ClawHub
Back to skill

Security audit

Miro MCP Integration

Security checks for vulnerabilities and agentic risk

Overview

This is a Miro integration guide that openly explains OAuth-based board read and write access, with some practical setup cautions users should review.

Before installing, confirm you want the connected agent to read and write Miro boards in the selected team. Use least-privilege scopes where your client allows it, avoid sensitive production boards unless approved, keep auto-approval disabled for write tools, and treat the optional global npm Inspector install as a debugging-only step best run locally pinned or isolated.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/mcp-connection.md:220
Finding

Unpinned Global npm Package Installation

Content
View full analysis

Vulnerability Details

File Location: references/mcp-connection.md, lines 220-227
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

bash
# Install MCP Inspector
npm install -g @modelcontextprotocol/inspector

# Start inspector (connects to your MCP server)
mcp-inspector https://mcp.miro.com/

Technical Analysis

The documentation directs users to install the latest available version of @modelcontextprotocol/inspector globally. No exact version, lockfile, or integrity verification is specified.

npm installations may execute package lifecycle scripts. If the package, one of its transitive dependencies, or its publication channel is compromised, installation can execute attacker-controlled code with the privileges of the user running npm. The -g option also modifies the user's global npm environment rather than containing the optional debugging utility within the project.

MCP Inspector is an optional diagnostic tool and is not necessary for the Skill's primary Miro integration functionality. Consequently, a mutable global dependency introduces supply-chain exposure and system modification beyond the minimum required privileges.

Attack Path

  1. An attacker compromises the npm package, a transitive dependency, a maintainer account, or the package publication process.
  2. The attacker publishes a malicious release or dependency update containing an installation lifecycle script or malicious executable.
  3. A user follows the Skill documentation and runs npm install -g @modelcontextprotocol/inspector.
  4. npm resolves the unpinned dependency to the compromised release.
  5. Malicious lifecycle code executes under the installing user's account, or the globally installed mcp-inspector executable performs malicious actions when invoked.
  6. The payload can access resources available to that user and alter files in user-writable global ...[truncated 870 chars]
Remediation
View remediation

Remediation Suggestions

  1. Clearly label MCP Inspector as optional and unnecessary for normal Miro MCP operation.
  2. Pin the dependency to an explicitly reviewed version rather than resolving the mutable latest release:
    bash
    npm install --save-dev @modelcontextprotocol/inspector@<reviewed-version>
  3. Prefer a project-local installation with a committed lockfile over npm install -g.
  4. Run the utility through the local package executable, such as npm exec, after verifying the locked dependency tree.
  5. Review package provenance, maintainers, release history, lifecycle scripts, and transitive dependencies before recommending a version.
  6. Use npm integrity metadata and automated dependency scanning to detect unexpected package changes.
  7. For higher-assurance environments, execute the diagnostic tool in a disposable container or similarly isolated environment with no credentials and only the network access required to reach https://mcp.miro.com/.
  8. Avoid running installation commands with sudo or from an administrator shell.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (29)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/best-practices.md (reported line 131)May include surrounding context.

Result: ❌ 401 Unauthorized - Token Expired

text

**Cause:** OAuth access token has expired (typically after 1 hour).

**Solution:**
- Client will automatically use refresh token to get new access token

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/best-practices.md (reported line 134)May include surrounding context.

Result: ❌ 401 Unauthorized - Token Expired

text

**Cause:** OAuth access token has expired (typically after 1 hour).

**Solution:**
- Client will automatically use refresh token to get new access token

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/best-practices.md (reported line 309)May include surrounding context.

md
### Token Management

- **Never store access tokens** in code or version control
- **Let your client handle token refresh** — don't manage tokens manually
- **Re-authenticate periodically** if using for long sessions
- **Use PKCE** (Proof Key for Public Clients) when available

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 94)May include surrounding context.

md
### Step 5: Token Exchange
Your client exchanges the authorization code for tokens via a server-to-server request:
- Sends: `code`, `client_id`, `client_secret`, `redirect_uri`
- Receives: `access_token` (for API calls), `refresh_token` (for obtaining new access tokens)

### Step 6: Board Access
Your agent is now authenticated. API calls include the `access_token`:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-connection.md (reported line 134)May include surrounding context.

md
- **Per-user authentication** — Each agent connection is authenticated as a specific user
- **No static API keys** — Dynamic client registration means no long-lived credentials to store or rotate
- **Scope minimization** — Agent requests only necessary permissions (e.g., `boards:read`, `boards:write`)
- **Token expiry** — Access tokens expire; refresh tokens are used to obtain new ones without re-authentication

### Authorization & Permissions

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/mcp-overview.md (reported line 63)May include surrounding context.

