Windsor.ai Analytics

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:17 PM UTC
• Version: 1.0.3

Overview

The skill matches its stated Windsor.ai analytics purpose, but it needs Review because its setup runs an unpinned package and includes a troubleshooting command that can expose more local secrets than necessary.

Install only if you are comfortable connecting Windsor.ai business data to an external MCP service. Prefer a keychain or secrets manager, avoid the bulk `.env` export command, and use a pinned or locally reviewed `mcporter` binary rather than unpinned `npx` commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:199

Finding

Unsafe Bulk Import of Environment Variables

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:77

Finding

Unpinned Package Execution Through npx

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The skill instructs users to place the API key into a plaintext ~/.clawdbot/.env file via shell redirection. Although common, this creates a durable local secret exposure path through filesystem access, backups, shell history practices, and accidental disclosure from developer tooling.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Add your API key to the clawdbot environment file:

bash

echo 'WINDSOR_API_KEY=your_api_key_here' >> ~/.clawdbot/.env

Replace your_api_key_here with the key you copied.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The troubleshooting command export $(grep -v '^#' ~/.clawdbot/.env | xargs) && npx mcporter list loads secrets from a plaintext file and immediately exposes them to a newly executed process. This pattern is brittle, may mis-handle values, and increases the risk that credentials are available to unintended code, especially because the invoked package is not version-pinned.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

md

**Failed to resolve header 'Authorization' / WINDSOR_API_KEY must be set:**
- mcporter requires the variable to be exported in your shell, not just stored in `.env`
- Run: `export WINDSOR_API_KEY=your_api_key_here && npx mcporter list`
- To load from your `.env` file: `export $(grep -v '^#' ~/.clawdbot/.env | xargs) && npx mcporter list`

**No data sources found:**
- You must connect at least one data source in your Windsor.ai dashboard before querying

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description emphasizes capabilities but does not clearly disclose that user prompts and business-data queries are sent to an external Windsor.ai MCP endpoint. This can lead to unintended third-party disclosure of sensitive commercial, CRM, or analytics information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger scope is broad enough to auto-invoke the skill for many generic analytics, advertising, or CRM questions. That increases the chance of unnecessary routing of sensitive business prompts and metadata to the external Windsor.ai service when a local answer or clarification would have sufficed.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

> **Note:** mcporter requires `WINDSOR_API_KEY` to be exported as a shell environment variable. Simply storing it in `~/.clawdbot/.env` is not enough — it must be available in your active shell session.
>
> **Security note:** Avoid appending the key to `~/.zshrc` or other shell rc files, as this stores your secret in plaintext and loads it into every shell session. Prefer your system keychain, a secrets manager, or a `.env` file with restricted permissions (`chmod 600 ~/.clawdbot/.env`). If you do add it to your shell rc file, remove it once no longer needed.

### Step 3: Configure mcporter

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

Step 3: Configure mcporter

Add Windsor.ai to your mcporter configuration. Open or create config/mcporter.json in your project and add the following inside the mcpServers object:

json

{

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 80% confidence

Finding

The skill instructs users to run npx mcporter without pinning an exact package version. Because npx may fetch the latest package at execution time, a compromised or unexpectedly changed upstream release could execute unreviewed code in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 80% confidence

Finding

This troubleshooting command again uses unpinned npx mcporter, which preserves supply-chain risk during incident handling. Users often paste troubleshooting commands directly, so fetching the latest package at runtime can lead to execution of unintended code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 80% confidence

Finding

The command combining environment export with npx mcporter list still executes an unpinned package, adding supply-chain risk in a context where secrets are present in the shell environment. If a malicious package version were fetched, it could access the exported API key.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 80% confidence

Finding

This is another reference to npx mcporter without version pinning, creating the same dependency confusion or malicious-update risk. Repetition across the document increases the chance that users will run at least one unsafe variant.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.