ClawHub
Back to skill

Security audit

alphaportal-mcp

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it exposes a reusable account token and provides transportation-setting changes without requiring confirmation.

Prefer read-only use until every setting change requires explicit approval of the student and proposed values. Enter tokens through a protected prompt or credential store, keep them out of history and transcripts, and revoke any exposed credentials. Both bundled files were inspected; live API behavior, token lifetimes and external dependency contents remain unverified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The supplied commands perform state-changing operations, not data retrieval. Although notification settings are related to the declared arrival-notification functionality, the description does not disclose configuration changes. In particular, changing a walk-zone radius that affects eligibility is a substantive undeclared capability, not a supporting detail of token acquisition or API access.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
GPS location, arrival notifications — from a shell with curl instead of
  running the alphaportal-mcp server. Capture the signed-in web app's refresh
  token ONCE (a paste-in-console one-liner, or the fpx browser bridge), then mint
  access tokens and curl the REST API directly. Use when you want AlphaPortal
  data without the MCP, in a script, or on a machine where the MCP isn't
  installed.
---

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
hold a token, plain `curl` does every call — no browser extension at runtime.
Login itself is reCAPTCHA-gated and can't be scripted, so the credential is the
**refresh token** the web app stores in your signed-in browser. It's an 8-day,
reusable JWT; from it you mint a 30-minute access token with one unauthenticated
POST (no reCAPTCHA, no MFA).

So the flow is: **capture the refresh token once → mint an access token → curl.**

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
reusable JWT; from it you mint a 30-minute access token with one unauthenticated
POST (no reCAPTCHA, no MFA).

So the flow is: **capture the refresh token once → mint an access token → curl.**

## 1. Capture the refresh token (once; repeat when it expires after ~8 days)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

export ALPHAPORTAL_RT=$(fpx local-storage user -p alphaportal | jq -r '.user | fromjson | .User.RefreshToken')

text

## 2. Mint an access token (each session, or when the last one is >30 min old)

```sh
export ALPHAPORTAL_TOKEN=$(

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md
## Status codes

- `401` — the access token expired (re-run step 2) or the refresh token died
  (re-capture, step 1).
- `400` with `developerMessage` — a required param is missing (e.g. a path
  `studentId`, or `studentId`/`radius` on a write).

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/endpoints.md (reported line 80)May include surrounding context.

'{"studentId":218652901,"schoolArrivalNotifyAm":1,"schoolArrivalNotifyPm":1,"schoolArrivalEmailAm":0,"schoolArrivalEmailPm":0}' | jq

text

## Refresh (mint a new access token, rotating the refresh token)

```sh
# returns {token, refreshToken, lang}; the refresh token is reusable, but each

The token-pasting workflow lacks a warning that the reusable refresh token can be retained in shell history.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

Pasting a reusable refresh token into an export command can persist the literal secret in shell history, including histories later collected or synchronized. Someone obtaining it could mint access tokens during its remaining validity and potentially access children's identities, transportation details, and live bus locations with the account's permissions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

sh
export ALPHAPORTAL_TOKEN=$(
  curl -s -X POST https://api.alpharoute.app/AlphaCore/v1/public/refresh-token \
    -H 'Content-Type: application/json' \
    -d "{\"refreshToken\":\"$ALPHAPORTAL_RT\"}" | jq -r '.data.token'
)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 85)May include surrounding context.

sh
# returns {token, refreshToken, lang}; the refresh token is reusable, but each
# call also issues a fresh 8-day one you can save to roll the window forward.
curl -s -X POST https://api.alpharoute.app/AlphaCore/v1/public/refresh-token \
  -H 'Content-Type: application/json' \
  -d "{\"refreshToken\":\"$ALPHAPORTAL_RT\"}" | jq '.data | {token, refreshToken}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

sh
export ALPHAPORTAL_TOKEN=$(
  curl -s -X POST https://api.alpharoute.app/AlphaCore/v1/public/refresh-token \
    -H 'Content-Type: application/json' \
    -d "{\"refreshToken\":\"$ALPHAPORTAL_RT\"}" | jq -r '.data.token'
)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

so pipe .data to jq.

sh
alpha() { curl -s "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN"; }

# your students (grab each studentId here first)
alpha AlphaPortal/v1/user-students/list | jq '.data.students[] | {studentId, name, gradeName}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 11)May include surrounding context.

sh
alpha() { curl -s "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN"; }
apost() { curl -s -X POST "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN" -H 'Content-Type: application/json' -d "$2"; }

Students & transportation

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 10)May include surrounding context.

All reads below are live-verified (2026-08-25). Define the helper once:

sh
alpha() { curl -s "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN"; }
apost() { curl -s -X POST "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN" -H 'Content-Type: application/json' -d "$2"; }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 10)May include surrounding context.

All reads below are live-verified (2026-08-25). Define the helper once:

sh
alpha() { curl -s "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN"; }
apost() { curl -s -X POST "https://api.alpharoute.app/$1" -H "Authorization: Bearer $ALPHAPORTAL_TOKEN" -H 'Content-Type: application/json' -d "$2"; }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/endpoints.md (reported line 85)May include surrounding context.

sh
# returns {token, refreshToken, lang}; the refresh token is reusable, but each
# call also issues a fresh 8-day one you can save to roll the window forward.
curl -s -X POST https://api.alpharoute.app/AlphaCore/v1/public/refresh-token \
  -H 'Content-Type: application/json' \
  -d "{\"refreshToken\":\"$ALPHAPORTAL_RT\"}" | jq '.data | {token, refreshToken}'

The skill includes a permanent transportation-eligibility change despite being described as a way to access school-bus data.

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The manifest describes retrieving AlphaPortal data through curl, but L69–L70 provide a POST command that changes a student's walk-zone radius and explicitly affects eligibility. This is a consequential remote modification, not an implementation detail of accessing students, stops, GPS locations, or arrival notifications.

Content

No source excerpt is available for this finding.