Security audit

Comulytic

Security checks for vulnerabilities and agentic risk

Overview

This skill is for legitimate Comulytic lookups, but it needs review because it stores login tokens and uses shell examples that can mishandle user-supplied search text while accessing sensitive meeting data.

Install only if you trust the publisher and intend to let the agent query Comulytic meeting summaries, full transcripts, contacts, action items, and conversation history. Treat the saved token as sensitive, avoid running status commands in shared/logged terminals, and prefer hardened commands or scripts that serialize API arguments safely instead of substituting user text into shell snippets.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:112
Finding: Unsafe interpolation of user-controlled search terms into shell and JSON commands
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:112-119 and SKILL.md:180-187
Vulnerability Type: Shell command injection through unsafe string interpolation
Risk Level: High

Vulnerable Code

bash
# By keyword curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/search","arguments":{"query":"KEYWORD","limit":5}}}' \ | jq '.result.content[0].text' -r | jq '.'

A second instance uses the same unsafe pattern:

bash
curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"conversations/search","arguments":{"query":"KEYWORD","limit":10}}}' \ | jq '.result.content[0].text' -r | jq '.'

Technical Analysis

The documented command embeds the KEYWORD placeholder inside a single-quoted shell argument containing JSON. The Skill does not instruct the agent to encode the search term with a JSON serializer or pass it through a safe positional parameter.

If an agent implements the example by directly replacing KEYWORD with user-controlled text, a search term containing a single quote can terminate the shell-quoted JSON argument. Shell metacharacters following that quote can then be interpreted as commands rather than data. Ordinary quotes and control characters can also corrupt the JSON request even when they do not produce command execution.

This is especially sensitive because the same shell process holds COMULYTIC_MCP_TOKEN, which authorizes access to private meeting summaries, transcripts, contacts, action items, and conversation history.

Attack Path

An attacker supplies a meeting or conversation search term containing a single quote followed by shell s ...[truncated 1330 chars]
Remediation: View remediation
Remediation Suggestions

Do not interpolate user-controlled values into shell source text.

Generate the complete request body with a JSON-aware tool such as Python or jq.

Pass the search term as a positional argument or environment value rather than embedding it in shell syntax.

Use curl --data-binary with serialized data supplied through standard input.

Add explicit instructions that agents must treat meeting IDs, contact IDs, keywords, dates, cursors, and other API arguments as data.

A safer pattern using jq is:

bash
payload="$(jq -n --arg query "$QUERY" '{ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "meetings/search", arguments: {query: $query, limit: 5} } }')" curl -sS -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ --data-binary "$payload"

Prefer implementing the API call in a dedicated script that accepts structured arguments and serializes them with Python's json module, avoiding dynamically assembled shell commands entirely.

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/comulytic-login.py:57
Finding: OAuth token file is opened before restrictive permissions are enforced
Content: View full analysis
Vulnerability Details

File Location: scripts/comulytic-login.py:57-61
Vulnerability Type: Insecure sensitive-file creation and symlink handling
Risk Level: Medium

Vulnerable Code

python
def save_token(data): os.makedirs(os.path.dirname(TOKEN_FILE), exist_ok=True) with open(TOKEN_FILE, "w") as f: json.dump(data, f, indent=2) os.chmod(TOKEN_FILE, 0o600)

Technical Analysis

The token file is opened with Python's ordinary write mode before permissions are restricted to 0600. For a newly created file, its initial permissions are determined by the process umask. If the umask is permissive, another local account may be able to read the file between creation and the later chmod call.

The parent directory is also created without an explicit 0700 mode or validation of an existing directory's ownership and permissions. In addition, open(TOKEN_FILE, "w") follows symbolic links and truncates an existing destination. The implementation does not use exclusive creation, O_NOFOLLOW, or atomic replacement.

The file contains an access token, refresh token, client identifier, and account email. The access token grants the read scopes declared by the Skill:

text
read:meetings:summary read:meetings:transcript read:contacts read:actions search:conversations

Attack Path

Possible exploitation requires local access and sufficiently weak permissions on ~/.comulytic or its containing path:

A local attacker identifies that the target will run the login script.

The attacker takes advantage of an attacker-writable token directory or places a symbolic link at ~/.comulytic/mcp-token.json.

The victim runs the login process.

The script follows the symbolic link or creates the token file with umask-derived permissions.

The attacker reads the newly written OAuth credentials before permissions are corrected, or redirects/truncates the write ta ...[truncated 974 chars]
Remediation: View remediation
Remediation Suggestions

Create ~/.comulytic with mode 0700.

