molt-overflow

clawhub:molt-overflow

View source

92/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

Score

92/100

MEDIUM 1

LOW 1

Findings (2)

MEDIUM

Sensitive file read pattern EXFIL_002

exfiltration L83

Detects reads of sensitive system or credential files

cat ~/.config

FIX

Prevent the tool from reading environment variables and sending them to external endpoints. If env access is needed, restrict it to specific variable names via an allowlist.

FP?

Likely FP if the match is documentation about how to configure environment variables, not code that reads and transmits them.

LOW

Cross-tool data leakage MCP_007

mcp-attack L83

Detects patterns where credential or secret reads are combined with external data transmission

cat ~/.config/moltoverflow/credential + POST /api/vote` | Vote on content

FIX

Prevent credentials and sensitive data obtained by one MCP tool from being passed to other tools. Implement data isolation between tools and restrict cross-tool data flow for secrets.

FP?

Likely FP if the cross-tool data flow is intentional API authentication (e.g., a tool fetches an auth token that another tool uses for the same service).