Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent for HoneyBook API access, but it handles live session credentials and includes a real message-sending workflow despite being framed as read-only.
Review this carefully before installing. Use it only if you are comfortable letting an agent capture and replay HoneyBook session credentials from your browser, and avoid storing the captured session JSON or tokens in shared locations, shell history, logs, or screenshots. Treat any message-sending steps as write actions that can contact real vendors, even though the skill is mainly described as read-only.
The skill operationalizes extraction of bearer tokens and user identifiers from browser localStorage and shows how to reuse them directly against the HoneyBook API. These are sensitive session credentials, and the guidance normalizes token harvesting without an up-front warning, least-privilege controls, or secure handling requirements, increasing the chance of credential misuse or leakage.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
same endpoint):
API_VERSION=$(curl -s 'https://api.honeybook.com/api/gon?callback=parseGon' \
| grep -oE '"api_version":[[:space:]]*[0-9]+' | grep -oE '[0-9]+$')
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
same endpoint):
API_VERSION=$(curl -s 'https://api.honeybook.com/api/gon?callback=parseGon' \
| grep -oE '"api_version":[[:space:]]*[0-9]+' | grep -oE '[0-9]+$')
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
same endpoint):
API_VERSION=$(curl -s 'https://api.honeybook.com/api/gon?callback=parseGon' \
| grep -oE '"api_version":[[:space:]]*[0-9]+' | grep -oE '[0-9]+$')
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
same endpoint):
API_VERSION=$(curl -s 'https://api.honeybook.com/api/gon?callback=parseGon' \
| grep -oE '"api_version":[[:space:]]*[0-9]+' | grep -oE '[0-9]+$')
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
same endpoint):
API_VERSION=$(curl -s 'https://api.honeybook.com/api/gon?callback=parseGon' \
| grep -oE '"api_version":[[:space:]]*[0-9]+' | grep -oE '[0-9]+$')
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
same endpoint):
API_VERSION=$(curl -s 'https://api.honeybook.com/api/gon?callback=parseGon' \
| grep -oE '"api_version":[[:space:]]*[0-9]+' | grep -oE '[0-9]+$')
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
same endpoint):
API_VERSION=$(curl -s 'https://api.honeybook.com/api/gon?callback=parseGon' \
| grep -oE '"api_version":[[:space:]]*[0-9]+' | grep -oE '[0-9]+$')
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
same endpoint):
API_VERSION=$(curl -s 'https://api.honeybook.com/api/gon?callback=parseGon' \
| grep -oE '"api_version":[[:space:]]*[0-9]+' | grep -oE '[0-9]+$')
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
same endpoint):
API_VERSION=$(curl -s 'https://api.honeybook.com/api/gon?callback=parseGon' \
| grep -oE '"api_version":[[:space:]]*[0-9]+' | grep -oE '[0-9]+$')
The skill is described as a read-only HoneyBook data access workflow, but it includes explicit instructions for a live outbound message-sending operation via the HoneyBook API. This expands the operational capability beyond the declared scope and creates a real risk of unintended external actions against client/vendor communications.
Although the text notes that the action will email the vendor, it does not require explicit confirmation before performing the real outbound operation. In a skill ecosystem, omission of a confirmation step for irreversible or externally visible actions raises the risk of accidental messages being sent to real parties.
The inline guidance explicitly states that the workflow can email the vendor for real, which contradicts the skill's stated read-only purpose. A user or downstream agent relying on the metadata could invoke the skill assuming passive retrieval, when it actually documents a side-effecting action.
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Session data (`AUTH_TOKEN`, `TRUSTED_DEVICE`) is opaque and
long-lived server-side (no client-visible JWT expiry) — keep it in shell
variables, not a world-readable file, if you must persist it at all.
- This project is developed and maintained by AI (Claude).
The document explicitly instructs users to capture live HoneyBook authentication headers and replay them with curl, which exposes session-equivalent secrets such as auth tokens, user IDs, and optional trusted-device values outside the original browser context. In this skill’s context, those credentials grant direct access to sensitive client-portal data including contracts, invoices, proposals, workspace details, and saved payment methods, so leakage through shell history, logs, screenshots, temp files, or shared scripts can cause unauthorized data access and privacy violations.
No suspicious patterns detected.