ClawHub
Back to skill

Security audit

Trakt.tv

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate Trakt integration, but it needs review because it stores and prints OAuth secrets while giving the agent account read/write access through raw curl commands.

Install only if you are comfortable giving OpenClaw access to read and modify your Trakt account data. Treat the Trakt client secret, access token, and refresh token as sensitive: do not run the helper in shared or recorded terminals, avoid committing OpenClaw config, restrict config permissions, and revoke or rotate tokens if they were exposed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
get_trakt_token.sh:19
Finding

OAuth Credentials and Tokens Are Exposed in Terminal Input and Output

Content
View full analysis

Vulnerability Details

File Location: get_trakt_token.sh:19-22, get_trakt_token.sh:91-113; the same insecure example is reproduced in SKILL.md:251-253 and SKILL.md:276-282
Vulnerability Type: Plaintext exposure of authentication credentials
Risk Level: Medium

Vulnerable Code

bash
if [ -z "$TRAKT_CLIENT_SECRET" ]; then
    echo -n "Enter your Trakt Client Secret: "
    read TRAKT_CLIENT_SECRET
fi
bash
echo "Add these to ~/.openclaw/openclaw.json:"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
echo '{
  "skills": {
    "entries": {
      "trakt": {
        "enabled": true,
        "env": {
          "TRAKT_CLIENT_ID": "'"$TRAKT_CLIENT_ID"'",
          "TRAKT_CLIENT_SECRET": "'"$TRAKT_CLIENT_SECRET"'",
          "TRAKT_ACCESS_TOKEN": "'"$ACCESS_TOKEN"'",
          "TRAKT_REFRESH_TOKEN": "'"$REFRESH_TOKEN"'"
        }
      }
    }
  }
}'
echo ""
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo "Or export as environment variables:"
echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
echo ""
echo "export TRAKT_CLIENT_ID=\"$TRAKT_CLIENT_ID\""
echo "export TRAKT_CLIENT_SECRET=\"$TRAKT_CLIENT_SECRET\""
echo "export TRAKT_ACCESS_TOKEN=\"$ACCESS_TOKEN\""
echo "export TRAKT_REFRESH_TOKEN=\"$REFRESH_TOKEN\""

Technical Analysis

The helper reads TRAKT_CLIENT_SECRET using the normal read command, leaving terminal echo enabled. The secret is therefore visibly displayed while the user types it. After completing the OAuth exchange, the script prints the client secret, access token, and refresh token in plaintext.

These values can be retained in terminal scrollback, screen recordings, CI logs, remote-session transcripts, support captures, or other console-monitoring systems. The refresh token is particularly sensitive because it can potentially be exchanged for new access toke ...[truncated 1477 chars]

Remediation
View remediation

Remediation Suggestions

  1. Read secrets without terminal echo and restore formatting afterward:

    bash
    read -rsp "Enter your Trakt Client Secret: " TRAKT_CLIENT_SECRET
printf '\n'

  2. Do not print client secrets, access tokens, or refresh tokens to standard output.

  3. If automatic configuration is required, request explicit user consent and write the values directly to a configuration file created with restrictive permissions:

    bash
    umask 077
install -m 600 /dev/null "$HOME/.openclaw/openclaw.json"

  4. Avoid overwriting an existing configuration file without confirmation. Prefer securely merging only the required fields.

  5. Redact sensitive values in all success and error messages.

  6. Update the helper example in SKILL.md so it does not print tokens.

  7. Warn users not to run credential-generation workflows in recorded terminals or CI environments.

  8. Advise users who have already exposed these values to revoke the affected authorization and rotate the client secret and OAuth tokens.

T08 · Insecure Dependencies

Note
Location
README.md:20
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: README.md:20-21 and README.md:190-192
Vulnerability Type: Unpinned supply-chain dependency installed globally
Risk Level: Low

Vulnerable Code

Installation instructions:

bash
npm install -g clawhub
clawhub install trakt

Publishing instructions:

bash
npm install -g clawhub
clawhub login
clawhub publish . --slug trakt --name "Trakt" --version 1.0.0 --tags latest

Technical Analysis

The documentation directs users to globally install clawhub without specifying a reviewed version or package integrity value. npm will resolve the package version available under that name at installation time. Consequently, the effective code installed can change independently of this audited project.

npm packages can define lifecycle scripts that execute during installation. If the registry package, maintainer account, release process, or a newly resolved package version is compromised, installation could execute attacker-controlled code with the privileges of the user running npm. Global installation also broadens the package's availability and potential effect beyond this project.

