eve-esi

• Outcome: Pass
• Latest audit: Aug 15, 2026 · 1:08 AM UTC
• Version: 1.3.3

Overview

This is a disclosed EVE Online API helper that handles sensitive OAuth tokens, but its risky behavior is documented, user-directed, and gated.

Install only if you are comfortable granting an agent access to the EVE scopes you choose. Prefer the narrowest scope profile, use --char instead of copying tokens, avoid putting tokens in config files or environment variables unless necessary, and use --allow-write only for intentional account-changing actions.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares powerful capabilities in practice—network access, shell execution, local file read/write, and environment access—while not exposing a formal permissions declaration. That weakens reviewability and consent, making it easier for operators or downstream systems to invoke a skill with broader authority than expected, especially since it handles OAuth tokens and local credential storage.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 81% confidence
• Finding: The description overstates and understates behavior in different places: it implies broad account-management writes while also omitting config-validation functionality. Security reviews depend on accurate behavioral descriptions; mismatches can cause operators to grant trust or permissions under false assumptions, particularly for a skill that can authenticate and touch sensitive account data.

Intent-Code Divergence

Medium

• Confidence: 77% confidence
• Finding: The dashboard section says there is no notification sender in the skill, but other parts advertise Telegram/Discord notification support and alert/report features. Contradictory security-relevant statements make data-flow boundaries unclear, which is risky when sensitive wallet, asset, or mail-derived content could be transmitted to third-party endpoints.

Context-Inappropriate Capability

Medium

• Confidence: 75% confidence
• Finding: The configuration introduces a Telegram notification channel that sends account-derived information to a third-party messaging platform, which broadens the trust boundary beyond the stated ESI API purpose. In the context of EVE character, wallet, contract, and alert data, this can expose sensitive operational or financial information if enabled without clear user understanding and minimization.

Context-Inappropriate Capability

Medium

• Confidence: 75% confidence
• Finding: The schema solicits and validates external notification credentials for Telegram and Discord, which introduces a new secret-handling and data-exfiltration path unrelated to basic ESI access. In the context of a skill that already handles sensitive EVE tokens, adding outbound channels makes accidental or intentional transmission of account data to third-party services more dangerous.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation description is broad enough to match many generic EVE-related requests, increasing the chance that the skill is auto-selected in contexts where authentication, token handling, or sensitive account access is unnecessary. Overbroad routing expands exposure to secrets and external network actions beyond the minimum required for a user task.

Credential Access

High

• Category: Privilege Escalation

Content

- Tokens live in `~/.openclaw/eve-tokens.json` with `chmod 600`. Refresh tokens
  rotate on every use, as EVE SSO intends.
- PKCE means there is no client secret to leak in the first place.
- **Access tokens expire in about 20 minutes. Refresh tokens do not.** Anything
  that prints a refresh token — logs, transcripts, CI output — hands over
  lasting access. `get_token.py --json` redacts it unless you explicitly pass
  `--include-refresh-token`.

• Confidence: 78% confidence
• Finding: The README confirms the skill stores long-lived OAuth refresh tokens locally and acknowledges that disclosure of a refresh token grants lasting access. Even though the text is warning about the risk, the underlying design still concentrates sensitive credentials in a local file and offers an option to reveal them (`--include-refresh-token`), so compromise of the host, logs, transcripts, or unsafe handling could expose durable account access.

Credential Access

High

• Category: Privilege Escalation

Content

required: false
    sensitive: false
  - name: EVE_TOKEN_MAIN
    description: "ESI OAuth2 access token for the main character. Not needed at runtime — scripts auto-manage tokens via ~/.openclaw/eve-tokens.json (created by auth_flow.py). Only set as env var if using $ENV: references in your dashboard config."
    required: false
    sensitive: true
  - name: EVE_REFRESH_MAIN

• Confidence: 73% confidence
• Finding: The skill explicitly supports reading OAuth access tokens from environment variables. Even though the documentation discourages normal use, environment-based secret handling can leak through process environments, debugging tools, crash reports, inherited subprocesses, or misconfigured dashboards, which is significant because these bearer tokens grant account access.

Credential Access

High

• Category: Privilege Escalation

Content

required: false
    sensitive: true
  - name: EVE_REFRESH_MAIN
    description: "ESI OAuth2 refresh token for automatic access token renewal. Not needed at runtime — scripts auto-manage tokens via ~/.openclaw/eve-tokens.json. Only set as env var if using $ENV: references in your dashboard config."
    required: false
    sensitive: true
  - name: TELEGRAM_BOT_TOKEN

• Confidence: 89% confidence
• Finding: Refresh tokens are long-lived and more sensitive than access tokens, so support for supplying them via environment variables creates substantial credential-exposure risk. Leakage of a refresh token can allow persistent unauthorized token renewal and continued access to private EVE account data.

Credential Access

High

• Category: Privilege Escalation

Content

},
          "token": {
            "type": "string",
            "description": "ESI Access Token (or '$ENV:EVE_TOKEN_MAIN'). Expires after ~20min."
          },
          "refresh_token": {
            "type": "string",

• Confidence: 93% confidence
• Finding: The schema explicitly supports storage of access tokens and refresh tokens in configuration, and the skill metadata states long-lived OAuth tokens are stored locally. These credentials grant access to sensitive EVE character data and potentially state-changing operations when write mode is enabled, so compromise of the config or token file can lead to account data disclosure and unauthorized API actions.

Credential Access

High

• Category: Privilege Escalation

Content

parser = argparse.ArgumentParser(description="Query EVE ESI API endpoints")
    parser.add_argument("--token", required=False,
                        help="ESI access token (Bearer). Exposed via ps/shell history — "
                             "prefer --char or --token-stdin")
    parser.add_argument("--char", required=False,
                        help="Stored character key; refreshes the token in-process so it "

• Confidence: 78% confidence
• Finding: The skill intentionally accepts bearer tokens via the --token CLI argument, and the help text correctly notes that argv can be exposed through process listings and shell history. In this skill context, tokens grant access to EVE character/account data and may enable account-modifying actions when --allow-write is used, so accepting secrets on the command line creates a real credential exposure path on multi-user systems or in logged automation environments.

Credential Access

High

• Category: Privilege Escalation

Content

file=sys.stderr)
        print(json.dumps(payload, indent=2))
    else:
        print("Note: access token written to stdout (valid ~20 min). "
              "Prefer esi_query.py --char, which never prints it.", file=sys.stderr)
        print(token_data["access_token"])

• Confidence: 88% confidence
• Finding: The script deliberately prints a live OAuth access token to stdout, which can be captured by terminal logs, CI systems, shell history workflows, agent transcripts, or downstream tooling. In this skill's context, that is more dangerous because agent frameworks commonly surface stdout to other components or users, turning a convenience feature into a credential disclosure path.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.