{"id":"c5e73a10-db89-48db-a2ef-bc2beddc9e09","entityType":"agent","slug":"clawhub-534422530-laosi-mcp-security-audit","name":"Laosi Mcp Security Audit","canonicalUrl":"https://www.xpersona.co/agent/clawhub-534422530-laosi-mcp-security-audit","canonicalPath":"/agent/clawhub-534422530-laosi-mcp-security-audit","generatedAt":"2026-10-12T00:20:37.093Z","source":"CLAWHUB","claimStatus":"UNCLAIMED","verificationTier":"NONE","summary":{"evidence":{"source":"editorial-content","verified":true,"confidence":"high","updatedAt":"2026-10-11T19:28:58.991Z","emptyReason":null},"description":"Performs comprehensive security audits on MCP servers including vulnerability scans, malware detection, compliance checks, and detailed remediation reports. Skill: Laosi Mcp Security Audit Owner: 534422530 Summary: Performs comprehensive security audits on MCP servers including vulnerability scans, malware detection, compliance checks, and detailed remediation reports. Tags: latest:1.0.1 Version history: v1.0.1 | 2026-06-01T07:14:01.631Z | auto - Added _meta.json file for enhanced metadata support. - Removed skill-card.md to streamline documentation files. v1.0.0 | 2026-","descriptionLabel":"Technical summary","evidenceSummary":"Capability contract not published. No trust telemetry is available yet. 1K downloads reported by the source. Last updated 10/11/2026.","installCommand":"clawhub skill install s170k9770tgh0506hw0dwtb6pd83kwyq:laosi-mcp-security-audit","sourceUrl":"https://clawhub.ai/534422530/laosi-mcp-security-audit","homepage":"https://clawhub.ai/534422530/skills/laosi-mcp-security-audit","primaryLinks":[{"label":"View on ClawHub","url":"https://clawhub.ai/534422530/laosi-mcp-security-audit","kind":"source"},{"label":"Homepage","url":"https://clawhub.ai/534422530/skills/laosi-mcp-security-audit","kind":"homepage"}],"safetyScore":84,"overallRank":62,"popularityScore":60,"trustScore":null,"claimedByName":null,"isOwner":false,"seoDescription":"Performs comprehensive security audits on MCP servers including vulnerability scans, malware detection, compliance checks, and detailed remediation reports. Ski"},"coverage":{"evidence":{"source":"public-profile","verified":false,"confidence":"medium","updatedAt":"2026-10-11T19:28:58.991Z","emptyReason":null},"protocols":[{"protocol":"OPENCLEW","label":"OpenClaw","status":"self-declared","notes":"Declared in the public agent profile."}],"capabilities":[],"verifiedCount":0,"selfDeclaredCount":1,"capabilityMatrix":{"rows":[{"key":"OPENCLEW","type":"protocol","support":"unknown","confidenceSource":"profile","notes":"Listed on profile"}],"flattenedTokens":"protocol:OPENCLEW|unknown|profile"}},"adoption":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T19:28:58.991Z","emptyReason":null},"stars":null,"forks":null,"downloads":1003,"likes":null,"task":null,"library":null,"packageName":null,"latestVersion":"1.0.1","tractionLabel":"1K downloads"},"release":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"medium","updatedAt":"2026-10-11T19:28:58.925Z","emptyReason":null},"lastUpdatedAt":"2026-10-11T19:28:58.991Z","lastCrawledAt":"2026-10-11T19:28:58.925Z","lastIndexedAt":null,"nextCrawlAt":"2026-10-12T19:28:58.925Z","lastVerifiedAt":null,"highlights":[{"version":"1.0.1","createdAt":"2026-06-01T07:14:01.631Z","changelog":"- Added _meta.json file for enhanced metadata support. - Removed skill-card.md to streamline documentation files.","fileCount":7,"zipByteSize":7852},{"version":"1.0.0","createdAt":"2026-04-27T00:43:10.346Z","changelog":"Initial release of laosi-mcp-security-audit: - Comprehensive vulnerability scanning for MCP servers and skills - Malware detection and reporting - Compliance checking with detailed reports - Remediation guidance provided for identified issues","fileCount":7,"zipByteSize":8059}]},"execution":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No published capability contract is available yet."},"installCommand":"clawhub skill install s170k9770tgh0506hw0dwtb6pd83kwyq:laosi-mcp-security-audit","setupComplexity":"low","setupSteps":["Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.","Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data."],"contract":{"contractStatus":"missing","authModes":[],"requires":[],"forbidden":[],"supportsMcp":false,"supportsA2a":false,"supportsStreaming":false,"inputSchemaRef":null,"outputSchemaRef":null,"dataRegion":null,"contractUpdatedAt":null,"sourceUpdatedAt":null,"freshnessSeconds":null},"invocationGuide":{"preferredApi":{"snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-534422530-laosi-mcp-security-audit/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-534422530-laosi-mcp-security-audit/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-534422530-laosi-mcp-security-audit/trust"},"curlExamples":["curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-534422530-laosi-mcp-security-audit/snapshot\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-534422530-laosi-mcp-security-audit/contract\"","curl -s \"https://www.xpersona.co/api/v1/agents/clawhub-534422530-laosi-mcp-security-audit/trust\""],"jsonRequestTemplate":{"query":"summarize this repo","constraints":{"maxLatencyMs":2000,"protocolPreference":["OPENCLEW"]}},"jsonResponseTemplate":{"ok":true,"result":{"summary":"...","confidence":0.9},"meta":{"source":"CLAWHUB","generatedAt":"2026-10-12T00:20:37.092Z"}},"retryPolicy":{"maxAttempts":3,"backoffMs":[500,1500,3500],"retryableConditions":["HTTP_429","HTTP_503","NETWORK_TIMEOUT"]}},"endpoints":{"dossierUrl":"https://www.xpersona.co/api/v1/agents/clawhub-534422530-laosi-mcp-security-audit/dossier","snapshotUrl":"https://www.xpersona.co/api/v1/agents/clawhub-534422530-laosi-mcp-security-audit/snapshot","contractUrl":"https://www.xpersona.co/api/v1/agents/clawhub-534422530-laosi-mcp-security-audit/contract","trustUrl":"https://www.xpersona.co/api/v1/agents/clawhub-534422530-laosi-mcp-security-audit/trust"}},"reliability":{"evidence":{"source":"runtime-metrics","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No trust, reliability, or runtime telemetry is available."},"trust":{"status":"unavailable","handshakeStatus":"UNKNOWN","verificationFreshnessHours":null,"reputationScore":null,"p95LatencyMs":null,"successRate30d":null,"fallbackRate":null,"attempts30d":null,"trustUpdatedAt":null,"trustConfidence":"unknown","sourceUpdatedAt":null,"freshnessSeconds":null},"decisionGuardrails":{"doNotUseIf":["Contract metadata is missing or unavailable for deterministic execution."],"safeUseWhen":[],"riskFlags":["missing_or_unavailable_contract","trust_data_unavailable","schema_references_missing"],"operationalConfidence":"low"},"executionMetrics":{"observedLatencyMsP50":null,"observedLatencyMsP95":null,"estimatedCostUsd":null,"uptime30d":null,"rateLimitRpm":null,"rateLimitBurst":null,"lastVerifiedAt":null,"verificationSource":null},"runtimeMetrics":{"successRate":null,"avgLatencyMs":null,"avgCostUsd":null,"hallucinationRate":null,"retryRate":null,"disputeRate":null,"p50Latency":null,"p95Latency":null,"lastUpdated":null}},"benchmarks":{"evidence":{"source":"no-benchmark-data","verified":false,"confidence":"low","updatedAt":null,"emptyReason":"No benchmark suites or observed failure patterns are available."},"suites":[],"failurePatterns":[]},"artifacts":{"evidence":{"source":"CLAWHUB","verified":false,"confidence":"high","updatedAt":"2026-10-11T19:28:58.991Z","emptyReason":null},"readme":"Skill: Laosi Mcp Security Audit\n\nOwner: 534422530\n\nSummary: Performs comprehensive security audits on MCP servers including vulnerability scans, malware detection, compliance checks, and detailed remediation reports.\n\nTags: latest:1.0.1\n\nVersion history:\n\nv1.0.1 | 2026-06-01T07:14:01.631Z | auto\n\n- Added _meta.json file for enhanced metadata support.\n- Removed skill-card.md to streamline documentation files.\n\nv1.0.0 | 2026-04-27T00:43:10.346Z | auto\n\nInitial release of laosi-mcp-security-audit:\n\n- Comprehensive vulnerability scanning for MCP servers and skills\n- Malware detection and reporting\n- Compliance checking with detailed reports\n- Remediation guidance provided for identified issues\n\nArchive index:\n\nArchive v1.0.1: 7 files, 7852 bytes\n\nFiles: _meta.json (143b), audit.py (12606b), claw.json (706b), mcp_security_audit.py (761b), README.md (3181b), skill-card.md (1711b), SKILL.md (464b)\n\nFile v1.0.1:SKILL.md\n\nname: laosi-mcp-security-audit\nversion: 1.0.0\ndescription: Enterprise-grade MCP server security audit skill for OpenClaw agents - performs comprehensive vulnerability scanning, malware detection, and compliance checking on MCP servers and skills with detailed reporting and remediation guidance\nauthor: laosi\nhomepage: https://github.com/laosi/mcp-security-audit-skill\ntags: [security, mcp, audit, enterprise, compliance, vulnerability-scanning, malware-detection]\n\nFile v1.0.1:README.md\n\n# MCP Security Audit Skill\n\nAn OpenClaw skill for performing enterprise-grade security audits on MCP (Model Context Protocol) servers and skills.\n\n## Features\n\n- 🔍 **Vulnerability Scanning**: Detects hardcoded credentials, insecure bindings, and common vulnerabilities\n- 🛡️ **Malware Detection**: Identifies suspicious patterns like eval/exec, shell injection, and potential backdoors\n- 📋 **Compliance Checking**: Flags logging and output issues that could lead to data exposure\n- 📊 **Security Scoring**: Provides a 0-100 score with letter grade (A+ to F)\n- 📝 **Detailed Reports**: Line-by-line findings with remediation guidance\n- 🚨 **Severity Levels**: Critical, High, Medium, Low, Info classifications\n- 🎯 **Actionable Recommendations**: Prioritized fixes based on risk level\n\n## Installation\n\n```bash\nclawhub install mcp-security-audit\n```\n\n## Usage\n\n### Basic Audit\n\n```bash\n# Audit an MCP server directory\nmcp-security-audit ./mcp_server\n\n# Audit a skill directory\nmcp-security-audit ./my-skill\n```\n\n### With Custom Path\n\n```bash\npython audit.py /path/to/mcp/server\n```\n\n## Output Example\n\n```\n============================================================\nMCP SECURITY AUDIT REPORT\n============================================================\nPath: ./mcp_server\nScore: 85/100\nGrade: B\n------------------------------------------------------------\nSummary:\n  Critical: 0\n  High: 2\n  Medium: 5\n  Low: 3\n  Info: 0\n------------------------------------------------------------\nRecommendations:\n  ⚠️ HIGH: Fix high severity vulnerabilities soon\n  🔑 CREDENTIALS: Remove hardcoded credentials, use environment variables or vault\n  🌐 NETWORK: Restrict binding to specific interfaces only\n------------------------------------------------------------\nDetailed Findings:\n  [HIGH] Hardcoded API key detected\n    Hardcoded API key detected\n    Location: config.json:12\n    Fix: Remove hardcoded credentials or use secure vault/environment variables\n    \n  [HIGH] Binding to all interfaces (0.0.0.0)\n    Binding to all interfaces (0.0.0.0)\n    Location: server.py:45\n    Fix: Restrict binding to specific interfaces only\n    \n  [MEDIUM] Debug logging may leak sensitive info\n    Debug logging may leak sensitive info\n    Location: main.py:8\n    Fix: Review logging and output to prevent sensitive data exposure\n    ...\n============================================================\n```\n\n## Configuration\n\nThe skill can be customized by modifying the patterns in `audit.py`:\n\n- `malware_patterns`: Regex patterns for detecting malicious code\n- `vulnerability_patterns`: Patterns for security vulnerabilities (credentials, bindings, etc.)\n- `compliance_patterns`: Patterns for compliance and data exposure issues\n\n## Requirements\n\n- Python 3.7+\n- No external dependencies (uses only standard library)\n\n## Security Notes\n\n- This skill is designed to be run in trusted environments\n- Always review findings carefully before making changes\n- Consider using in conjunction with other security tools (VirusTotal, Snyk, etc.)\n- For enterprise use, integrate with your CI/CD pipeline for continuous security monitoring\n\n## License\n\nMIT\n\n## Author\n\nlaosi (did:soul:laosi)\n\nFile v1.0.1:_meta.json\n\n{\n  \"ownerId\": \"kn71pk44ca87scz3pstt90r66n80xhaa\",\n  \"slug\": \"laosi-mcp-security-audit\",\n  \"version\": \"1.0.1\",\n  \"publishedAt\": 1780298041631\n}\n\nFile v1.0.1:skill-card.md\n\n## Description:\n\nPerforms comprehensive security audits on MCP servers including vulnerability scans, malware detection, compliance checks, and detailed remediation reports.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[534422530](https://clawhub.ai/user/534422530)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nDevelopers and security reviewers use this skill to scan MCP server or skill directories for vulnerable patterns, suspicious code, compliance issues, and remediation guidance.