This finding does not establish that the current clawhub package is malicious. The risk arises from the unpinned, mutable dependency resolution and global installation instruction.

Attack Path

  1. An attacker compromises the relevant npm publisher account, package release pipeline, or another component of the package's supply chain.
  2. The attacker publishes a malicious version under the package name used by the documentation.
  3. A user follows the README and runs npm install -g clawhub without a version or integrity pin.
  4. npm resolves the attacker-controlled release and may execute its lifecycle scripts.
  5. The malicious package executes with the invoking user's privileges and remains globally available to that user.
  6. Depending on those privileges, the pac ...[truncated 722 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a specifically reviewed version:

    bash
    npm install -g clawhub@<reviewed-version>

  2. Document the expected official publisher and registry source so users can verify package identity.

  3. Verify package provenance, signatures, and integrity metadata where supported.

  4. Review the package's lifecycle scripts and dependency tree before recommending installation.

  5. Prefer a project-local, least-privileged installation instead of a global installation when practical.

  6. Do not recommend running the installation command with sudo or an administrator account.

  7. Periodically review and deliberately update the pinned version after security assessment rather than automatically consuming the latest release.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (43)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 47)May include surrounding context.

md
- **Redirect URI**: `urn:ietf:wg:oauth:2.0:oob`
4. Save and note your **Client ID** and **Client Secret**

### Step 2: Get OAuth Access Token

Run the included helper script:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · get_trakt_token.sh (reported line 84)May include surrounding context.

sh
- **Redirect URI**: `urn:ietf:wg:oauth:2.0:oob`
4. Save and note your **Client ID** and **Client Secret**

### Step 2: Get OAuth Access Token

Run the included helper script:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 172)May include surrounding context.

Token Refresh

Access tokens expire after 3 months. To refresh:

bash
curl -X POST https://api.trakt.tv/oauth/token \

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The skill prominently instructs use and storage of sensitive client secrets and access tokens, which creates credential exposure risk if configs, terminals, logs, or examples are mishandled. In an agent environment, compromised tokens can allow unauthorized reads and account modifications against the user's Trakt account.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

  1. Create a Trakt application at https://trakt.tv/oauth/applications
  2. Get your Client ID and Client Secret
  3. Complete OAuth flow to get an access token
  4. Set environment variables in ~/.openclaw/openclaw.json:
json

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

Telling the agent to always use curl with headers containing the access token increases the chance the bearer token appears in shell history, process listings, transcripts, or debug logs. Bearer tokens are sufficient for account access, so leakage can directly expose private data and enable unauthorized account actions.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md
When the user asks to interact with Trakt:

1. **Always use curl** with proper headers including the access token
2. **Required headers** for all requests:
   - `trakt-api-version: 2`
   - `trakt-api-key: $TRAKT_CLIENT_ID`

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The helper script handles OAuth codes, client secrets, access tokens, and refresh tokens in a way that can expose them on-screen and encourage plaintext reuse. These credentials grant durable access, so accidental disclosure through terminal output, saved scripts, screenshots, or shell logs can compromise the account.

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

Getting OAuth Token

To get an access token, use this helper script:

bash
#!/bin/bash

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · get_trakt_token.sh (reported line 48)May include surrounding context.

sh
fi

echo ""
echo "Exchanging authorization code for access token..."
echo ""

RESPONSE=$(curl -s -X POST https://api.trakt.tv/oauth/token \

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · get_trakt_token.sh (reported line 74)May include surrounding context.

sh
fi

echo ""
echo "Exchanging authorization code for access token..."
echo ""

RESPONSE=$(curl -s -X POST https://api.trakt.tv/oauth/token \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

md
AgentSkills is a standardized format for teaching AI agents how to use tools. Each skill is a folder containing a `SKILL.md` file with YAML frontmatter and usage instructions. OpenClaw loads these skills and makes them available to the agent.