md
- **Per-user authentication** — Each agent connection is authenticated as a specific user
- **No static API keys** — Dynamic client registration means no long-lived credentials to store or rotate
- **Scope minimization** — Agent requests only necessary permissions (e.g., `boards:read`, `boards:write`)
- **Token expiry** — Access tokens expire; refresh tokens are used to obtain new ones without re-authentication

### Authorization & Permissions

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description is broad enough to trigger on generic brainstorming, visualization, architecture, and design-workflow requests, not just clearly Miro-specific tasks. That increases the chance an agent invokes a board-connected skill unnecessarily, causing unintended data access or writes to an external SaaS.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly says agents can read from and write to Miro boards, but it does not prominently warn that using the skill may access workspace content and modify remote data. Without that disclosure, users may not realize sensitive board data could be transmitted to or altered in Miro during routine agent use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

Use OAuth 2.1 Bearer tokens:

bash
curl -H "Authorization: Bearer $ACCESS_TOKEN" https://api.miro.com/v2/...

Tokens obtained via OAuth flow (see OAuth setup in SKILL.md), valid for defined scope.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

Use OAuth 2.1 Bearer tokens:

bash
curl -H "Authorization: Bearer $ACCESS_TOKEN" https://api.miro.com/v2/...

Tokens obtained via OAuth flow (see OAuth setup in SKILL.md), valid for defined scope.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

Use OAuth 2.1 Bearer tokens:

bash
curl -H "Authorization: Bearer $ACCESS_TOKEN" https://api.miro.com/v2/...

Tokens obtained via OAuth flow (see OAuth setup in SKILL.md), valid for defined scope.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

Use OAuth 2.1 Bearer tokens:

bash
curl -H "Authorization: Bearer $ACCESS_TOKEN" https://api.miro.com/v2/...

Tokens obtained via OAuth flow (see OAuth setup in SKILL.md), valid for defined scope.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

Use OAuth 2.1 Bearer tokens:

bash
curl -H "Authorization: Bearer $ACCESS_TOKEN" https://api.miro.com/v2/...

Tokens obtained via OAuth flow (see OAuth setup in SKILL.md), valid for defined scope.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

Use OAuth 2.1 Bearer tokens:

bash
curl -H "Authorization: Bearer $ACCESS_TOKEN" https://api.miro.com/v2/...

Tokens obtained via OAuth flow (see OAuth setup in SKILL.md), valid for defined scope.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

Use OAuth 2.1 Bearer tokens:

bash
curl -H "Authorization: Bearer $ACCESS_TOKEN" https://api.miro.com/v2/...

Tokens obtained via OAuth flow (see OAuth setup in SKILL.md), valid for defined scope.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

Correct nested structure (discovered via Phase B testing):

bash
curl -X POST https://api.miro.com/v2/boards/{board_id}/shapes \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

bash
# Create section background
curl -X POST https://api.miro.com/v2/boards/$BOARD_ID/shapes \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d "{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guide encourages connecting third-party AI coding tools to Miro and pasting board URLs, but it does not warn that board content may be transmitted to external AI providers or exposed through their retention, logging, or model-improvement pipelines. In this context, users may reasonably infer that sharing a board URL is routine and safe, which increases the chance of accidental disclosure of sensitive project, customer, or architectural data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The examples instruct users to create diagrams or add generated content directly to shared Miro boards without warning that the connected AI tool has write capability and may alter collaborative content. That omission can lead to unintended modifications, overwrites, or placement of inaccurate/generated artifacts on production boards used by teams.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

This text explicitly states that some clients allow auto-approving specific tools, but it does not include guardrails about the risks of allowing write-capable or data-exfiltrating tools to run without user confirmation. In a skill whose purpose is broad integration with many AI clients, that omission is meaningful because users may copy the guidance into environments where autonomous tool execution can affect shared boards or sensitive data.

Content

Scanner excerpt · references/ai-coding-tools.md (reported line 291)May include surrounding context.

md
**Fields:**
- `url`: Always `https://mcp.miro.com/` (Miro's hosted MCP server)
- `disabled`: Set to `false` to enable; `true` to temporarily disable
- `autoApprove`: Leave empty `[]` for standard OAuth flow; some clients allow auto-approving specific tools here

## Common Setup Issues

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
"miro-mcp": {
      "url": "https://mcp.miro.com/",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/ai-coding-tools.md (reported line 76)May include surrounding context.

md
"miro-mcp": {
      "url": "https://mcp.miro.com/",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/ai-coding-tools.md (reported line 178)May include surrounding context.

md
"miro-mcp": {
      "url": "https://mcp.miro.com/",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/ai-coding-tools.md (reported line 282)May include surrounding context.

md
"miro-mcp": {
      "url": "https://mcp.miro.com/",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/mcp-connection.md (reported line 35)May include surrounding context.

md
"miro-mcp": {
      "url": "https://mcp.miro.com/",
      "disabled": false,
      "autoApprove": []
    }
  }
}

Static analysis

No suspicious patterns detected.