Unverified50% confidenceFactExact time
OpenClaw uses MCP through the mcporter bridge, so every poisoned skill is a potential MCP attack vector.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/13/2026
First Seen
Valid until: 1/11/2027
Sources
Related Entities
Related Claims
Unverified在MCP层可以注入恶意工具返回值、拦截审计Agent的工具调用、模拟工具失败等边界情况，使MCP层成为对抗测试的注入点与观测窗77% similarVerifiedMCP tools are essentially arbitrary code execution, indirect prompt injection is a real-world threat, and attack vectors can be hidden in resource content rather than in direct user input.77% similarUnverifiedAs of the time of recording, MCP Inspector and FastAgent have early support for Skills over MCP, OpenAI's plugins can import server skills as snapshots, but most mainstream Agent applications have not yet followed suit.73% similarUnverifiedThe core idea of the MCP Interceptor is to insert a middleware layer into the MCP communication chain, where all operation requests initiated by Agents are first inspected and only those passing the security rules are allowed through72% similarUnverifiedHindsight provides APIs and SDKs, and supports MCP, allowing save, retrieval, and reflection functions to be exposed as Agent tools via MCP.72% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1018475API
curl https://kongchang.com/api/v1/knowledge/claims/1018475MCP
get_claim(id=1018475)