Verify that the token directory is a real directory, is owned by the current user, and is not writable by group or other users.

Create sensitive files with mode 0600 at creation time rather than correcting permissions afterward.

Refuse to follow symbolic links by using O_NOFOLLOW where supported.

Write to an exclusively created temporary file in the same directory, flush and synchronize it, and atomically replace the destination.

Validate any existing destination with lstat before replacement.

Avoid storing refresh tokens unless they are required by the implemented renewal flow.

A hardened implementation should use primitives equivalent to:

python
token_dir = os.path.dirname(TOKEN_FILE) os.makedirs(token_dir, mode=0o700, exist_ok=True) os.chmod(token_dir, 0o700) flags = os.O_WRONLY | os.O_CREAT | os.O_EXCL if hasattr(os, "O_NOFOLLOW"): flags |= os.O_NOFOLLOW temp_path = os.path.join(token_dir, f".mcp-token.{secrets.token_hex(8)}.tmp") fd = os.open(temp_path, flags, 0o600) try: with os.fdopen(fd, "w") as file: json.dump(data, file, indent=2) file.flush() os.fsync(file.fileno()) os.replace(temp_path, TOKEN_FILE) os.chmod(TOKEN_FILE, 0o600) except Exception: try: os.unlink(temp_path) except FileNotFoundError: pass raise

The implementation should additionally reject unsafe ownership or permission states instead of silently trusting a pre-existing token directory.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a read-only query tool, but its setup/login flow implies interactive credential handling, OAuth registration, token acquisition, token storage, and logout state management. That mismatch is dangerous because users and policy engines may approve the skill under a lower-risk mental model while it actually handles credentials and persistent authentication material.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/comulytic-login.py (reported line 3)May include surrounding context.
python
#!/usr/bin/env python3 """ Comulytic MCP Login — 自动完成 OAuth 2.0 流程，获取 MCP access token。用法: comulytic-login # 交互式输入邮箱密码

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The status command prints the first portion of the access token to stdout. Even partial token disclosure can leak sensitive bearer material into terminal history, logs, screenshots, or remote session recordings, increasing the chance of credential compromise. In the context of a skill that accesses meetings, transcripts, contacts, and conversation search, leaked tokens expose sensitive organizational data.
Content: Scanner excerpt · scripts/comulytic-login.py (reported line 161)May include surrounding context.
python
print(f" Token 文件: {TOKEN_FILE}") print(f" Client ID: {token.get('client_id', 'unknown')[:8]}...") at = token.get("access_token", "") print(f" Access Token: {at[:20]}..." if at else " Access Token: (空)") def do_logout():

