creditkarma

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:05 PM UTC
• Version: 2.8.2

Overview

The skill is coherent for Credit Karma analysis, but it asks users to expose and persist sensitive financial session cookies with insufficient safeguards.

Review this carefully before installing. Only use it on a trusted machine, avoid project-local .env or MCP config for cookies, pin and verify the MCP package/source before running it, restrict file permissions, and treat the local SQLite database as sensitive financial data. Prefer a safer official authentication flow or secret manager if available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:15
• Finding: Unpinned Third-Party Package and Source Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15–38 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```markdown ### Option A — npx (recommended) Add to `.mcp.json` in your project or `~/.claude/mcp.json`: ```json { "mcpServers": { "creditkarma": { "command": "npx", "args": ["-y", "creditkarma-mcp"], "env": { "CK_COOKIES": "CKTRKID=...; CKAT=eyJ...%3BeyJ...; ..." } } } } ``` ### Option B — from source ```bash git clone https://github.com/chrischall/creditkarma-mcp cd creditkarma-mcp npm install && npm run build ``` ``` ### Technical Analysis The recommended configuration executes `npx -y creditkarma-mcp` without pinning an exact package version or verifying package integrity. The `-y` option suppresses the installation confirmation, and the unversioned package name resolves to whichever release the npm registry serves when the MCP server starts. The source-installation alternative also clones the repository's current default branch rather than a reviewed commit and runs `npm install` followed by a package-defined build script. This delegates local code execution to a mutable remote repository and its transitive dependency graph. Because the resulting MCP process receives `CK_COOKIES`, a compromised package, maintainer account, repository, or dependency could access authenticated financial-session credentials. It could also execute commands with the operating-system privileges of the user running the MCP server. The audit did not establish that the referenced package or repository is currently malicious. The vulnerability is the unsafe, mutable dependency execution model. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, the source repository, or a transitive dependency. 2. The attacker publishes a modified package release or changes the repository's default branch. 3. A user starts the con ...[truncated 1065 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `creditkarma-mcp` to an exact, reviewed version instead of resolving the latest package: ```json "args": ["creditkarma-mcp@<audited-version>"] ``` 2. Do not use automatic confirmation for first-time or unreviewed package execution. 3. Pin source installations to a reviewed immutable commit: ```bash git checkout <reviewed-commit-hash> ``` 4. Commit and enforce a lockfile for all dependencies. 5. Verify npm integrity metadata, package provenance, signatures, and repository ownership before execution. 6. Disable unnecessary npm lifecycle scripts where feasible, or audit every script before allowing it to run. 7. Run the MCP server in a sandbox or restricted account with access only to its required database and credentials. 8. Separate dependency installation from runtime credential injection so installation and build scripts cannot access `CK_COOKIES`. 9. Vendor the reviewed server implementation when stronger supply-chain assurance is required. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:43
• Finding: Plaintext Persistence and Broad Handling of Authenticated Financial Session Cookies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43–71 **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: High ### Vulnerable Code ```markdown Then add to `.mcp.json`: ```json { "mcpServers": { "creditkarma": { "command": "node", "args": ["/path/to/creditkarma-mcp/dist/index.js"], "env": { "CK_COOKIES": "CKTRKID=...; CKAT=eyJ...%3BeyJ...; ..." } } } } ``` Or use a `.env` file in the project directory with `CK_COOKIES=<value>`. ### Getting CK_COOKIES (optional) Three onboarding paths, in priority order: **1. fetchproxy extension (easiest — no env vars):** Install the [fetchproxy 0.3.0 extension](https://github.com/chrischall/fetchproxy), sign into creditkarma.com once, and leave `CK_COOKIES` **unset**. The MCP reads HttpOnly `CKAT` + `CKTRKID` cookies on the first tool call via `chrome.cookies.get`, then operates direct-to-API from Node. **2. ck_set_session MCP tool:** From within Claude, call `ck_set_session` with a Cookie header you copied from DevTools (see below). The tool persists it to `.env`. **3. Manual (DevTools):** 1. Log in to [creditkarma.com](https://www.creditkarma.com) in Chrome 2. DevTools → **Network** → any creditkarma.com request → **Request Headers** 3. Right-click the `cookie` header → **Copy value** 4. Paste into `CK_COOKIES` in your Claude config ``` ### Technical Analysis The Skill instructs users to copy the complete Cookie header from an authenticated Credit Karma request and store it in `.mcp.json`, Claude configuration, or a project-level `.env` file. The `ck_set_session` workflow explicitly persists the supplied credential to `.env`. Authenticated cookies are bearer-style session secrets. Any process or person that obtains a valid cookie can potentially exercise the same Credit Karma access available to that session. Project configuration and `.env` files are plaintext and may be exposed through source-control commits, backups, ...[truncated 2252 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace project-file credential persistence with an operating-system keychain or dedicated secret manager. 2. Do not store the complete Cookie header in `.mcp.json`, Claude configuration, or a project-level `.env` file. 3. Prefer a scoped OAuth, device-authorization, or similarly revocable authentication flow instead of extracting browser-session cookies. 4. If file storage is unavoidable: - Store the secret outside the project directory. - Enforce owner-only permissions such as mode `0600`. - Add `.env` and credential-bearing MCP configuration files to `.gitignore`. - Provide pre-commit secret scanning. - Encrypt credentials at rest. - Delete expired credentials promptly. 5. Store only the minimum cookie fields necessary rather than the complete Cookie header. 6. Ensure tool arguments, error messages, telemetry, and MCP/agent transcripts redact cookie values. 7. Prevent dependency installation and build processes from inheriting runtime credentials. 8. Clearly document the browser extension's requested host and cookie permissions, and restrict access to the minimum Credit Karma domains and cookie names. 9. Provide explicit credential revocation and rotation instructions for suspected exposure. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The documentation instructs users to store raw Credit Karma cookies in environment files and sync financial records into a local SQLite database, but it omits an explicit warning that both authentication material and sensitive financial history will be written to disk. Users may unknowingly persist highly sensitive data in insecure locations, increasing the risk of credential theft, account takeover, or privacy compromise from local compromise or accidental file exposure.

