alphaportal-mcp

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:07 PM UTC
• Version: 0.3.1

Overview

This skill is transparent about what it does, but it teaches direct reuse of browser refresh tokens to access sensitive student transportation data and perform live writes without strong safeguards.

Install only if you fully control the AlphaPortal account and understand that this skill exposes reusable session credentials and sensitive student transportation information to your shell, tools, terminal history, and optionally a third-party browser bridge. Prefer an official supported auth flow or the safer MCP path with confirmations; avoid the fpx option unless you have audited and pinned it, and do not run the documented write commands unless you intend to permanently change records.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:44
• Finding: Unpinned Third-Party Dependency Granted Access to Reusable Authentication Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:44-48` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```sh npm install -g @fetchproxy/cli # provides `fpx` fpx profile add alphaportal --domain alphaportal.app fpx profile declare alphaportal --local-storage user # declare scope BEFORE first pairing fpx local-storage user -p alphaportal # first call prints a pair code → approve in Transporter export ALPHAPORTAL_RT=$(fpx local-storage user -p alphaportal | jq -r '.user | fromjson | .User.RefreshToken') ``` ### Technical Analysis The Skill instructs users to install the latest available version of `@fetchproxy/cli` globally and pair it with the Transporter browser extension. No package version, package integrity hash, or audited release is specified. The dependency is then authorized to retrieve the AlphaPortal `user` local-storage entry, from which it extracts an approximately eight-day reusable refresh token. This grants a third-party CLI and browser extension access to a credential capable of minting access tokens for sensitive student and transportation information. This access is not the minimum privilege required for the declared functionality because `SKILL.md:31-37` already documents a dependency-free browser-console method that reads the specific refresh-token field. The bridge method expands the trusted computing base and exposes the entire `user` local-storage item to third-party components. The audit did not establish that the named package or extension is malicious. The vulnerability arises from installing an unpinned, globally scoped dependency and granting it access to a high-value browser credential, creating a supply-chain compromise path. ### Attack Path 1. An attacker compromises a future release of `@fetchproxy/cli`, its distribution account, one of its transitive dependencies, or the associated browser extension. 2. A u ...[truncated 1466 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make the dependency-free browser-console procedure the preferred and default credential-capture method. 2. Remove the bridge procedure unless browser automation is essential to the declared functionality. 3. If the bridge must remain: - Pin `@fetchproxy/cli` to a specifically reviewed version. - Verify the package using a lockfile and trusted integrity hash. - Avoid global installation; use an isolated, temporary environment. - Audit the CLI, its transitive dependencies, and the browser extension. - Document the extension's publisher, update policy, data flow, and trust boundary. 4. Request access only to the exact refresh-token field where technically possible, rather than the complete `user` local-storage object. 5. Clearly warn users that pairing grants a third-party component access to a reusable authentication credential. 6. Provide instructions to revoke sessions and rotate credentials immediately if the CLI, extension, or host is suspected of compromise. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37
• Finding: Reusable Authentication Tokens Exposed Through Environment Variables, Process Arguments, and Terminal Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:37, 48, 53-58`; `references/endpoints.md:83-88` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code From `SKILL.md`: ```sh export ALPHAPORTAL_RT='<paste the refresh token>' ``` ```sh export ALPHAPORTAL_RT=$(fpx local-storage user -p alphaportal | jq -r '.user | fromjson | .User.RefreshToken') ``` ```sh export ALPHAPORTAL_TOKEN=$( curl -s -X POST https://api.alpharoute.app/AlphaCore/v1/public/refresh-token \ -H 'Content-Type: application/json' \ -d "{\"refreshToken\":\"$ALPHAPORTAL_RT\"}" | jq -r '.data.token' ) ``` From `references/endpoints.md`: ```sh # returns {token, refreshToken, lang}; the refresh token is reusable, but each # call also issues a fresh 8-day one you can save to roll the window forward. curl -s -X POST https://api.alpharoute.app/AlphaCore/v1/public/refresh-token \ -H 'Content-Type: application/json' \ -d "{\"refreshToken\":\"$ALPHAPORTAL_RT\"}" | jq '.data | {token, refreshToken}' ``` ### Technical Analysis The Skill stores both refresh and access tokens in exported shell environment variables. Exported values are inherited by every child process launched from that shell unless explicitly removed. This unnecessarily broadens credential exposure beyond the `curl` process that needs the token. The refresh token is interpolated directly into curl's `-d` argument. Depending on the operating system and process-inspection controls, command-line arguments may be visible to other local users, monitoring agents, diagnostic tools, process accounting, or logs while the request is active. The endpoint reference also deliberately prints both the access token and newly issued refresh token to standard output. This can disclose credentials through terminal scrollback, copied command output, shell-session recording, CI logs, support transcripts, or screen sharing. The network transmission itself is directed only to t ...[truncated 1705 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not export authentication tokens globally into the shell environment. 2. Store tokens in variables with the narrowest possible scope and unset them immediately after use. 3. Read pasted secrets without terminal echo, for example with an appropriate silent-input mechanism. 4. Avoid placing the refresh token directly in command-line arguments. Supply request content using a protected input file, standard input, or another mechanism that does not expose the secret in the process argument list. 5. If a temporary file is required: - Create it with restrictive permissions such as mode `0600`. - Use a private temporary directory. - Delete it immediately after the request. - Ensure backups and logs do not retain it. 6. Do not print access or refresh tokens to standard output. Extract and persist only what is operationally required, using a credential store or a permission-restricted file. 7. Disable shell tracing around all credential-handling commands and warn users not to execute them in recorded terminals or CI logs. 8. Add explicit cleanup commands for both token variables. 9. Document session revocation and token-rotation procedures for suspected exposure. 10. Add a confirmation step before permanent write operations so credential misuse or command mistakes do not immediately modify transportation settings. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (20)

