gold_price_mcp

SAFE max severity MEDIUMSkillSpector Caution 18 registry clawhub.ai last scanned 1 scan

Verdict safe, but 2 findings (2 medium), mainly unauthorized tool use, data exfiltration. Most recent scan 2026-02-06.

This skill is a relatively straightforward MCP (Model Context Protocol) service that fetches Thai gold prices from an external API. The code quality is reasonable with proper async/await patterns and error handling. However, there are MEDIUM severity concerns around the external API dependency lacking validation and provenance documentation. The skill makes network calls to a third-party domain without any integrity verification, which could be exploited if the API is compromised. LOW severity issues include missing manifest metadata (license, compatibility, allowed-tools) and hardcoded Python version requirements. The skill does NOT contain prompt injection, data exfiltration to attacker-controlled servers, credential theft, or command injection vulnerabilities. The external API call is for legitimate data retrieval, not malicious exfiltration. Overall, this skill appears to be a legitimate utility with some security hygiene improvements needed around dependency management and metadata documentation.

Scanner's overall assessment (LLM analyzer)
Findings2
Critical0
High0
Medium2
Low0
Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 18
Score18 / 100
Issues5
CategoriesSupply Chain Data Exfiltration
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

ดึงราคาทองคำปัจจุบันจาก api กลางของประเทศไทย

Package
7 files, 6.9 KB
SKILL.md
0 words
Code
Python (2), Shell (1)
Allowed tools
name: mcp_gold_price_mc_get_thai_gold_price # เปลี่ยนจาก get_thai_gold_price
Requires
bins: python3.10

Findings

MEDIUM Undeclared network usage Unauthorized Tool Usestatic

Skill code uses network libraries but doesn't declare network requirement

Remediation: Declare network usage in compatibility field or remove network calls
MEDIUM External API Dependency Without Validation or Provenance Data Exfiltrationllm

The skill makes HTTP requests to an external third-party API (https://api.chnwt.dev/thai-gold-api/latest) without any validation of response integrity, HTTPS certificate pinning, or documented provenance. While the API appears to be for legitimate gold price data, there is no verification mechanism to ensure the data hasn't been tampered with or that the API endpoint remains trustworthy. An attacker who compromises the API domain or performs a man-in-the-middle attack could inject malicious data into the agent's context.

gold-price-mcp.py:17

API_URL = "https://api.chnwt.dev/thai-gold-api/latest"
Remediation: 1. Document the API provenance and ownership in the manifest. 2. Implement response validation (schema checking, signature verification if available). 3. Add error handling for unexpected response formats. 4. Consider adding rate limiting to prevent abuse. 5. Document the external dependency clearly in the description field.

What is in the package

FileKindSize
SKILL.mddoc531 B
claude_desktop_config.jsonconfig243 B
gold-price-mcp.pyscript3.6 KB
readme.mddoc53 B
requirements.txtdoc17 B
run.shscript204 B
test_api.pyscript2.3 KB

External hosts referenced

api.chnwt.dev

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills