Tmp.1v9UY6NaDu

• Outcome: Review
• Latest audit: Jul 30, 2026 · 4:34 PM UTC
• Version: 2.3.2

Overview

This skill is purpose-built for Credit Karma transaction analysis, but it handles live financial session cookies and stores sensitive financial data in ways users should review carefully.

Install only if you are comfortable giving this MCP access to your active Credit Karma session and local transaction history. Treat CK_COOKIES as a password-equivalent secret, avoid pasting it into chat when possible, protect or delete any .env/config/database files when done, and review the fetched npm package and fetchproxy extension before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill explicitly instructs users to copy a full authenticated Credit Karma Cookie header and place it into Claude configuration or environment variables, but does not clearly warn that these cookies are equivalent to active financial-session credentials. Anyone who obtains those values can potentially impersonate the user to access account and transaction data until expiry, and storing them in config files increases the chance of accidental disclosure through logs, backups, screenshots, or repo commits.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: Persisting copied Credit Karma session cookies to a local .env file stores live financial authentication material on disk in plaintext, yet the skill provides no warning about the sensitivity of that data. This creates a clear credential-exposure risk from local compromise, backups, developer tooling, or accidental file sharing.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill states that it syncs Credit Karma transactions into a local SQLite database without clearly informing users that personal financial records will be stored locally. While local storage is not inherently malicious, undisclosed retention of sensitive financial data increases privacy and breach exposure if the machine, database file, or backups are accessed by others.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill's documented flow tells the model/user to provide a full authenticated Credit Karma Cookie header to the ck_set_session tool, which then persists it. Routing raw session credentials through the assistant/tool flow is dangerous because the data may be exposed to prompt history, logs, telemetry, screenshots, or unintended downstream processing.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The manual setup directs users to extract the full browser cookie header from DevTools and paste it into Claude configuration. That header contains active session credentials for a financial service, so copying it into assistant-managed configuration materially increases the chance of credential theft, accidental sharing, or long-lived storage in insecure locations.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The workflow section repeatedly instructs users to either set CK_COOKIES in config or call ck_set_session with copied browser cookies, normalizing the transfer of raw financial-session credentials into the assistant ecosystem. Repetition in setup guidance makes unsafe handling more likely and increases the probability of credential leakage through routine use.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

Three onboarding paths, in priority order:

**1. fetchproxy extension (easiest — no env vars):** Install the [fetchproxy 0.3.0 extension](https://github.com/chrischall/fetchproxy), sign into creditkarma.com once, and leave `CK_COOKIES` **unset**. The MCP reads HttpOnly `CKAT` + `CKTRKID` cookies on the first tool call via `chrome.cookies.get`, then operates direct-to-API from Node.

**2. ck_set_session MCP tool:** From within Claude, call `ck_set_session` with a Cookie header you copied from DevTools (see below). The tool persists it to `.env`.

• Confidence: 90% confidence
• Finding: COOKIES` **unset**. The MCP reads HttpOnly `CKAT` + `CKTRKID` cookies on the first tool call via `chrome.cookies.get`, then opera; cookies on the first tool call via `chrome.cookies.get`, then opera

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.