Credential Access

High

• Category: Privilege Escalation

Content

GPS location, arrival notifications — from a shell with curl instead of
  running the alphaportal-mcp server. Capture the signed-in web app's refresh
  token ONCE (a paste-in-console one-liner, or the fpx browser bridge), then mint
  access tokens and curl the REST API directly. Use when you want AlphaPortal
  data without the MCP, in a script, or on a machine where the MCP isn't
  installed.
---

• Confidence: 97% confidence
• Finding: The manifest openly advertises capturing a signed-in user's refresh token and minting access tokens for direct API use, which is explicit credential acquisition and reuse. Because the targeted data includes student and live transportation information, the resulting compromise affects highly sensitive operational and personal data.

Ssd 3

High

• Confidence: 99% confidence
• Finding: These instructions describe bypassing the intended application flow by extracting a long-lived refresh token from a signed-in browser session and using it to mint API access tokens outside normal controls like reCAPTCHA and MFA. That enables unauthorized persistent access to sensitive student transportation data and defeats the security boundaries the web app relies on.

Credential Access

High

• Category: Privilege Escalation

Content

hold a token, plain `curl` does every call — no browser extension at runtime.
Login itself is reCAPTCHA-gated and can't be scripted, so the credential is the
**refresh token** the web app stores in your signed-in browser. It's an 8-day,
reusable JWT; from it you mint a 30-minute access token with one unauthenticated
POST (no reCAPTCHA, no MFA).

So the flow is: **capture the refresh token once → mint an access token → curl.**

• Confidence: 99% confidence
• Finding: This section identifies the browser-stored refresh token as the credential to use and highlights that it can bypass reCAPTCHA and MFA when exchanged for an access token. That is an explicit abuse path for defeating authentication protections and maintaining access for days.

Credential Access

High

• Category: Privilege Escalation

Content

reusable JWT; from it you mint a 30-minute access token with one unauthenticated
POST (no reCAPTCHA, no MFA).

So the flow is: **capture the refresh token once → mint an access token → curl.**

## 1. Capture the refresh token (once; repeat when it expires after ~8 days)

• Confidence: 99% confidence
• Finding: The documented flow—capture refresh token, mint access token, then curl—codifies a repeatable credential abuse pattern. It lowers the skill required to hijack sessions and directly query protected APIs containing student transportation data.

Ssd 3

High

• Confidence: 100% confidence
• Finding: The skill provides step-by-step instructions to retrieve the refresh token from localStorage or through a browser bridge and export it for reuse in a shell. This is credential theft/repurposing guidance that facilitates session hijacking and offline access to student data from any machine where the token is copied.

Credential Access

High

• Category: Privilege Escalation

Content

export ALPHAPORTAL_RT=$(fpx local-storage user -p alphaportal | jq -r '.user | fromjson | .User.RefreshToken')
```

## 2. Mint an access token (each session, or when the last one is >30 min old)

```sh
export ALPHAPORTAL_TOKEN=$(

• Confidence: 98% confidence
• Finding: This line transitions from stolen refresh token handling to access-token minting, completing the credential access chain needed for unauthorized API use. It materially enables exploitation by turning harvested browser secrets into active bearer tokens for downstream requests.

Credential Access

High

• Category: Privilege Escalation

Content

## Status codes

- `401` — the access token expired (re-run step 2) or the refresh token died
  (re-capture, step 1).
- `400` with `developerMessage` — a required param is missing (e.g. a path
  `studentId`, or `studentId`/`radius` on a write).

• Confidence: 88% confidence
• Finding: Although framed as status-code guidance, this text normalizes the refresh-token recapture process and reinforces persistence of credential reuse after expiration. That supports ongoing unauthorized access by instructing operators how to maintain the compromised-auth flow over time.

Credential Access

High

• Category: Privilege Escalation

Content

'{"studentId":218652901,"schoolArrivalNotifyAm":1,"schoolArrivalNotifyPm":1,"schoolArrivalEmailAm":0,"schoolArrivalEmailPm":0}' | jq
```

## Refresh (mint a new access token, rotating the refresh token)

```sh
# returns {token, refreshToken, lang}; the refresh token is reusable, but each

• Confidence: 95% confidence
• Finding: The section explicitly describes minting a new access token and returning a reusable refresh token, which are highly sensitive credentials that can grant ongoing API access. In a skill handling student transportation data, compromise of these tokens could expose live location, student records, and account information over an extended period.

External Transmission

Medium

• Category: Data Exfiltration

Content

```sh
export ALPHAPORTAL_TOKEN=$(
  curl -s -X POST https://api.alpharoute.app/AlphaCore/v1/public/refresh-token \
    -H 'Content-Type: application/json' \
    -d "{\"refreshToken\":\"$ALPHAPORTAL_RT\"}" | jq -r '.data.token'
)

• Confidence: 91% confidence
• Finding: This POST transmits a browser-derived refresh token to an external API endpoint to mint a new access token. In context, the transmission is dangerous because it operationalizes stolen or repurposed credentials and extends access outside the user’s authenticated browser session.

External Transmission

Medium

• Category: Data Exfiltration

Content

```sh
export ALPHAPORTAL_TOKEN=$(
  curl -s -X POST https://api.alpharoute.app/AlphaCore/v1/public/refresh-token \
    -H 'Content-Type: application/json' \
    -d "{\"refreshToken\":\"$ALPHAPORTAL_RT\"}" | jq -r '.data.token'
)

• Confidence: 91% confidence
• Finding: This POST transmits a browser-derived refresh token to an external API endpoint to mint a new access token. In context, the transmission is dangerous because it operationalizes stolen or repurposed credentials and extends access outside the user’s authenticated browser session.

External Transmission

Medium

• Category: Data Exfiltration

Content

so pipe `.data` to `jq`.

```sh
alpha() { curl -s "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN"; }

# your students (grab each studentId here first)
alpha AlphaPortal/v1/user-students/list | jq '.data.students[] | {studentId, name, gradeName}'

• Confidence: 90% confidence
• Finding: This helper function is a reusable mechanism for querying the AlphaRoute API with a bearer token obtained from a browser-derived refresh token. In context, it enables systematic access to sensitive student records, live bus GPS data, and notifications outside intended app controls, making mass unauthorized data retrieval straightforward.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as read-oriented access to AlphaPortal data, but it explicitly documents real write operations that alter transportation records and emphasizes there is no dry-run protection. This creates a dangerous mismatch between expected capability and actual behavior, increasing the risk of unauthorized or accidental modification of live student transportation settings.

External Transmission

Medium

• Category: Data Exfiltration

Content

All reads below are **live-verified** (2026-08-25). Define the helper once:

```sh
alpha() { curl -s "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN"; }
apost() { curl -s -X POST "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN" -H 'Content-Type: application/json' -d "$2"; }
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

All reads below are **live-verified** (2026-08-25). Define the helper once:

```sh
alpha() { curl -s "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN"; }
apost() { curl -s -X POST "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN" -H 'Content-Type: application/json' -d "$2"; }
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

All reads below are **live-verified** (2026-08-25). Define the helper once:

```sh
alpha() { curl -s "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN"; }
apost() { curl -s -X POST "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN" -H 'Content-Type: application/json' -d "$2"; }
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

All reads below are **live-verified** (2026-08-25). Define the helper once:

```sh
alpha() { curl -s "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN"; }
apost() { curl -s -X POST "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN" -H 'Content-Type: application/json' -d "$2"; }
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: These examples retrieve sensitive student and account data, including names, stops, schedules, school associations, and live bus location, but they do not prominently warn about privacy, consent, or proper handling of educational/child-related data. In a skill centered on school transportation data, this omission makes misuse and over-collection more likely.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The endpoint reference includes real state-changing operations that permanently modify student transportation settings, despite the skill being framed primarily as a direct data-access/reference tool. In this context, exposing live write calls against school-bus/student records increases the chance of accidental or unauthorized changes to eligibility and notification preferences.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The refresh example returns a new access token and refresh token but does not warn users not to print, log, paste, or persist those credentials insecurely. Because refresh tokens allow continued re-authentication, mishandling them can enable durable unauthorized access to student/account data.

External Transmission

Medium

• Category: Data Exfiltration

Content

```sh
# returns {token, refreshToken, lang}; the refresh token is reusable, but each
# call also issues a fresh 8-day one you can save to roll the window forward.
curl -s -X POST https://api.alpharoute.app/AlphaCore/v1/public/refresh-token \
  -H 'Content-Type: application/json' \
  -d "{\"refreshToken\":\"$ALPHAPORTAL_RT\"}" | jq '.data | {token, refreshToken}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.