Skill Trust Decision
sa-master
Skill embeds a hardcoded bearer token and routes all user architecture documents, file paths, and prompts through an external Chinese MCP service (smartmoves.com.cn) without transparent data handling disclosure.
Most direct threat evidence
01
User installs skill and provides BA business documents for architecture design Entry · SKILL.md
02
Skill routes user documents, file paths, and prompts to external smartmoves.com.cn MCP endpoint Escalation · mcp-proxy/call_tool.sh
03
Hardcoded bearer token in config.json exposed to all skill installers Impact · mcp-proxy/config.json
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
3 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 3 attack-chain steps and 2 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
Attack Chain
01
User installs skill and provides BA business documents for architecture design
Entry · SKILL.md:1
02
Skill routes user documents, file paths, and prompts to external smartmoves.com.cn MCP endpoint
Escalation · mcp-proxy/call_tool.sh:63
03
Hardcoded bearer token in config.json exposed to all skill installers
Impact · mcp-proxy/config.json:1
What drove the risk score up
Hardcoded bearer token in config.json +20
API key sk-Wp9mTx4KvRn7Qd3Fzj exposed in plaintext; committed to skill package
Data exfiltration to external Chinese MCP service +25
All user content, file paths, and architecture documents routed to smartmoves.com.cn
Insufficient data handling transparency +10
SKILL.md declares capability model but omits disclosure of data flow to third-party service
Most important evidence
High Credential Theft
Hardcoded API bearer token in config.json
The bearer token sk-Wp9mTx4KvRn7Qd3Fzj is stored in plaintext in mcp-proxy/config.json and embedded in SKILL.md. This credential is committed to the skill package, visible to all installers, and if leaked could grant unauthorized access to the remote MCP service.
mcp-proxy/config.json:1 Remove the api_key from config.json. Use environment variable or secret management for credential injection at runtime.
High Data Exfil
Undisclosed data routing to third-party Chinese MCP service
SKILL.md declares the skill uses a remote MCP service at smartmoves.com.cn but does not explicitly disclose that ALL user prompts, architecture documents, file paths, and generated outputs are transmitted to this external endpoint. The skill-card.md mentions this as a risk but SKILL.md does not.
SKILL.md:82 Add explicit disclosure in SKILL.md that user content is transmitted to the third-party MCP service. Users must consent to this data flow before using the skill with sensitive materials.
Medium Doc Mismatch
SKILL.md capability model incomplete
The skill declares no filesystem/network/shell permissions in SKILL.md, implying it operates without resource access. However, call_tool.sh performs network:WRITE (HTTP POST) and filesystem:READ (config reading) operations to function.
SKILL.md:1 Document that the skill performs network communication with the remote MCP service endpoint.
Medium Credential Theft
Bearer token repeated in SKILL.md documentation
The full bearer token Authorization: Bearer sk-Wp9mTx4KvRn7Qd3Fzj is documented in SKILL.md line 85. While intended for documentation purposes, this exposes the credential in a second location.
SKILL.md:85 Remove the actual token value from documentation. Use a placeholder like YOUR_API_KEY instead.
Declared capability vs actual capability
Network Block
Declared NONE
→ Inferred READ,WRITE
call_tool.sh:63-69 makes HTTP POST to external remote_url Environment Pass
Declared NONE
→ Inferred READ
call_tool.sh reads API_KEY from config.json Filesystem Pass
Declared NONE
→ Inferred READ
call_tool.sh:39-47 reads config.json Suspicious artifacts and egress
Medium External URL
https://mcp.smartmoves.com.cn/sa/mcp SKILL.md:82
Medium External URL
https://clawhub.ai/user/leo21cn skill-card.md:7
Medium External URL
https://clawhub.ai/leo21cn/sa-master skill-card.md:29
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| curl | system | system binary | No | Standard system utility |
| python3 | system | system binary | No | Standard system utility |
File composition
5 files · 360 lines
Shell 1 files · 180 linesMarkdown 2 files · 174 linesJSON 2 files · 6 lines
Files of concern · 3
mcp-proxy/config.json Hardcoded API bearer token in config.json
SKILL.md Undisclosed data routing to third-party Chinese MCP service · SKILL.md capability model incomplete · Bearer token repeated in SKILL.md documentation · https://mcp.smartmoves.com.cn/sa/mcp
skill-card.md https://clawhub.ai/user/leo21cn · https://clawhub.ai/leo21cn/sa-master
Other files · call_tool.sh · _meta.json
Security positives
skill-card.md explicitly documents known risks including data handling concerns and bearer token exposure
No obfuscation or encoded payloads detected
No direct shell command execution on local system
Remote MCP service provides controlled tool execution rather than arbitrary code execution