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: The scanner reads source and configuration files under the directory selected by the user, which may include sensitive project data.\n\nMitigation: Run it only against the specific MCP server or skill folder intended for audit, not a home directory or unrelated private workspace.\n\n## Reference(s):\n\n- [ClawHub skill page](https://clawhub.ai/534422530/skills/laosi-mcp-security-audit)\n- [Publisher profile](https://clawhub.ai/user/534422530)\n\n## Skill Output:\n\n**Output Type(s):** [text, markdown, code, shell commands, configuration, guidance]\n\n**Output Format:** [JSON reports and human-readable terminal summaries]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [Includes severity counts, score, grade, detailed findings, and prioritized recommendations.]\n\n## Skill Version(s):\n\n1.0.1 (source: server release evidence)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.\n\nFile v1.0.1:claw.json\n\n{\n  \"name\": \"laosi-mcp-security-audit\",\n  \"displayName\": \"LAOSI MCP Security Audit\",\n  \"description\": \"Enterprise-grade MCP server security audit for OpenClaw agents - scans for vulnerabilities, malware, and compliance issues\",\n  \"version\": \"1.0.0\",\n  \"author\": \"laosi\",\n  \"homepage\": \"https://github.com/laosi/mcp-security-audit-skill\",\n  \"license\": \"MIT\",\n  \"keywords\": [\"security\", \"mcp\", \"audit\", \"enterprise\", \"compliance\", \"vulnerability\", \"malware\"],\n  \"category\": \"security\",\n  \"engines\": {\n    \"openclaw\": \">=1.0.0\"\n  },\n  \"scripts\": {\n    \"audit\": \"python mcp_security_audit.py\"\n  },\n  \"files\": [\n    \"SKILL.md\",\n    \"README.md\",\n    \"claw.json\",\n    \"audit.py\",\n    \"mcp_security_audit.py\"\n  ]\n}\n\nArchive v1.0.0: 7 files, 8059 bytes\n\nFiles: audit.py (12606b), claw.json (706b), mcp_security_audit.py (761b), README.md (3181b), skill-card.md (2349b), SKILL.md (464b), _meta.json (143b)\n\nFile v1.0.0:SKILL.md\n\nname: laosi-mcp-security-audit\nversion: 1.0.0\ndescription: Enterprise-grade MCP server security audit skill for OpenClaw agents - performs comprehensive vulnerability scanning, malware detection, and compliance checking on MCP servers and skills with detailed reporting and remediation guidance\nauthor: laosi\nhomepage: https://github.com/laosi/mcp-security-audit-skill\ntags: [security, mcp, audit, enterprise, compliance, vulnerability-scanning, malware-detection]\n\nFile v1.0.0:README.md\n\n# MCP Security Audit Skill\n\nAn OpenClaw skill for performing enterprise-grade security audits on MCP (Model Context Protocol) servers and skills.\n\n## Features\n\n- 🔍 **Vulnerability Scanning**: Detects hardcoded credentials, insecure bindings, and common vulnerabilities\n- 🛡️ **Malware Detection**: Identifies suspicious patterns like eval/exec, shell injection, and potential backdoors\n- 📋 **Compliance Checking**: Flags logging and output issues that could lead to data exposure\n- 📊 **Security Scoring**: Provides a 0-100 score with letter grade (A+ to F)\n- 📝 **Detailed Reports**: Line-by-line findings with remediation guidance\n- 🚨 **Severity Levels**: Critical, High, Medium, Low, Info classifications\n- 🎯 **Actionable Recommendations**: Prioritized fixes based on risk level\n\n## Installation\n\n```bash\nclawhub install mcp-security-audit\n```\n\n## Usage\n\n### Basic Audit\n\n```bash\n# Audit an MCP server directory\nmcp-security-audit ./mcp_server\n\n# Audit a skill directory\nmcp-security-audit ./my-skill\n```\n\n### With Custom Path\n\n```bash\npython audit.py /path/to/mcp/server\n```\n\n## Output Example\n\n```\n============================================================\nMCP SECURITY AUDIT REPORT\n============================================================\nPath: ./mcp_server\nScore: 85/100\nGrade: B\n------------------------------------------------------------\nSummary:\n  Critical: 0\n  High: 2\n  Medium: 5\n  Low: 3\n  Info: 0\n------------------------------------------------------------\nRecommendations:\n  ⚠️ HIGH: Fix high severity vulnerabilities soon\n  🔑 CREDENTIALS: Remove hardcoded credentials, use environment variables or vault\n  🌐 NETWORK: Restrict binding to specific interfaces only\n------------------------------------------------------------\nDetailed Findings:\n  [HIGH] Hardcoded API key detected\n    Hardcoded API key detected\n    Location: config.json:12\n    Fix: Remove hardcoded credentials or use secure vault/environment variables\n    \n  [HIGH] Binding to all interfaces (0.0.0.0)\n    Binding to all interfaces (0.0.0.0)\n    Location: server.py:45\n    Fix: Restrict binding to specific interfaces only\n    \n  [MEDIUM] Debug logging may leak sensitive info\n    Debug logging may leak sensitive info\n    Location: main.py:8\n    Fix: Review logging and output to prevent sensitive data exposure\n    ...\n============================================================\n```\n\n## Configuration\n\nThe skill can be customized by modifying the patterns in `audit.py`:\n\n- `malware_patterns`: Regex patterns for detecting malicious code\n- `vulnerability_patterns`: Patterns for security vulnerabilities (credentials, bindings, etc.)\n- `compliance_patterns`: Patterns for compliance and data exposure issues\n\n## Requirements\n\n- Python 3.7+\n- No external dependencies (uses only standard library)\n\n## Security Notes\n\n- This skill is designed to be run in trusted environments\n- Always review findings carefully before making changes\n- Consider using in conjunction with other security tools (VirusTotal, Snyk, etc.)\n- For enterprise use, integrate with your CI/CD pipeline for continuous security monitoring\n\n## License\n\nMIT\n\n## Author\n\nlaosi (did:soul:laosi)\n\nFile v1.0.0:_meta.json\n\n{\n  \"ownerId\": \"kn71pk44ca87scz3pstt90r66n80xhaa\",\n  \"slug\": \"laosi-mcp-security-audit\",\n  \"version\": \"1.0.0\",\n  \"publishedAt\": 1777250590346\n}\n\nFile v1.0.0:skill-card.md\n\n## Description: <br>\nPerforms security audits on MCP servers and skills by scanning local files for vulnerability, malware, and compliance patterns, then reporting findings with remediation guidance. <br>\n\nThis skill is ready for commercial/non-commercial use. <br>\n\n## Publisher: <br>\n[534422530](https://clawhub.ai/user/534422530) <br>\n\n### License/Terms of Use: <br>\nMIT-0 <br>\n\n\n## Use Case: <br>\nDevelopers and security engineers use this skill to audit MCP server or skill directories for risky code patterns, credential exposure, insecure bindings, and compliance issues before deployment or during review. <br>\n\n### Deployment Geography for Use: <br>\nGlobal <br>\n\n## Known Risks and Mitigations: <br>\nRisk: The scanner reads user-selected directories that may contain .env files, credentials, or sensitive configuration. <br>\nMitigation: Run it only against intended local paths in a trusted environment and review the target directory before scanning. <br>\nRisk: Generated reports can expose sensitive file paths, line numbers, and locations of credentials or risky code. <br>\nMitigation: Review and redact reports before sharing them outside the team or attaching them to public issues. <br>\nRisk: Pattern-based findings can be false positives or miss issues outside the configured rules. <br>\nMitigation: Treat results as triage guidance and confirm important findings with code review or additional security tools. <br>\n\n\n## Reference(s): <br>\n- [ClawHub skill page](https://clawhub.ai/534422530/laosi-mcp-security-audit) <br>\n- [Artifact README](artifact/README.md) <br>\n\n\n## Skill Output: <br>\n**Output Type(s):** [text, JSON, guidance] <br>\n**Output Format:** [JSON reports and console text with severity summaries, findings, scores, grades, and remediation guidance] <br>\n**Output Parameters:** [1D] <br>\n**Other Properties Related to Output:** [Reports may include file paths, line numbers, and descriptions of possible credential or risky-code locations.] <br>\n\n## Skill Version(s): <br>\n1.0.0 (source: server release evidence and artifact metadata) <br>\n\n## Ethical Considerations: <br>\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment. <br>\n\nFile v1.0.0:claw.json\n\n{\n  \"name\": \"laosi-mcp-security-audit\",\n  \"displayName\": \"LAOSI MCP Security Audit\",\n  \"description\": \"Enterprise-grade MCP server security audit for OpenClaw agents - scans for vulnerabilities, malware, and compliance issues\",\n  \"version\": \"1.0.0\",\n  \"author\": \"laosi\",\n  \"homepage\": \"https://github.com/laosi/mcp-security-audit-skill\",\n  \"license\": \"MIT\",\n  \"keywords\": [\"security\", \"mcp\", \"audit\", \"enterprise\", \"compliance\", \"vulnerability\", \"malware\"],\n  \"category\": \"security\",\n  \"engines\": {\n    \"openclaw\": \">=1.0.0\"\n  },\n  \"scripts\": {\n    \"audit\": \"python mcp_security_audit.py\"\n  },\n  \"files\": [\n    \"SKILL.md\",\n    \"README.md\",\n    \"claw.json\",\n    \"audit.py\",\n    \"mcp_security_audit.py\"\n  ]\n}","readmeExcerpt":"Skill: Laosi Mcp Security Audit Owner: 534422530 Summary: Performs comprehensive security audits on MCP servers including vulnerability scans, malware detection, compliance checks, and detailed remediation reports. Tags: latest:1.0.1 Version history: v1.0.1 | 2026-06-01T07:14:01.631Z | auto - Added _meta.json file for enhanced metadata support. - Removed skill-card.md to streamline documentation files. v1.0.0 | 2026-","codeSnippets":[],"executableExamples":[{"language":"bash","snippet":"clawhub install mcp-security-audit"},{"language":"bash","snippet":"# Audit an MCP server directory\nmcp-security-audit ./mcp_server\n\n# Audit a skill directory\nmcp-security-audit ./my-skill"},{"language":"bash","snippet":"python audit.py /path/to/mcp/server"},{"language":"text","snippet":"============================================================\nMCP SECURITY AUDIT REPORT\n============================================================\nPath: ./mcp_server\nScore: 85/100\nGrade: B\n------------------------------------------------------------\nSummary:\n  Critical: 0\n  High: 2\n  Medium: 5\n  Low: 3\n  Info: 0\n------------------------------------------------------------\nRecommendations:\n  ⚠️ HIGH: Fix high severity vulnerabilities soon\n  🔑 CREDENTIALS: Remove hardcoded credentials, use environment variables or vault\n  🌐 NETWORK: Restrict binding to specific interfaces only\n------------------------------------------------------------\nDetailed Findings:\n  [HIGH] Hardcoded API key detected\n    Hardcoded API key detected\n    Location: config.json:12\n    Fix: Remove hardcoded credentials or use secure vault/environment variables\n    \n  [HIGH] Binding to all interfaces (0.0.0.0)\n    Binding to all interfaces (0.0.0.0)\n    Location: server.py:45\n    Fix: Restrict binding to specific interfaces only\n    \n  [MEDIUM] Debug logging may leak sensitive info\n    Debug logging may leak sensitive info\n    Location: main.py:8\n    Fix: Review logging and output to prevent sensitive data exposure\n    ...\n============================================================"},{"language":"bash","snippet":"clawhub install mcp-security-audit"},{"language":"bash","snippet":"# Audit an MCP server directory\nmcp-security-audit ./mcp_server\n\n# Audit a skill directory\nmcp-security-audit ./my-skill"}],"parameters":null,"dependencies":[],"permissions":[],"extractedFiles":[{"path":"SKILL.md","content":"name: laosi-mcp-security-audit\nversion: 1.0.0\ndescription: Enterprise-grade MCP server security audit skill for OpenClaw agents - performs comprehensive vulnerability scanning, malware detection, and compliance checking on MCP servers and skills with detailed reporting and remediation guidance\nauthor: laosi\nhomepage: https://github.com/laosi/mcp-security-audit-skill\ntags: [security, mcp, audit, enterprise, compliance, vulnerability-scanning, malware-detection]"},{"path":"README.md","content":"# MCP Security Audit Skill\n\nAn OpenClaw skill for performing enterprise-grade security audits on MCP (Model Context Protocol) servers and skills.\n\n## Features\n\n- 🔍 **Vulnerability Scanning**: Detects hardcoded credentials, insecure bindings, and common vulnerabilities\n- 🛡️ **Malware Detection**: Identifies suspicious patterns like eval/exec, shell injection, and potential backdoors\n- 📋 **Compliance Checking**: Flags logging and output issues that could lead to data exposure\n- 📊 **Security Scoring**: Provides a 0-100 score with letter grade (A+ to F)\n- 📝 **Detailed Reports**: Line-by-line findings with remediation guidance\n- 🚨 **Severity Levels**: Critical, High, Medium, Low, Info classifications\n- 🎯 **Actionable Recommendations**: Prioritized fixes based on risk level\n\n## Installation\n\n```bash\nclawhub install mcp-security-audit\n```\n\n## Usage\n\n### Basic Audit\n\n```bash\n# Audit an MCP server directory\nmcp-security-audit ./mcp_server\n\n# Audit a skill directory\nmcp-security-audit ./my-skill\n```\n\n### With Custom Path\n\n```bash\npython audit.py /path/to/mcp/server\n```\n\n## Output Example\n\n```\n============================================================\nMCP SECURITY AUDIT REPORT\n============================================================\nPath: ./mcp_server\nScore: 85/100\nGrade: B\n------------------------------------------------------------\nSummary:\n  Critical: 0\n  High: 2\n  Medium: 5\n  Low: 3\n  Info: 0\n------------------------------------------------------------\nRecommendations:\n  ⚠️ HIGH: Fix high severity vulnerabilities soon\n  🔑 CREDENTIALS: Remove hardcoded credentials, use environment variables or vault\n  🌐 NETWORK: Restrict binding to specific interfaces only\n------------------------------------------------------------\nDetailed Findings:\n  [HIGH] Hardcoded API key detected\n    Hardcoded API key detected\n    Location: config.json:12\n    Fix: Remove hardcoded credentials or use secure vault/environment variables\n    \n  [HIGH] Binding to all interfaces (0.0.0.0)\n    Binding to all interfaces (0.0.0.0)\n    Location: server.py:45\n    Fix: Restrict binding to specific interfaces only\n    \n  [MEDIUM] Debug logging may leak sensitive info\n    Debug logging may leak sensitive info\n    Location: main.py:8\n    Fix: Review logging and output to prevent sensitive data exposure\n    ...\n============================================================\n```\n\n## Configuration\n\nThe skill can be customized by modifying the patterns in `audit.py`:\n\n- `malware_patterns`: Regex patterns for detecting malicious code\n- `vulnerability_patterns`: Patterns for security vulnerabilities (credentials, bindings, etc.)\n- `compliance_patterns`: Patterns for compliance and data exposure issues\n\n## Requirements\n\n- Python 3.7+\n- No external dependencies (uses only standard library)\n\n## Security Notes\n\n- This skill is designed to be run in trusted environments\n- Always review findings carefully before making changes\n- Consider using in conjunction with other security tools (VirusTotal"},{"path":"_meta.json","content":"{\n  \"ownerId\": \"kn71pk44ca87scz3pstt90r66n80xhaa\",\n  \"slug\": \"laosi-mcp-security-audit\",\n  \"version\": \"1.0.1\",\n  \"publishedAt\": 1780298041631\n}"},{"path":"skill-card.md","content":"## Description:\n\nPerforms comprehensive security audits on MCP servers including vulnerability scans, malware detection, compliance checks, and detailed remediation reports.\n\nThis skill is ready for commercial/non-commercial use.\n\n## Publisher:\n\n[534422530](https://clawhub.ai/user/534422530)\n\n### License/Terms of Use:\n\nMIT-0\n\n## Use Case:\n\nDevelopers and security reviewers use this skill to scan MCP server or skill directories for vulnerable patterns, suspicious code, compliance issues, and remediation guidance.\n\n### Deployment Geography for Use:\n\nGlobal\n\n## Known Risks and Mitigations:\n\nRisk: The scanner reads source and configuration files under the directory selected by the user, which may include sensitive project data.\n\nMitigation: Run it only against the specific MCP server or skill folder intended for audit, not a home directory or unrelated private workspace.\n\n## Reference(s):\n\n- [ClawHub skill page](https://clawhub.ai/534422530/skills/laosi-mcp-security-audit)\n- [Publisher profile](https://clawhub.ai/user/534422530)\n\n## Skill Output:\n\n**Output Type(s):** [text, markdown, code, shell commands, configuration, guidance]\n\n**Output Format:** [JSON reports and human-readable terminal summaries]\n\n**Output Parameters:** [1D]\n\n**Other Properties Related to Output:** [Includes severity counts, score, grade, detailed findings, and prioritized recommendations.]\n\n## Skill Version(s):\n\n1.0.1 (source: server release evidence)\n\n## Ethical Considerations:\n\nUsers should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment."},{"path":"claw.json","content":"{\n  \"name\": \"laosi-mcp-security-audit\",\n  \"displayName\": \"LAOSI MCP Security Audit\",\n  \"description\": \"Enterprise-grade MCP server security audit for OpenClaw agents - scans for vulnerabilities, malware, and compliance issues\",\n  \"version\": \"1.0.0\",\n  \"author\": \"laosi\",\n  \"homepage\": \"https://github.com/laosi/mcp-security-audit-skill\",\n  \"license\": \"MIT\",\n  \"keywords\": [\"security\", \"mcp\", \"audit\", \"enterprise\", \"compliance\", \"vulnerability\", \"malware\"],\n  \"category\": \"security\",\n  \"engines\": {\n    \"openclaw\": \">=1.0.0\"\n  },\n  \"scripts\": {\n    \"audit\": \"python mcp_security_audit.py\"\n  },\n  \"files\": [\n    \"SKILL.md\",\n    \"README.md\",\n    \"claw.json\",\n    \"audit.py\",\n    \"mcp_security_audit.py\"\n  ]\n}"}],"languages":[],"docsSourceLabel":"CLAWHUB","editorialOverview":"Performs comprehensive security audits on MCP servers including vulnerability scans, malware detection, compliance checks, and detailed remediation reports. Skill: Laosi Mcp Security Audit Owner: 534422530 Summary: Performs comprehensive security audits on MCP servers including vulnerability scans, malware detection, compliance checks, and detailed remediation reports. Tags: latest:1.0.1 Version history: v1.0.1 | 2026-06-01T07:14:01.631Z | auto - Added _meta.json file for enhanced metadata support. - Removed skill-card.md to streamline documentation files. v1.0.0 | 2026-","editorialQuality":{"score":100,"threshold":65,"status":"ready","wordCount":961,"uniquenessScore":50,"reasons":[]}},"media":{"evidence":{"source":"no-media","verified":false,"confidence":"low","updatedAt":"2026-10-11T19:28:58.991Z","emptyReason":"No screenshots, media assets, or demo links are available."},"primaryImageUrl":null,"mediaAssetCount":0,"assets":[],"demoUrl":null},"ownerResources":{"evidence":{"source":"unclaimed","verified":false,"confidence":"low","updatedAt":"2026-10-11T19:28:58.991Z","emptyReason":"This page has not been claimed by the agent owner."},"hasCustomPage":false,"customPageUpdatedAt":null,"customLinks":[],"structuredLinks":{"docsUrl":null,"demoUrl":null,"supportUrl":null,"pricingUrl":null,"statusUrl":null},"customPage":null},"relatedAgents":{"evidence":{"source":"protocol-neighbors","verified":false,"confidence":"medium","updatedAt":"2026-10-12T00:20:37.093Z","emptyReason":null},"items":[{"id":"8ebccd8e-3863-4187-8355-c3f14e1f9edf","entityType":"agent","canonicalPath":"/agent/iofficeai-aionui","slug":"iofficeai-aionui","name":"AionUi","description":"Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!","url":"https://github.com/iOfficeAI/AionUi","homepage":"https://www.aionui.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-10-09T19:11:12.944Z","createdAt":"2026-02-25T03:38:16.584Z","downloads":null},{"id":"b917f68a-ebff-438e-84f8-3f4b2494c0bc","entityType":"agent","canonicalPath":"/agent/activepieces-activepieces","slug":"activepieces-activepieces","name":"activepieces","description":"AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents","url":"https://github.com/activepieces/activepieces","homepage":"https://www.activepieces.com","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-15T02:22:12.426Z","createdAt":"2026-02-25T03:38:12.412Z","downloads":null},{"id":"5cb26759-3a39-483f-94cf-276a98c13bb8","entityType":"agent","canonicalPath":"/agent/cherryhq-cherry-studio","slug":"cherryhq-cherry-studio","name":"cherry-studio","description":"AI productivity studio with smart chat, autonomous agents, and 300+ assistants. Unified access to frontier LLMs","url":"https://github.com/CherryHQ/cherry-studio","homepage":"https://cherry-ai.com","source":"GITHUB_REPOS","protocols":["MCP","OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-04-11T14:38:40.986Z","createdAt":"2026-02-25T03:38:19.379Z","downloads":null},{"id":"6f6582d0-5d76-4f0f-b81d-86520247950b","entityType":"agent","canonicalPath":"/agent/copilotkit-copilotkit","slug":"copilotkit-copilotkit","name":"CopilotKit","description":"The Frontend for Agents & Generative UI. React + Angular","url":"https://github.com/CopilotKit/CopilotKit","homepage":"https://docs.copilotkit.ai","source":"GITHUB_REPOS","protocols":["OPENCLAW"],"capabilities":[],"safetyScore":100,"overallRank":70,"updatedAt":"2026-03-25T09:50:57.846Z","createdAt":"2026-02-25T03:39:14.617Z","downloads":null}],"links":{"hub":"/agent","source":"/agent/source/clawhub","protocols":[{"label":"OpenClaw","href":"/agent/protocol/openclew"}]}}}