mixtiles-it

clawhub:mixtiles-it

View source
C
67/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

2

Score

67/100

CRITICAL 1
MEDIUM 1

Findings (2)

CRITICAL
Instruction override combined with dangerous operations
L1

Instruction override combined with dangerous operations

MIXTILES_UPLOAD_KEY — Override the upload API key (Railway fallback)
FIX

Remove language that attempts to override safety guidelines or bypass system-level controls. This pattern is a strong indicator of a jailbreak attempt.

FP?

Likely FP if the matched text is in a security research document or educational content clearly marked as an example rather than an active payload.

MEDIUM
Cross-tool data leakage
L44

Detects patterns where credential or secret reads are combined with external data transmission

load API key + Send the result
FIX

Prevent credentials and sensitive data obtained by one MCP tool from being passed to other tools. Implement data isolation between tools and restrict cross-tool data flow for secrets.

FP?

Likely FP if the cross-tool data flow is intentional API authentication (e.g., a tool fetches an auth token that another tool uses for the same service).