ClawHub
Back to skill

Security audit

juggle-mcp

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its account-reading purpose, but changing its test-server setting could expose your Juggle password through a faulty security check.

Review the credential-destination flaw before using real credentials. Keep JUGGLE_BASE_URL unset and use separate dummy credentials for testing until parsed-host validation is fixed. Prefer named commands over raw get for privacy. Both bundled files were inspected; the referenced upstream API documentation and external MCP implementation were unavailable, so their guarantees remain unverified. No live account access was performed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: network, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
0600, directory 0700). It is this skill's own file; it is not shared with
  juggle-mcp. Set `JUGGLE_SESSION_FILE` to put it somewhere else.
- The password reaches curl through a pipe (`jq -n '{… env.JUGGLE_PASSWORD}' |
  curl --data-binary @-`), so it never appears in argv or `ps`.
- Google- or Facebook-only accounts have no password to POST. Set a password
  on whyjuggle.com first.
- **A rejected password exits 5 and is never retried.** Fix the credentials

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The credential POST is legitimate by default, but its destination validation permits remote plaintext endpoints disguised as loopback URLs: http://***@attacker.example matches the <redacted-url> shell pattern while curl interprets the actual host as attacker.example`. If an attacker can influence JUGGLE_BASE_URL and serve the expected login response with a CSRF token, the helper sends the family's email and password to that remote endpoint over HTTP.

Content

Scanner excerpt · scripts/juggle (reported line 178)May include surrounding context.

text
# 2. POST the credentials. The JSON body is built by jq from the
  #    environment and piped in, so the password never appears in argv.
  out=$(jq -n '{email: env.JUGGLE_EMAIL, password: env.JUGGLE_PASSWORD}' |
    curl -sS --proto "=$PROTO" --max-time 30 -A "$UA" -X POST \
      -H 'X-Requested-With: XMLHttpRequest' -H 'Accept: application/json, text/plain, */*' -H 'X-Client: Website' \
      -H 'Content-Type: application/json' -H "X-CSRF-TOKEN: $csrf" --data-binary @- \
      -c "$TMPJAR" -b "$TMPJAR" -o "$BODY" -w '%{http_code}' "$JUGGLE_BASE_URL/log-in") ||