MCP Config Access

High

• Category: Agent Snooping

Content

### Option A — npx (recommended)

Add to `.mcp.json` in your project or `~/.claude/mcp.json`:

```json
{

• Confidence: 95% confidence
• Finding: The skill explicitly instructs users to place live session cookies in project or global MCP configuration files under ~/.claude/mcp.json, which are local files accessible to other software and potentially exposed through backups, logs, or misconfigured permissions. Because these values authenticate to a financial service, disclosure could enable unauthorized access to account data.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

RKID=...; CKAT=eyJ...%3BeyJ...; ..."
      }
    }
  }
}
```

Or use a `.env` file in the project directory with `CK_COOKIES=<value>`.

### Getting CK_COOKIES (optional)

Three onboarding paths, in priority order:

**1. fetchproxy extension (easiest — no env vars):** Install the [fetchproxy 0.3.0 extension](https://github.com/chrischall/fetchproxy), sign into creditkarma.com once, and leave `CK_COOKIES` **unset**. The MCP reads HttpOnly `CKAT` + `CKTRKID` cookies on the first tool call via `chrome.cookies.get`, then operates direct-to-API from Node.

**2. ck_set_session MCP tool:** From within Claude, call `ck_set_session` with a Cookie header you copied from DevTools (see below). The tool persists it to `.env`.

**3. Manual (DevTools):**
1. Log in to [creditkarma.com](https://www.creditkarma.com) in Chrome
2. DevTools → **Network** → any creditkarma.com request → **Request Headers**
3. Right-click the `cookie` header → **Copy value**
4. Paste into `CK_COOKIES` in your Claude

• Confidence: 97% confidence
• Finding: The skill instructs use of a browser extension and direct access to HttpOnly Credit Karma cookies via chrome.cookies.get, then reuses those cookies from Node to call the service API. This is highly sensitive credential-harvesting behavior consistent with infostealer patterns, and in the context of a financial service it could enable account session theft, unauthorized financial-data access, and broad privacy compromise if the extension, MCP server, or host is untrusted or compromised.

Credential Access

High

• Category: Privilege Escalation

Content

The MCP handles auth automatically once any of the three paths is configured.

- Access token: ~15 min TTL, auto-refreshed transparently
- Refresh token: ~8 hours TTL
- When expired:
  - **fetchproxy path:** sign back into creditkarma.com — the MCP reads fresh cookies on the next tool call

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger text is overly broad for a skill that handles highly sensitive financial data, so it may activate in contexts where the user did not clearly intend to use this specific integration. That increases the chance of unnecessary access to Credit Karma data or prompting users into sensitive session setup flows when a narrower interpretation would have sufficed.

Static analysis

No suspicious patterns detected.