Mcp Server Scanner

Scans and assesses MCP servers for vulnerabilities, insecure configs, data exposure, and compliance with SOC 2, GDPR, and ISO 27001 standards.

This skill's goals (discovering MCP servers, finding hardcoded secrets, scanning configs and network) imply access to sensitive system files and network traffic, but the package declares no required credentials, binaries, or file paths and gives only vague instructions. Before installing or invoking it: 1) Ask the author for source code or a trustworthy homepage and for an explicit list of files/paths, network ranges, and credentials the skill will access. 2) Require the skill to declare required env vars and exact commands it will run, or reject it. 3) Run any scan in an isolated/test environment and with written authorization for the scope. 4) Avoid granting the agent network access or secrets without tight controls; prefer skills with verifiable provenance. If the author cannot provide clear, scoped details, treat this skill as high-risk and do not run it against production systems.

Type: OpenClaw Skill Name: mcp-server-scanner Version: 1.0.0 The skill bundle contains no executable code and relies entirely on instructions in SKILL.md to direct the AI agent to perform high-risk reconnaissance. It tasks the agent with searching for hardcoded secrets, PII, and configuration files across the environment under the guise of a 'security scan.' This pattern is characteristic of a prompt-injection attack designed to trick an agent into exposing sensitive environment data through its output without providing any actual scanning logic.