ClawHub
Back to skill

Security audit

creditkarma-fpx

Security checks for vulnerabilities and agentic risk

Overview

The Credit Karma access is clearly disclosed, but the examples can leave account tokens and financial records exposed in temporary files.

Review before running: replace the fixed temporary paths with an owner-only temporary directory and automatic cleanup. Keep tokens and financial records out of logs or shared outputs. Approve only the stated domain and cookies, and revoke pairing when finished.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

installed (releases; it is the fetchproxy extension renamed, same maintainer — public source, verify a release zip with shasum -a 256 -c <zip>.sha256), with an open www.creditkarma.com tab you're signed into, and its Chrome Site access allowing creditkarma.com. CKAT/CKTRKID are HttpOnly (invisible to page JS) but fpx cookies reads them via the extension's chrome.cookies.get, same as @fetchproxy/bootstrap does inside the MCP. Pairing persists across invocations.

Capture the session (once per shell / once the token goes stale)

sh
fpx cookies -p creditkarma
# {"CKAT":"<accessJWT>%3B<refreshJWT>","CKTRKID":"<value>"}

CKAT packs both JWTs joined by a literal %3B (URL-encoded ;). Split it:

sh
COOKIES=$(fpx cookies -p creditkarma)
CKAT=$(jq -r '.CKAT' <<<"$COOKIES" | sed 's/%3B/;/')
CKTRKID=$(jq -r '.CKTRKID' <<<"$COOKIES")
ACCESS=${CKAT%%;*}
REFRESH=${CKAT#*;}

Core call: fetch

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

text

If that value matches `UNAUTHENTICATED|UNAUTHORIZED|TOKEN_EXPIRED|401`
(case-insensitive), the access token expired — refresh it (below) and retry.
Anything else (schema drift, validation) is a real error, not an auth
failure — don't refresh on it. A `FORBIDDEN`/403-shaped code means
authenticated-but-not-authorized; refreshing won't help.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md
`pageInfo.endCursor`, and stop when `pageInfo.hasNextPage` is `false`. See
`references/requests.md` for the full loop.

## Refreshing the access token (no need to re-run `fpx` for this)

The access token is short-lived (~15 min). Refresh with the `refreshToken`
you already extracted — this is a plain `curl`, not another `fpx` capture:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
session: re-sign into `creditkarma.com` in the browser and re-run
`fpx cookies -p creditkarma` to capture a fresh `CKAT`/`CKTRKID` pair. Note every successful refresh
ROTATES the refresh token and signs the browser tab out, so refresh only when
the access token has actually expired.

## Output / exit-code contract

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

Refreshing the access token (no need to re-run fpx for this)

The access token is short-lived (~15 min). Refresh with the refreshToken you already extracted — this is a plain curl, not another fpx capture:

sh

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/requests.md (reported line 135)May include surrounding context.

value is a real GraphQL error (schema drift, validation) — surface it, don't refresh.

2. Refresh the access token

sh
GLID=$(node -e "console.log(JSON.parse(Buffer.from(process.argv[1].split('.')[1],'base64url').toString()).glid||'')" "$ACCESS")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md
categoryInput:{categoryId:null,primeCategoryType:null},
      datePeriodInput:{datePeriod:null},accountInput:{}}}}' > /tmp/ck-body.json

curl -s https://api.creditkarma.com/graphql -X POST \
  -H "Authorization: Bearer $ACCESS" \
  -H 'Content-Type: application/json' \
  -H 'ck-client-name: prime_web' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md
categoryInput:{categoryId:null,primeCategoryType:null},
      datePeriodInput:{datePeriod:null},accountInput:{}}}}' > /tmp/ck-body.json

curl -s https://api.creditkarma.com/graphql -X POST \
  -H "Authorization: Bearer $ACCESS" \
  -H 'Content-Type: application/json' \
  -H 'ck-client-name: prime_web' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

sh
GLID=$(node -e "console.log(JSON.parse(Buffer.from(process.argv[1].split('.')[1],'base64url').toString()).glid||'')" "$ACCESS")

curl -s https://api.creditkarma.com/mobile/4.5/oauth2/token -X POST \
  -H 'content-type: application/json' \
  -H 'accept: multipart/mixed; deferSpec=20220824, application/json' \
  -H 'Origin: https://www.creditkarma.com' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

sh
GLID=$(node -e "console.log(JSON.parse(Buffer.from(process.argv[1].split('.')[1],'base64url').toString()).glid||'')" "$ACCESS")

curl -s https://api.creditkarma.com/mobile/4.5/oauth2/token -X POST \
  -H 'content-type: application/json' \
  -H 'accept: multipart/mixed; deferSpec=20220824, application/json' \
  -H 'Origin: https://www.creditkarma.com' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/requests.md (reported line 7)May include surrounding context.

md
actually calls (from `src/client.ts`). Both are unpublished, reverse-engineered
CK-internal endpoints — verified live by the MCP's own client, not guessed.