This is **NOT** an MCP server - it's a simple skill file that teaches the agent how to use the Trakt API via curl commands.

## Installation

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

md
## Setup

### Step 1: Create a Trakt Application

1. Go to https://trakt.tv/oauth/applications
2. Click "New Application"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README instructs users to store a long-lived Trakt client secret, access token, and refresh token in a local OpenClaw configuration file without explicitly warning that these are sensitive credentials. If that config file is exposed through backups, local compromise, screen sharing, or accidental commits, an attacker could use the tokens and secret to access or manipulate the user's Trakt account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The token refresh example places the refresh token and client secret directly into a shell command, which can be captured in shell history, process listings, terminal logging, or CI logs. That creates a realistic credential exposure path even though the endpoint itself is legitimate and HTTPS-protected.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 201)May include surrounding context.

md
## Troubleshooting

**Skill not loading:**
- Check `~/.openclaw/skills/trakt/SKILL.md` exists
- Verify permissions: `chmod +r SKILL.md`
- Restart OpenClaw session

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill instructs the agent to use shell-based curl commands but does not declare any tool scope or allowed-tools restrictions. That mismatch weakens policy enforcement and can let an agent execute shell/network actions without explicit least-privilege boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill tells users to store client secrets and OAuth tokens in configuration without warning about sensitivity, exposure, rotation, or least-privilege handling. This increases the chance of credential leakage through logs, backups, shared configs, or accidental disclosure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The setup directs users to persist long-lived OAuth credentials and tokens in local configuration, increasing the blast radius if the host, config file, backups, or profile data are exposed. Persistent sessions are useful operationally, but without safeguards they create a standing authorization target.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
Before using this skill, you need to set up Trakt API credentials:

1. Create a Trakt application at https://trakt.tv/oauth/applications
2. Get your Client ID and Client Secret
3. Complete OAuth flow to get an access token
4. Set environment variables in `~/.openclaw/openclaw.json`:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documented commands perform account-modifying actions such as adding/removing watchlist items and changing history without requiring confirmation or warning the operator. In an agent setting, this can lead to unintended state changes in the user's Trakt account from ambiguous or misinterpreted prompts.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

Add to watchlist:

bash
curl -X POST https://api.trakt.tv/sync/watchlist \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TRAKT_ACCESS_TOKEN" \
  -H "trakt-api-version: 2" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

Add to watchlist:

bash
curl -X POST https://api.trakt.tv/sync/watchlist \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TRAKT_ACCESS_TOKEN" \
  -H "trakt-api-version: 2" \

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.

md
## Notes

- Items are automatically removed from watchlist when marked as watched
- You can use IDs instead of title/year for more accuracy
- Extended info can be requested with `?extended=full` parameter
- All dates should be in UTC ISO 8601 format

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script interactively requests a Trakt client secret and later sends it to the Trakt OAuth token endpoint, but it does not clearly warn the user that they are entering sensitive credentials or suppress terminal echo while typing. In a local helper script this is not inherently malicious, but it increases the chance of accidental exposure through shoulder-surfing, screen recording, or unsafe operator assumptions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 175)May include surrounding context.

md
echo "Exchanging authorization code for access token..."
echo ""

RESPONSE=$(curl -s -X POST https://api.trakt.tv/oauth/token \
  -H "Content-Type: application/json" \
  -d "{
    \"code\": \"$CODE\",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
echo "Exchanging authorization code for access token..."
echo ""

RESPONSE=$(curl -s -X POST https://api.trakt.tv/oauth/token \
  -H "Content-Type: application/json" \
  -d "{
    \"code\": \"$CODE\",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
echo "Exchanging authorization code for access token..."
echo ""

RESPONSE=$(curl -s -X POST https://api.trakt.tv/oauth/token \
  -H "Content-Type: application/json" \
  -d "{
    \"code\": \"$CODE\",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
echo "Exchanging authorization code for access token..."
echo ""

RESPONSE=$(curl -s -X POST https://api.trakt.tv/oauth/token \
  -H "Content-Type: application/json" \
  -d "{
    \"code\": \"$CODE\",

Static analysis

No suspicious patterns detected.