ClawHub
Back to skill

Security audit

Scalekit Agent Auth

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate Scalekit integration, but it gives an agent broad access to connected services and includes a command that can reveal raw OAuth tokens.

Install only if you intend this agent to operate across the Scalekit services you connect. Use least-privilege Scalekit credentials, connect only necessary providers, avoid logging command output, never use --get-authorization in agent workflows, and require explicit approval before proxy requests, file transfers, sends, deletes, or other mutating actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill exposes network access and environment-backed credentials but does not declare explicit permissions or constraints. In a general-purpose executor that can contact many third-party services, this weakens guardrails and increases the chance of unintended data access or outbound actions without clear policy boundaries.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented behavior goes beyond a normal end-user skill and includes administrative capabilities such as listing all connections, proxying arbitrary HTTP requests, and references to raw OAuth token inspection. This mismatch is dangerous because agents or users may invoke a seemingly ordinary integration skill while actually granting a broad control plane over connected services and sensitive authentication state.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The skill exposes raw OAuth access and refresh tokens via the get_authorization command and prints them directly to stdout. This exceeds the stated purpose of tool discovery and execution, and creates a credential-theft primitive that can enable full account takeover or offline reuse of third-party access outside Scalekit controls.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill can enumerate all configured environment connections, including provider and key metadata, which is broader than the advertised end-user tool-execution function. This expands discovery of internal integrations and can help an attacker map available services and target valuable connected accounts.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The invocation guidance is extremely broad, instructing activation for essentially any request involving an external service or data source. In an agent setting, this can cause over-triggering of a powerful skill that performs real third-party actions, increasing the chance of unintended data access, message sending, or API calls without sufficiently narrow user intent checks.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The README describes authorization, tool execution, and direct proxied API fallback, but it does not warn users that the skill may access third-party data or perform external actions on their behalf. Without an explicit warning and consent model, users and integrators may unknowingly enable a capability that can send data externally, mutate resources, or invoke broad API access through fallback behavior.

Vague Triggers

High
Confidence
94% confidence
Finding
The trigger criteria are extremely broad and effectively route almost any request involving an external service into this powerful executor. Because the skill can read, write, message, query, and proxy requests across many providers, over-invocation materially raises the risk of unintended external actions and data exposure.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The description encourages broad third-party actions on the user's behalf but does not clearly warn that the skill may access external accounts, send data off-platform, or mutate remote state. Users and orchestrators may therefore underestimate the sensitivity of invoking it.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The proxy fallback permits direct HTTP requests to provider APIs with custom paths, methods, headers, query parameters, and bodies, yet the instructions do not require a clear safety warning or approval step before using this more dangerous path. This effectively creates a generic API client that can bypass the narrower semantics of predefined tools.

Missing User Warnings

High
Confidence
99% confidence
Finding
Printing access and refresh tokens to stdout exposes credentials to terminal history, logs, transcripts, orchestration layers, and any downstream observer of command output. In an agent skill context this is especially dangerous because outputs may be persisted or surfaced back to users, turning secret material into recoverable text.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The proxy_request path can write arbitrary response content to any caller-supplied local file path. In a skill capable of interacting with external services, this can overwrite sensitive local files or place attacker-controlled content on disk if the path is influenced by an untrusted request.

Credential Access

High
Category
Privilege Escalation
Content
refresh_token = tokens["refresh_token"]

        print(f"{GREEN}✅ Tokens retrieved:{RESET}")
        print(f"   Access Token:  {access_token}")
        print(f"   Refresh Token: {refresh_token}")

    except KeyError as e:
Confidence
99% confidence
Finding
Access Token

Known Vulnerable Dependency: protobuf — 9 advisory(ies): CVE-2026-0994 (protobuf affected by a JSON recursion depth bypass); CVE-2022-1941 (protobuf-cpp and protobuf-python have potential Denial of Service issue); CVE-2025-4565 (protobuf-python has a potential Denial of Service issue) +6 more

High
Category
Supply Chain
Confidence
89% confidence
Finding
protobuf

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
76% confidence
Finding
python-dotenv

Known Vulnerable Dependency: pytest — 2 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)

High
Category
Supply Chain
Confidence
73% confidence
Finding
pytest

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.