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes shell commands, reads environment variables and local files, and performs network requests, but it does not declare a restrictive tool scope such as allowed-tools or permissions. This creates an overly broad execution surface where a host agent may grant more capabilities than the user expects, increasing the chance of unintended secret access or command execution.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
"kind": "apt", "package": "curl", "bins": ["curl"], "label": "Install curl (apt)", }, { "id": "apt-python3",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill accesses and transmits highly sensitive business data including meeting notes, transcripts, contact profiles, and conversation history to an external API, but it does not prominently warn users about that data flow. Without clear disclosure, users may unknowingly expose confidential information, especially when querying full transcripts or conversation search results.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The generic API pattern documents authenticated external transmission to api.comulytic.ai for arbitrary tool calls. Because it establishes a reusable pattern for sending account-scoped requests with a bearer token, it is a real capability that can expose sensitive data if combined with insufficient permission boundaries.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}" curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"TOOL","arguments":{ARGS}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This duplicate finding points to the same external host usage for recent meetings queries. It is not malicious by itself, but it confirms repeated network transmission of authenticated business data to a remote service.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}" # Recent meetings curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/search","arguments":{"limit":10}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This duplicate finding points to the same external host usage for recent meetings queries. It is not malicious by itself, but it confirms repeated network transmission of authenticated business data to a remote service.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}" # Recent meetings curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/search","arguments":{"limit":10}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This duplicate host-based finding again reflects external transmission for keyword meeting search. The risk stems from sending potentially sensitive keywords and receiving account data over a bearer-authenticated remote API.
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
md
| jq '.result.content[0].text' -r | jq '.' # By keyword curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/search","arguments":{"query":"KEYWORD","limit":5}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This duplicate host-based finding again reflects external transmission for keyword meeting search. The risk stems from sending potentially sensitive keywords and receiving account data over a bearer-authenticated remote API.
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
md
| jq '.result.content[0].text' -r | jq '.' # By keyword curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/search","arguments":{"query":"KEYWORD","limit":5}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This duplicate host-based finding corresponds to date-range searches against the remote API. The concern remains unauthorized or insufficiently disclosed transmission of account-linked historical meeting information.
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
md
| jq '.result.content[0].text' -r | jq '.' # By date range curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/search","arguments":{"date_from":"2025-03-01","date_to":"2025-03-31"}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This duplicate host-based finding corresponds to date-range searches against the remote API. The concern remains unauthorized or insufficiently disclosed transmission of account-linked historical meeting information.
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
md
| jq '.result.content[0].text' -r | jq '.' # By date range curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/search","arguments":{"date_from":"2025-03-01","date_to":"2025-03-31"}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This duplicate finding reflects remote retrieval of meeting summaries from the same API host. The sensitivity of discussion summaries makes the external transmission materially important from a privacy and confidentiality standpoint.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}" # Summary curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/detail","arguments":{"meeting_id":"ID"}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This duplicate finding reflects remote retrieval of meeting summaries from the same API host. The sensitivity of discussion summaries makes the external transmission materially important from a privacy and confidentiality standpoint.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}" # Summary curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/detail","arguments":{"meeting_id":"ID"}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: This duplicate host finding again highlights transcript retrieval from the external API. Verbatim transcripts materially increase exposure risk because they may contain secrets, personal data, or legally sensitive conversation content.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
md
| jq '.result.content[0].text' -r | jq '.' # Full transcript curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/detail","arguments":{"meeting_id":"ID","detail_level":"full"}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: This duplicate host finding again highlights transcript retrieval from the external API. Verbatim transcripts materially increase exposure risk because they may contain secrets, personal data, or legally sensitive conversation content.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
md
| jq '.result.content[0].text' -r | jq '.' # Full transcript curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"meetings/detail","arguments":{"meeting_id":"ID","detail_level":"full"}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This duplicate host-based finding corresponds to contact profile retrieval from the remote service. It remains a real privacy issue because personally identifying and enriched contact information is transmitted and returned without prominent warning.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}" curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"contacts/profile","arguments":{"contact_id":"ID","include_insights":true}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This duplicate host-based finding corresponds to contact profile retrieval from the remote service. It remains a real privacy issue because personally identifying and enriched contact information is transmitted and returned without prominent warning.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}" curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"contacts/profile","arguments":{"contact_id":"ID","include_insights":true}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This duplicate host finding maps to contact-history lookups against the external API. Aggregated interaction history can reveal sensitive relationship and timing information even when no content transcripts are fetched.
Content: Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.
bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}" curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"contacts/history","arguments":{"contact_id":"ID","limit":10}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This duplicate host finding maps to contact-history lookups against the external API. Aggregated interaction history can reveal sensitive relationship and timing information even when no content transcripts are fetched.
Content: Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.
bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}" curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"contacts/history","arguments":{"contact_id":"ID","limit":10}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: This duplicate host finding maps to full-text conversation search and confirms broad searchable access to sensitive conversational data via the remote API. That capability raises the confidentiality impact beyond ordinary metadata retrieval.
Content: Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.
bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}" curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"conversations/search","arguments":{"query":"KEYWORD","limit":10}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: This duplicate host finding maps to full-text conversation search and confirms broad searchable access to sensitive conversational data via the remote API. That capability raises the confidentiality impact beyond ordinary metadata retrieval.
Content: Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.
bash
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}" curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"conversations/search","arguments":{"query":"KEYWORD","limit":10}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: This duplicate host finding reflects pending action retrieval from the remote API. It is a genuine but moderate confidentiality risk because task data can disclose internal operations and priorities.
Content: Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.
md
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}" # All pending curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"actions/pending","arguments":{"status":"pending","limit":20}}}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: This duplicate host finding reflects pending action retrieval from the remote API. It is a genuine but moderate confidentiality risk because task data can disclose internal operations and priorities.
Content: Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.
md
COMULYTIC_MCP_TOKEN="${COMULYTIC_MCP_TOKEN:-$(python3 -c "import json; print(json.load(open('$HOME/.comulytic/mcp-token.json'))['access_token'])" 2>/dev/null)}" # All pending curl -s -X POST https://api.comulytic.ai/mcp \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $COMULYTIC_MCP_TOKEN" \ -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"actions/pending","arguments":{"status":"pending","limit":20}}}' \

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp4

Credential Access

Credential Access

Undeclared Tool Scope

External Transmission

Missing User Warnings

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis