Skill Trust Decision
sa-master
Skill includes an undeclared shell script (call_tool.sh) that executes local bash commands, exposes a hardcoded API key in config.json, and connects to an external MCP service with limited data-handling transparency.
Most direct threat evidence
01
Skill packaged with hardcoded bearer token in config.json Entry · mcp-proxy/config.json
02
Undeclared shell script call_tool.sh executes bash+curl+python3 locally Escalation · mcp-proxy/call_tool.sh
03
Business architecture documents exfiltrated to external MCP service https://mcp.smartmoves.com.cn/sa/mcp Impact · SKILL.md
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
3 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 1 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
Attack Chain
01
Skill packaged with hardcoded bearer token in config.json
Entry · mcp-proxy/config.json:2
02
Undeclared shell script call_tool.sh executes bash+curl+python3 locally
Escalation · mcp-proxy/call_tool.sh:1
03
Business architecture documents exfiltrated to external MCP service https://mcp.smartmoves.com.cn/sa/mcp
Impact · SKILL.md:91
04
Bearer token credentials sent with every request to external service
Impact · mcp-proxy/call_tool.sh:72
What drove the risk score up
Undeclared shell execution capability +20
call_tool.sh enables bash+curl execution but is not mentioned in SKILL.md capabilities or tool declarations
Hardcoded credential exposure +15
Bearer token sk-Wp9mTx4KvRn7Qd3Fzj embedded in config.json and referenced in SKILL.md
External service data exfiltration risk +10
Architecture documents and business assets sent to https://mcp.smartmoves.com.cn/sa/mcp with unclear data handling
No allowed-tools mapping +5
No pi.yaml or equivalent declaring filesystem/shell/network permissions
Most important evidence
High Credential Theft
Hardcoded bearer token in config.json
The file mcp-proxy/config.json contains a hardcoded API key 'sk-Wp9mTx4KvRn7Qd3Fzj'. This credential is also embedded in SKILL.md documentation, creating a permanent exposure risk.
mcp-proxy/config.json:2 Remove api_key from config.json entirely. Require users to provide their own API key via environment variable (e.g., MCP_API_KEY) or user configuration. SKILL.md should instruct users to supply credentials, not embed them.
Medium Doc Mismatch
Undeclared shell script execution capability
mcp-proxy/call_tool.sh is a bash script that executes local shell commands (bash, curl, python3) but this capability is not declared in SKILL.md under tool declarations or permissions. The SKILL.md only mentions MCP tools without referencing any local script execution.
mcp-proxy/call_tool.sh:1 Either remove call_tool.sh if not needed, or explicitly declare shell/bash:WRITE capability in SKILL.md with clear documentation of the use case.
Medium Data Exfil
Architecture documents sent to external MCP service with unclear data retention
The skill sends business requirements, architecture documents, and design artifacts to a remote MCP service at https://mcp.smartmoves.com.cn/sa/mcp. skill-card.md acknowledges this risk but provides no details about data retention, processing, or third-party sharing policies.
SKILL.md:91 Before using this skill in production, verify the external service's data-handling policies. Consider self-hosting the MCP service if data confidentiality is critical. Add explicit data classification guidance in SKILL.md.
Low Priv Escalation
No allowed-tools declaration file present
No pi.yaml or equivalent allowed-tools mapping file exists in the skill package. Without explicit permission declarations, the runtime cannot verify that shell access granted to call_tool.sh is intentional and scoped.
. Add a pi.yaml file declaring allowed tools and resource permissions (e.g., shell:WRITE for call_tool.sh, network:WRITE for MCP calls) to provide transparency and enable permission verification.
Declared capability vs actual capability
Shell Block
Declared NONE
→ Inferred WRITE
mcp-proxy/call_tool.sh:1 — bash script executes curl commands to remote endpoint Network Pass
Declared READ
→ Inferred WRITE
SKILL.md declares MCP service usage; call_tool.sh sends JSON-RPC requests Filesystem Pass
Declared NONE
→ Inferred NONE
Skill outputs documents but no filesystem permissions declared; call_tool.sh creates .tmp directory Suspicious artifacts and egress
Medium External URL
https://mcp.smartmoves.com.cn/sa/mcp SKILL.md:82
Medium External URL
https://clawhub.ai/user/leo21cn skill-card.md:7
Medium External URL
https://clawhub.ai/leo21cn/skills/sa-master skill-card.md:29
Dependencies and supply chain
There are no structured dependency warnings.
File composition
5 files · 359 lines
Shell 1 files · 180 linesMarkdown 2 files · 173 linesJSON 2 files · 6 lines
Files of concern · 4
mcp-proxy/config.json Hardcoded bearer token in config.json
SKILL.md Architecture documents sent to external MCP service with unclear data retention · https://mcp.smartmoves.com.cn/sa/mcp
mcp-proxy/call_tool.sh Undeclared shell script execution capability
skill-card.md https://clawhub.ai/user/leo21cn · https://clawhub.ai/leo21cn/skills/sa-master
Other files · _meta.json
Security positives
skill-card.md acknowledges the risk of exposed bearer tokens and external data sharing, demonstrating some security awareness
The call_tool.sh script uses temporary files in a dedicated .tmp subdirectory rather than system /tmp
No base64-encoded payloads or obfuscated code patterns observed
No evidence of credential harvesting from environment variables or sensitive paths like ~/.ssh