ClawHub
Back to skill

Security audit

Classquill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ClassQuill read-only integration, but it asks users to handle a live API key in chat and optionally run an unpinned npm MCP server that would receive that key.

Install or use this only if you are comfortable granting read access to ClassQuill organization data. Prefer OAuth or a protected secret/environment-variable setup instead of pasting an ei_live key into chat, rotate any key shared accidentally, and avoid the local npx path unless you pin and review the package version or run it in a restricted environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:31
Finding

Unpinned npm Package Is Downloaded and Executed Automatically

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 31
Vulnerability Type: Untrusted and mutable third-party dependency execution
Risk Level: High

Complete Code Snippet:

bash
npx -y equateit-mcp        # stdio; set EQUATEIT_API_KEY=ei_live_…

Technical Analysis

The documented command uses npx -y to retrieve and execute equateit-mcp without user confirmation. It does not specify an exact version, verify package integrity, use a lockfile, or otherwise bind execution to an artifact that was reviewed with this skill.

Consequently, the effective executable payload can change independently of the reviewed repository. If the npm package, its dependencies, its publisher account, or the package distribution channel is compromised, following this instruction could execute attacker-controlled JavaScript with the privileges of the user running npx. The process is also expected to receive EQUATEIT_API_KEY, making that credential directly accessible to package code.

This finding identifies an unsafe supply-chain execution pattern. The audited file does not establish that the current package is malicious.

Attack Path

  1. An attacker compromises the package publisher, a transitive dependency, or the relevant package-distribution account.
  2. The attacker publishes a malicious release under the same package name.
  3. A user follows the skill instructions and runs npx -y equateit-mcp.
  4. Because no exact version or integrity value is specified, npx resolves and downloads the attacker-controlled release.
  5. The package executes locally without an interactive confirmation prompt.
  6. Malicious initialization or runtime code reads EQUATEIT_API_KEY, accesses files available to the current user, or makes arbitrary outbound network requests.
  7. The attacker can exfiltrate collected credentials or use them to query organization-scoped ClassQuill data.

Impact Assessment

Successful exploit ...[truncated 693 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to an exact, previously audited version rather than resolving the latest release, for example equateit-mcp@X.Y.Z.
  • Distribute and use a lockfile containing integrity hashes when integrating the package into a managed installation.
  • Verify the package publisher, official npm package URL, signatures or provenance attestations, and expected integrity digest before execution.
  • Review direct and transitive dependencies and use automated supply-chain monitoring for newly disclosed compromises.
  • Avoid -y for security-sensitive first-time execution so unexpected installation behavior requires explicit approval.
  • Prefer a locally installed, reviewed dependency over runtime package retrieval.
  • Execute the MCP server in a restricted environment with minimal filesystem permissions, a constrained network policy, and only the required API credential.
  • Scope and rotate API keys where supported, and ensure package logs cannot disclose the credential.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:49
Finding

Instructions Request a Live API Key Through the Conversation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-50
Vulnerability Type: Unsafe handling of a live bearer credential
Risk Level: High

Complete Code Snippet:

text
- If a key is missing or invalid, ask the user to create/paste an `ei_live_…` key from
  ClassQuill → Settings → Developers.

Technical Analysis

The skill explicitly instructs the agent to ask the user to paste a live API key. Entering a bearer credential into a conversational channel may expose it to message history, application logs, model context, telemetry, debugging systems, connected tools, or users with access to the transcript.

Bearer credentials do not require separate proof of possession. Any party that obtains the complete key may attempt to authenticate to the hosted MCP server or ClassQuill API as the key holder until the credential expires or is revoked. This creates avoidable credential exposure even though the key itself is not hardcoded in the repository.

Attack Path

  1. The ClassQuill key is absent or rejected.
  2. Following the skill instruction, the agent asks the user to create or paste an ei_live_… key into the conversation.
  3. The user submits the live bearer credential as message content.
  4. The credential is retained or propagated through one or more systems that process or store the conversation, such as logs, transcript history, telemetry, model context, or connected integrations.
  5. An unauthorized party with access to one of those systems obtains the key.
  6. That party presents the bearer token to the ClassQuill MCP endpoint or public API.
  7. If the key remains valid, the party retrieves data available within the associated organization scope.

Impact Assessment

Exposure may grant unauthorized read access under the compromised key's organization scope. The documented accessible data includes schedules and sessions, students, tutors, parents, availability, invoices, payments, balanc ...[truncated 440 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the instruction to paste API keys into conversational messages.
  • Direct users to configure EQUATEIT_API_KEY through the client's protected secret store, credential prompt, or environment-variable configuration mechanism.
  • Prefer OAuth authorization when the client supports it, using narrowly scoped and revocable grants.
  • Ensure credentials are never reproduced in responses, command output, diagnostics, telemetry, or logs.
  • Add automatic redaction for the ei_live_… token pattern across transcript and logging systems.
  • Use least-privilege, organization-scoped credentials with expiration where supported.
  • Provide explicit instructions to revoke and rotate any key accidentally submitted through chat.
  • Document secure credential verification that reports only whether configuration succeeded, without displaying any part of the secret beyond a safely masked identifier.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
ClassQuill is a tutoring-business-management platform (by EquateIt). This skill lets you
read a user's ClassQuill data through its MCP server, which proxies the public REST API
at `https://api.classquill.com/v1`.

## Connecting

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs users to run npx -y equateit-mcp without pinning a specific package version or integrity reference. This creates a supply-chain risk: if the npm package is updated maliciously, compromised, or a typo/package takeover occurs, users may execute unreviewed code that can access the configured EQUATEIT_API_KEY and local environment.

Content

No source excerpt is available for this finding.