBHOOK_URL", "https://hooks.slack.com/test")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Access to sensitive file pathstests/test_smoke.py:772 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"arguments": {"config_path": "../../etc/passwd"},Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Access to sensitive file pathstests/test_models.py:70 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesA2aCardValidateInput(card_path="../../etc/passwd")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
URL to a private-network addresstests/test_config_helpers.py:74 · URL to a private-network address — a LAN or development targeterr = check_ssrf("http://192.168.1.1/api")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_cov_100a.py:258 · URL to a private-network address — a LAN or development targetr = check_ssrf("http://10.0.0.1/api")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresssrc/gateway_fleet.py:234 · URL to a private-network address — a LAN or development targethttp_url: HTTP URL (e.g. "http://192.168.1.10:18789").Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
URL to a private-network addresstests/test_cov_100f.py:1518 · URL to a private-network address — a LAN or development targetresult = check_ssrf("http://10.0.0.1:8080/data")Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
LOW
Instructs the agent to modify its persistent memory or instruction filessrc/gateway_hardening.py:531 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file- MEMORY.md present (warns if stale > stale_days days without update)Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Prompt injectionREADME.md:120 · Prompt injection — known jailbreak technique reference · informational: not an instruction file · informational: not an instruction file| prompt_security | `firm_prompt_injection_check` | Scan text for 16 injection/jailbreak patterns | H2 |Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01

Cost to the agent

Instructions loaded
≈69 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for mcp-openclaw-extensions@4.1.2 as of 6d ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim romainsantoli-web: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Destructive command against a filesystem root or device≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to PyPI, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim romainsantoli-webPropose a patch to the maintainer