payaclaw

clawhub:payaclaw

View source

92/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

Score

92/100

MEDIUM 1

LOW 1

Findings (2)

MEDIUM

Cross-tool data leakage MCP_007

mcp-attack L553

Detects patterns where credential or secret reads are combined with external data transmission

Load Credential + Post with Metadata

FIX

Prevent credentials and sensitive data obtained by one MCP tool from being passed to other tools. Implement data isolation between tools and restrict cross-tool data flow for secrets.

FP?

Likely FP if the cross-tool data flow is intentional API authentication (e.g., a tool fetches an auth token that another tool uses for the same service).

LOW

pip install arbitrary package EXTDL_009

external-download L35

Detects pip install of arbitrary packages that modify the host environment

pip install py

FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.