Security audit

Motion Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Motion document-editing integration, but it asks users to grant and transmit workspace-wide document authority while documenting immediate and bulk mutation actions without strong confirmation guidance.

Install only if you trust the hosted Motion MCP service with the same level of access as a workspace administrator. Prefer document-scoped invite credentials when possible, avoid pasting real tokens directly into shell commands or logs, revoke tokens promptly if exposed, and require explicit user confirmation before direct edits, deletion, page or folder moves, exports, or bulk suggestion accept/reject operations.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:30
Finding: Workspace-Wide Authentication Tokens Exposed Through Command-Line Arguments
Content: View full analysis
Vulnerability Details

File Locations:

SKILL.md, lines 30-32

SKILL.md, lines 40-42

references/examples.md, lines 10-18

references/examples.md, lines 36-39

Vulnerability Type: Bearer credential exposure through shell command history and process arguments
Risk Level: Medium

Vulnerable Code

SKILL.md, lines 30-32:

bash
curl -X POST https://motion-mcp-server.fly.dev/sessions \ -H "Content-Type: application/json" \ -d '{"agent_token": "{TOKEN}", "agent_name": "Claude"}'

SKILL.md, lines 40-42:

bash
curl -X POST https://motion-mcp-server.fly.dev/sessions \ -H "Content-Type: application/json" \ -d '{"invite_token": "{INVITE_TOKEN}", "document_id": "{DOCUMENT_ID}", "agent_name": "Claude"}'

references/examples.md, lines 10-18:

bash
curl -X POST $BASE/sessions \ -H "Content-Type: application/json" \ -d '{"agent_token": "YOUR_TOKEN", "agent_name": "Claude"}' # Or connect to a specific document immediately curl -X POST $BASE/sessions \ -H "Content-Type: application/json" \ -d '{"agent_token": "YOUR_TOKEN", "document_id": "DOC_ID", "agent_name": "Claude"}'

references/examples.md, lines 36-39:

bash
# Create workspace-only session curl -X POST $BASE/sessions \ -H "Content-Type: application/json" \ -d '{"agent_token": "YOUR_TOKEN", "agent_name": "Claude"}'

Technical Analysis

The documented workflows instruct users or agents to substitute authentication tokens directly into the JSON supplied through curl command-line arguments. Once a real token replaces the placeholder, the bearer credential may be retained in interactive shell history. It may also be temporarily exposed through operating-system process inspection, terminal logging, command auditing, automation logs, or error-reporting systems that capture complete command lines.

The impact is amplified for agent tokens because SKILL.md states ...[truncated 2083 chars]
Remediation: View remediation
Remediation Suggestions

Do not place bearer credentials directly in command-line arguments or literal example commands.

Retrieve tokens from a protected credential manager or prompt for them without terminal echo.

Construct the request body outside the visible command line and pass it to curl through standard input or a permission-restricted temporary file. If a temporary file is used, create it with mode 0600, avoid shared directories, and delete it immediately after use.

Prevent request bodies and authentication values from being emitted by shell tracing, verbose HTTP output, CI logs, or error diagnostics.

Add explicit warnings that tokens must not be pasted into shell history, source files, chat transcripts, or build configuration.

Prefer document-scoped invite credentials for single-document operations rather than workspace-wide agent tokens.

Introduce short-lived, narrowly scoped tokens where supported and require explicit confirmation before workspace-wide enumeration or destructive operations.

Document an immediate incident-response procedure: revoke an exposed token, terminate active sessions, issue a replacement, and review workspace activity for unauthorized access.

Update every duplicated example consistently so users are not directed back to the unsafe pattern by secondary reference files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/api-reference.md (reported line 53)May include surrounding context.
Disconnect

text
DELETE /sessions/:id

Response: { disconnected: true }

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: DELETE /sessions/:id/blocks/:block_id performs content deletion, and the API explicitly allows mode: "direct", which removes the block immediately. In an agent skill that edits user documents from tokens and invites, parameter misuse or prompt-driven invocation against the wrong block can cause irreversible content loss, especially if user intent is not revalidated.
Content: Scanner excerpt · references/api-reference.md (reported line 120)May include surrounding context.
Delete Block

text
DELETE /sessions/:id/blocks/:block_id

json
{ "mode": "suggest" }

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 87% confidence
Finding: DELETE /sessions/:id/pages/:page_id enables page deletion, even if soft-delete sends content to trash rather than hard-deleting it immediately. In this skill context, agents can list pages and operate across a workspace, so misuse of page identifiers or ambiguous user instructions could delete the wrong page and disrupt availability or collaboration.
Content: Scanner excerpt · references/api-reference.md (reported line 216)May include surrounding context.
Delete Page (soft-delete to trash)

text
DELETE /sessions/:id/pages/:page_id

Response: { deleted: true, page_id }

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: DELETE /sessions/:id/folders/:folder_id is a destructive organizational action that removes a folder and relocates its pages, potentially causing broad workspace disruption if the wrong folder ID is supplied. Because this skill supports workspace-wide page and folder management using powerful tokens, parameter abuse or mistaken targeting could impact many documents at once.
Content: Scanner excerpt · references/api-reference.md (reported line 270)May include surrounding context.
Delete Folder

text
DELETE /sessions/:id/folders/:folder_id

Pages in the deleted folder are moved to root level (folder_id set to null).

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly allows a "direct" editing mode that applies changes immediately to a live collaborative document, but it does not prominently warn that this bypasses review and can instantly alter shared content. In a real-time multi-user editing context, omission of that warning increases the chance of unintended destructive edits or social-engineering-driven misuse.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The skill instructs users to transmit a workspace-wide agent token to an external service endpoint in order to create a session. Even if this is the intended Motion MCP backend, the token grants full access to all documents in the workspace, so disclosure, misrouting, logging, or compromise of that endpoint could expose or enable modification of sensitive workspace data.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
full access to all documents in the workspace. The token is a 64-character hex string.

bash
curl -X POST https://motion-mcp-server.fly.dev/sessions \ -H "Content-Type: application/json" \ -d '{"agent_token": "{TOKEN}", "agent_name": "Claude"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill documents delete, rename, move, and restore operations for pages and folders without clear cautionary language about destructive consequences, scope, or the need for confirmation. Because the skill is workspace-scoped and can affect many documents, missing warnings can lead to accidental data loss, disruption, or unauthorized content changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The API reference exposes destructive direct edit modes for replace, update, delete, and find/replace operations without any accompanying warning, confirmation guidance, or recommendation to prefer non-destructive suggestion mode for untrusted or user-requested edits. In an agent skill context, this increases the chance an LLM or integrator will apply irreversible document changes immediately, causing accidental content loss or unauthorized modifications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The bulk suggestion accept-all and reject-all endpoints can trigger large-scale document changes, but the reference gives no warning about mass modification risk, lack of granular review, or need for explicit approval. In a collaborative editing skill, an agent could unintentionally approve or discard many edits at once, leading to major integrity issues in shared documents.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/examples.md (reported line 10)May include surrounding context.
bash
# Create workspace-only session with agent token curl -X POST $BASE/sessions \ -H "Content-Type: application/json" \ -d '{"agent_token": "YOUR_TOKEN", "agent_name": "Claude"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file includes examples for editing shared documents and notes that passing "mode": "direct" will apply changes immediately, but it does not include a clear caution about the user-data impact of direct edits. Under the markdown-file criteria, behaviors that can affect user data should be accompanied by warnings so users understand the risk before using them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation includes an accept-all suggestions endpoint without any warning that it can trigger large-scale, potentially irreversible document modifications. In an agent setting, this increases the chance that an automated workflow applies many pending changes without granular review or explicit user approval.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

Tool Parameter Abuse

Disconnect

Tool Parameter Abuse

Delete Block

Tool Parameter Abuse

Delete Page (soft-delete to trash)

Tool Parameter Abuse

Delete Folder

Missing User Warnings

External Transmission

Missing User Warnings

Missing User Warnings

Missing User Warnings

External Transmission

Missing User Warnings

Missing User Warnings