T08 · Insecure Dependencies
Warning
- Location
README.md:51- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Native Google Analytics
Security checks for vulnerabilities and agentic risk
Overview
This skill matches its stated purpose of reading GA4 reports through Google APIs, but users should treat the OAuth refresh token and client secret as sensitive credentials.
Install only if you are comfortable giving the skill read-only access to GA4 data through your Google account. Store GOOGLE_CLIENT_SECRET and GOOGLE_REFRESH_TOKEN in a protected secret store or local environment, never commit or paste them into shared logs/chats/issues, and consider using the bundled ga4_auth.py path instead of the documented unpinned pip install where possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ga4_auth.py:62- Finding
Long-Lived OAuth Refresh Token Printed in Plaintext
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Tainted flow: 'req' from os.environ.get (line 38, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python headers={"Content-Type": "application/x-www-form-urlencoded"}, ) try: with urllib.request.urlopen(req) as resp: return json.loads(resp.read())["access_token"] except urllib.error.HTTPError as e: print(f"Auth error: {e.read().decode()}", file=sys.stderr)
Tainted flow: 'req' from os.environ.get (line 38, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python headers={"Content-Type": "application/x-www-form-urlencoded"}, ) try: with urllib.request.urlopen(req) as resp: return json.loads(resp.read())["access_token"] except urllib.error.HTTPError as e: print(f"Auth error: {e.read().decode()}", file=sys.stderr)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is presented as a GA4 reporting/query tool, but the setup instructions also direct users through OAuth credential creation and refresh-token acquisition via Google Accounts endpoints. While this may be operationally necessary, it expands behavior beyond simple analytics querying and can surprise users into handling sensitive OAuth credentials without a clear up-front disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README instructs users to generate and store a Google OAuth client secret and long-lived refresh token, but it does not explicitly warn that these values are sensitive credentials that must be protected and never committed, shared, or logged. If exposed, an attacker could use them to obtain access tokens and read GA4 analytics data for the associated property, making the omission a real security weakness in setup guidance.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill requires environment variables containing OAuth client secrets and a refresh token, and it performs direct network access to Google APIs, but it does not declare any explicit tool scope such as permissions or allowed-tools. That weakens the security boundary by obscuring what sensitive capabilities the skill needs, making accidental overexposure of secrets and network access more likely in agent environments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description does not prominently warn that the skill depends on stored OAuth credentials and transmits analytics queries and resulting data to Google's API. In agent ecosystems, insufficient disclosure around external data transfer and secret usage can lead to uninformed use of sensitive accounts or data.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
text https://www.googleapis.com/auth/analytics.readonlyThis is listed as a "sensitive scope" by Google. If your app is Internal, no verification is needed.
4. Enable the Analytics Data API
Tainted flow: 'req' from input (line 46, user input) → urllib.request.urlopen (network output)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python ) try: with urllib.request.urlopen(req) as resp: tokens = json.loads(resp.read()) except urllib.error.HTTPError as e: print(f"Error: {e.read().decode()}", file=sys.stderr)
Static analysis
No suspicious patterns detected.