- `POST https://api.creditkarma.com/graphql` — the transactions query.
- `POST https://api.creditkarma.com/mobile/4.5/oauth2/token` — access-token refresh
  (the endpoint CK's own web app uses; the old `www.creditkarma.com/member/oauth2/refresh`
  is retired and answers every request with an HTML 400).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/requests.md (reported line 8)May include surrounding context.

md
CK-internal endpoints — verified live by the MCP's own client, not guessed.

- `POST https://api.creditkarma.com/graphql` — the transactions query.
- `POST https://api.creditkarma.com/mobile/4.5/oauth2/token` — access-token refresh
  (the endpoint CK's own web app uses; the old `www.creditkarma.com/member/oauth2/refresh`
  is retired and answers every request with an HTML 400).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/requests.md (reported line 72)May include surrounding context.

md
# ck-client-name MUST be exactly `prime_web` (`web` is rejected) and
# ck-client-version must be non-empty; its value is not checked. Nothing else
# is required — no cookies, no Origin/Referer/User-Agent.
curl -s https://api.creditkarma.com/graphql -X POST \
  -H "Authorization: Bearer $ACCESS" \
  -H 'Content-Type: application/json' \
  -H 'ck-client-name: prime_web' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/requests.md (reported line 106)May include surrounding context.

md
after=null
while :; do
  build_body "$after" > /tmp/ck-body.json
  curl -s https://api.creditkarma.com/graphql -X POST \
    -H "Authorization: Bearer $ACCESS" \
    -H 'Content-Type: application/json' \
    -H 'Origin: https://www.creditkarma.com' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/requests.md (reported line 140)May include surrounding context.

sh
GLID=$(node -e "console.log(JSON.parse(Buffer.from(process.argv[1].split('.')[1],'base64url').toString()).glid||'')" "$ACCESS")

curl -s https://api.creditkarma.com/mobile/4.5/oauth2/token -X POST \
  -H 'content-type: application/json' \
  -H 'accept: multipart/mixed; deferSpec=20220824, application/json' \
  -H 'Origin: https://www.creditkarma.com' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/requests.md (reported line 72)May include surrounding context.

md
# ck-client-name MUST be exactly `prime_web` (`web` is rejected) and
# ck-client-version must be non-empty; its value is not checked. Nothing else
# is required — no cookies, no Origin/Referer/User-Agent.
curl -s https://api.creditkarma.com/graphql -X POST \
  -H "Authorization: Bearer $ACCESS" \
  -H 'Content-Type: application/json' \
  -H 'ck-client-name: prime_web' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/requests.md (reported line 106)May include surrounding context.

md
after=null
while :; do
  build_body "$after" > /tmp/ck-body.json
  curl -s https://api.creditkarma.com/graphql -X POST \
    -H "Authorization: Bearer $ACCESS" \
    -H 'Content-Type: application/json' \
    -H 'Origin: https://www.creditkarma.com' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/requests.md (reported line 140)May include surrounding context.

sh
GLID=$(node -e "console.log(JSON.parse(Buffer.from(process.argv[1].split('.')[1],'base64url').toString()).glid||'')" "$ACCESS")

curl -s https://api.creditkarma.com/mobile/4.5/oauth2/token -X POST \
  -H 'content-type: application/json' \
  -H 'accept: multipart/mixed; deferSpec=20220824, application/json' \
  -H 'Origin: https://www.creditkarma.com' \

The workflow saves authentication tokens and financial data to temporary files without a privacy or credential-handling warning.

Medium
Category
Output Handling
Confidence
98% confidence
Finding

The workflow writes access and potentially refresh tokens to the predictable path /tmp/ck-refresh.json, and financial records to /tmp/ck-resp.json, without restrictive permissions or cleanup. Depending on the environment, other local users could read these files, and predictable filenames introduce precreation or symlink risks; stolen refresh tokens could enable continued unauthorized account access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.