motion

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:56 PM UTC
• Version: 1.2.1

Overview

This skill is a disclosed Motion API integration that uses Maton for OAuth-backed API access, with clear cautions around credentials, writes, and connection selection.

Install only if you trust Maton and are comfortable granting Motion account access through its gateway. Prefer OAuth over long-lived API keys, choose the narrowest Motion scopes available, confirm every write or delete action, and consider installing the CLI or SDK in an isolated environment because the package versions are not pinned.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35
• Finding: Unpinned Third-Party Dependencies Create Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:35-44` **Additional Locations**: `SKILL.md:566-585` **Vulnerability Type**: Unpinned package installation **Risk Level**: Medium ### Vulnerable Code ```bash npm install -g @maton/cli ``` ```bash brew install maton-ai/cli/maton ``` The optional SDK instructions contain the same issue: ```bash pip install maton-ai ``` ```bash npm install @maton/sdk ``` ### Technical Analysis The Skill instructs users or agents to install mutable third-party packages without pinning reviewed versions or verifying package integrity. Each command resolves to whatever release is current at installation time, so the code ultimately installed can differ from the code that existed when the Skill was audited. The global npm installation is particularly consequential because package installation scripts and the resulting executable run with the invoking user's privileges. The Homebrew tap also introduces a third-party distribution channel whose formula may change independently. The Python and JavaScript SDK alternatives have the same version-mutation risk. This is a supply-chain weakness rather than evidence that the named packages are currently malicious. ### Attack Path 1. An attacker compromises a package publisher account, package registry release, or Homebrew tap, or otherwise causes a malicious release to be distributed under the expected package name. 2. A user or agent follows the installation commands in `SKILL.md`. 3. The package manager resolves the unpinned dependency to the compromised release. 4. Malicious installation hooks or runtime code execute with the user's privileges. 5. The compromised component may access files available to the process, intercept API requests, or steal credentials available through its execution context. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the user performing t ...[truncated 397 chars]
• Remediation: ## Remediation Suggestions - Pin every dependency to a reviewed, known-good version. - Use package-manager lockfiles where the installation model supports them. - Verify package integrity with cryptographic hashes, signatures, or registry provenance attestations. - Avoid global installation where possible; use an isolated virtual environment, container, or project-local dependency. - Pin the Homebrew formula or release artifact and document how its publisher and checksum should be verified. - Establish a controlled update process that reviews new releases before changing pinned versions. - Disable package installation scripts where feasible or audit required lifecycle scripts before installation.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:157
• Finding: Generic API Passthrough Exceeds the Documented Endpoint Surface## Vulnerability Details **File Location**: `SKILL.md:157-171` **Additional Locations**: `SKILL.md:7`, `SKILL.md:184-188` **Vulnerability Type**: Excessively broad API capability **Risk Level**: Medium ### Vulnerable Code ```markdown Motion has no typed `maton motion` commands yet, so every call goes through `maton api`. ```bash maton api '/motion/v1/tasks' ``` Paths are `/motion/{native-api-path}`. The gateway forwards everything after the app segment to `api.usemotion.com` and injects the credential for the connection. Query strings, custom headers (except `Host` and `Authorization`), and all HTTP methods pass through. Send a JSON body with `--input -`: ```bash maton api -X POST '/motion/{native-api-path}' -H 'Content-Type: application/json' --input - <<'JSON' {"key": "value"} JSON ``` ``` The Skill explicitly acknowledges the expanded capability: ```markdown The `maton api` passthrough can additionally reach any endpoint this connection is authorized for, including ones not documented below, so treat the list above as the intended surface rather than a technical limit. ``` ### Technical Analysis The generic `maton api` interface accepts arbitrary native Motion API paths, query strings, supported custom headers, request bodies, and HTTP methods. Consequently, the documented task, project, workspace, comment, and scheduling operations are only a recommended surface—not an enforced security boundary. The effective privilege is the complete set of endpoints allowed by the connected OAuth authorization. This violates strict least-privilege design because a Skill intended for a limited set of operations retains a general-purpose API channel. The documentation mitigates risk by requiring explicit approval for writes, recommending narrow OAuth scopes, defaulting to read operations, and treating API content as untrusted. However, those procedural controls do not technically prevent access to undocumented endp ...[truncated 1575 chars]
• Remediation: ## Remediation Suggestions - Enforce an allowlist of approved endpoint paths and HTTP methods in the CLI or gateway rather than relying only on documentation. - Reject path traversal, alternate path forms, and undocumented endpoints before credential injection. - Use separate, narrowly scoped OAuth connections for read-only and write-capable workflows. - Require explicit user approval for any request outside the documented endpoint surface, including read requests. - Resolve and display the exact connection, account, endpoint, method, parameters, and expected data scope before sensitive calls. - Preserve the existing rule that API-returned content must never select a subsequent endpoint, recipient, or action. - Record minimal, redacted audit metadata for gateway calls without logging credentials or sensitive response bodies. - Revoke unused connections promptly and periodically review granted OAuth scopes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.