T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:149- Finding
OAuth Authentication Tokens Exposed to Browser JavaScript
- Content
View full analysis
- Remediation
View remediation
Security audit
Twenty CRM OAuth Mastery
Security checks for vulnerabilities and agentic risk
Overview
This OAuth troubleshooting skill is coherent, but it gives unsafe token-handling guidance that could expose user sessions and OAuth credentials.
Review before installing. The skill may be useful as Twenty CRM OAuth debugging notes, but do not follow its token transport recommendations as written. Keep OAuth/session tokens out of JavaScript-readable cookies and URLs, avoid printing secrets during troubleshooting, pin package versions where possible, and treat database/container commands as production changes requiring backup and change control.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:237- Finding
Authentication Token Pair Transported Through a URL
- Content
View full analysis
{ const tokenPairFromUrl = getAuthPairFromUrl(); if (tokenPairFromUrl) { const tokenSignature = JSON.stringify(tokenPairFromUrl); // 🔴 CRITICAL: Skip if already processed if (processedTokenSignatures.current.has(tokenSignature)) { return; } // Track this signature processedTokenSignatures.current.add(tokenSignature); // Now process the token setAuthTokens(tokenPairFromUrl); } }, []); ``` ### Technical Analysis The documented frontend flow obtains an authentication token pair directly from the page URL and installs it as the application's active authentication state. URLs are not suitable containers for access tokens or refresh tokens. Depending on whether the values are placed in the query string or fragment and on the surrounding infrastructure, sensitive URL data may be retained in browser history, screenshots, bookmarks, analytics systems, reverse-proxy or application logs, error reports, copied links, and support records. Query-string data can also be disclosed through referrer headers unless a restrictive referrer policy is applied. Tracking the token signature prevents repeated frontend processing but does not protect token confidentiality, prevent replay by another party, or remove copies from history and infrastructure logs. ### Attack Path 1. The OAuth callback places the authentication token pair in the redirect URL. 2. The browser loads the URL and the frontend extracts the tokens using `getAuthPairFromUrl()`. 3. The full URL or its sensitive parameters are retained by browser history, logging, monitoring, analytics, or support tooling. 4. An attacker with access to one of those records obtains the token pair. 5. The attacker replays the acc ...[truncated 587 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:477- Finding
Troubleshooting Command Discloses OAuth Client Secrets
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly advises setting the auth token cookie with
httpOnly: falseso frontend JavaScript can read it. This materially weakens token confidentiality: any XSS, third-party script compromise, or browser extension with page access can steal bearer tokens and take over user sessions. Because the skill presents itself as OAuth best-practices guidance, this recommendation is more dangerous, as readers may trust and propagate an insecure pattern.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The markdown directly recommends making the
tokenPaircookie readable by JavaScript without any warning about XSS or token theft risk. Exposing access or refresh tokens to the browser runtime sharply increases the attack surface and can enable account compromise, API abuse, and persistent unauthorized access if refresh tokens are included.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README recommends
httpOnly: falseas a quick fix for a 'Cookie Not Readable' issue without any security warning or safer alternative. Making authentication or token-bearing cookies readable by frontend JavaScript significantly increases exposure to token theft through XSS, browser extensions, or injected third-party scripts, and the skill context makes this more dangerous because it is explicitly about OAuth token handling and sync integration.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The markdown instructs users to run a direct
INSERTinto theworkspaceMetadatatable and elsewhere advises container rebuild/restart actions, which can affect production data and service availability. The document does not provide explicit cautions about backing up data, verifying environment, or avoiding execution in production without change control.- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md #### Issue 4: Frontend Token Processing Loop **Symptoms**: `SignInUpGlobalScopeFormEffect` runs repeatedly, infinite API calls **Root Cause**: Same token processed multiple times
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:92