cerbug45-agent-crypto-message

clawhub:cerbug45-agent-crypto-message

View source

85/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

Score

85/100

HIGH 1

LOW 1

Findings (2)

HIGH

Private data read with public output TOXIC_001

toxic-flow L216

Skill can read private data (credentials, SSH keys, env vars) AND write to public channels (Slack, Discord, email). This combination enables data exfiltration.

[reads_private_data] load

def sign_message(private_key + [writes_public_output] Send message to all channel

FIX

Break the toxic data flow by adding validation and sanitization between the input source and the sensitive operation. Do not pass untrusted data directly to file system, network, or execution APIs.

FP?

Likely FP if the data flow involves only trusted, hardcoded values and the taint analysis over-approximated the untrusted input sources.

LOW

Cross-tool data leakage MCP_007

mcp-attack L216

Detects patterns where credential or secret reads are combined with external data transmission

load

def sign_message(private_key + Send to data

FIX

Prevent credentials and sensitive data obtained by one MCP tool from being passed to other tools. Implement data isolation between tools and restrict cross-tool data flow for secrets.

FP?

Likely FP if the cross-tool data flow is intentional API authentication (e.g., a tool fetches an auth token that another tool uses for the same service).