T09 · Insecure Skill Coding Practices
Error
- Location
civic-tool-runner.ts:35- Finding
Bearer Token Disclosure Through an Unvalidated MCP Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Civic
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a real Civic MCP bridge, but it needs review because it gives an agent broad access to external accounts and has weak safeguards around token destination and sensitive argument logging.
Install only if you trust Civic and understand that the configured token may let the agent access connected services such as Gmail, databases, and storage. Use a least-privilege Civic profile, keep CIVIC_URL on the official HTTPS Civic endpoint, avoid passing secrets in tool arguments, review logs, and confirm sensitive or mutating actions before allowing the agent to run them.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
civic-tool-runner.ts:249- Finding
Sensitive MCP Tool Arguments Are Logged in Plaintext
- Content
View full analysis
0) { console.log(`Args: ${JSON.stringify(toolArgs)}`); } ``` ### Technical Analysis The runner accepts arbitrary JSON arguments for any remotely exposed MCP tool and serializes the complete argument object to standard output before executing the call. There is no field-level redaction, sensitivity classification, output restriction, or secure debug-mode requirement. Tool arguments can contain credentials, authorization codes, email contents, recipient addresses, database statements, personal information, document contents, account identifiers, or other confidential values. Standard output is commonly retained in terminal capture, CI/CD logs, agent execution traces, process supervisors, centralized logging platforms, and support diagnostics. Although the command-line JSON value may already be visible to local process inspection or shell history depending on invocation, unconditional logging creates an additional persistent copy and can distribute it to systems and users that do not otherwise have access to the process arguments. ### Attack Path 1. A user or agent invokes `--call` with confidential data in the `--args` JSON object. 2. The runner parses the object into `toolArgs`. 3. Before making the MCP request, the runner serializes the entire object with `JSON.stringify`. 4. The plaintext value is written to standard output. 5. A terminal recorder, CI system, OpenClaw execution log, process supervisor, or centralized log collector retains the output. 6. A user with access to those logs retrieves the confidential arguments. An attacker must be able to induce a call containing sensitive arguments and subsequently access the generated logs, or already have access to a logg ...[truncated 638 chars]- Remediation
View remediation
0) { console.log(`Argument fields: ${Object.keys(toolArgs).join(", ")}`); } ``` For high-sensitivity environments, log only the tool name and omit all argument information. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (32)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### 1. Get your Civic credentials 1. Go to [nexus.civic.com](https://nexus.civic.com) and sign in 2. Get your **MCP URL** and **access token** from your profile settings ### 2. Configure in OpenClaw
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts ### 1. Get your Civic credentials 1. Go to [nexus.civic.com](https://nexus.civic.com) and sign in 2. Get your **MCP URL** and **access token** from your profile settings ### 2. Configure in OpenClaw
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts ### 1. Get your Civic credentials 1. Go to [nexus.civic.com](https://nexus.civic.com) and sign in 2. Get your **MCP URL** and **access token** from your profile settings ### 2. Configure in OpenClaw
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares environment-variable requirements and provides executable command guidance, but it does not define an explicit tool scope such as permissions or allowed-tools. That omission weakens containment and reviewability, making it easier for an agent to invoke external capabilities or handle sensitive credentials without clear policy boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The setup instructions ask users to configure a third-party MCP endpoint and place a long-lived access token into agent configuration, but they do not clearly warn that data and credentials will be transmitted to an external service. In a skill that bridges to Gmail, databases, and storage systems, that missing disclosure increases the risk of unsafe consent and accidental overexposure of sensitive account data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The agent instructions actively demonstrate listing and calling external tools, including Gmail queries, without requiring an explicit warning or confirmation that the action may read or modify data in external accounts. Because the skill targets many integrations, an agent could perform sensitive operations under user credentials with insufficient transparency.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Using
npx tsxwithout a pinned package version can cause the runtime to fetch or resolve whatever version is current at execution time. This creates a supply-chain risk: a malicious or compromised release oftsxor a dependency could execute arbitrary code in the agent environment while handling Civic credentials.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Using
npx tsxwithout a pinned package version can cause the runtime to fetch or resolve whatever version is current at execution time. This creates a supply-chain risk: a malicious or compromised release oftsxor a dependency could execute arbitrary code in the agent environment while handling Civic credentials.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Using
npx tsxwithout a pinned package version can cause the runtime to fetch or resolve whatever version is current at execution time. This creates a supply-chain risk: a malicious or compromised release oftsxor a dependency could execute arbitrary code in the agent environment while handling Civic credentials.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Using
npx tsxwithout a pinned package version can cause the runtime to fetch or resolve whatever version is current at execution time. This creates a supply-chain risk: a malicious or compromised release oftsxor a dependency could execute arbitrary code in the agent environment while handling Civic credentials.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Using
npx tsxwithout a pinned package version can cause the runtime to fetch or resolve whatever version is current at execution time. This creates a supply-chain risk: a malicious or compromised release oftsxor a dependency could execute arbitrary code in the agent environment while handling Civic credentials.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Static analysis
No suspicious patterns detected.