Max Auth

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:02 AM UTC
• Version: 2.2.0

Overview

This auth skill is intended to protect sensitive actions, but the shipped server does not enforce several protections it advertises.

Do not use this skill to protect real sensitive actions or collect real credentials until sessionKey isolation, returnUrl token handling, secret API authorization, CORS, XSS-safe rendering, and dependency locking are fixed and retested.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/auth-server.js:821

Finding

Authentication Token Disclosure Through an Arbitrary Redirect

Content

View full analysis

location.reload(), 500); } } ``` ### Technical Analysis The `returnUrl` query parameter is controlled by the requester. The application neither validates its origin nor restricts it to approved callback paths before appending a valid authentication token. This occurs both when the user already has a session and immediately after successful authentication. Consequently, a URL supplied by an attacker can cause the browser to transmit the token to an arbitrary external host. Placing the token in a query string also exposes it to destination-server access logs, browser history, monitoring infrastructure, reverse proxies, and potentially referrer data. The network request flagged at line 860 posts the password to the relative same-origin `/auth/login` endpoi ...[truncated 1285 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: assets/auth-server.js:250

Finding

Declared Per-Channel Session Isolation Is Not Implemented

Content

View full analysis

{ // ... if (valid) { const token = createSession(ip); auditLog('login', ip, true); sendJSON(res, 200, { success: true, token, expiresAt: Date.now() + SESSION_DURATION_MS }); } }); ``` ### Technical Analysis The documentation declares independent authentication per channel/session key. In practice, the ser ...[truncated 1453 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: assets/auth-server.js:574

Finding

Secret Collection and Retrieval Endpoints Lack Authentication

Content

View full analysis

{ if (!label || !Array.isArray(fields) || fields.length === 0) { sendJSON(res, 400, { error: 'label and fields are required' }); return; } const expireMin = Math.min( Math.max(Number(expires_in_minutes) || 30, 1), 1440 ); const token = generateToken(); const entry = { token, label: String(label), fields: fields.map(f => ({ name: String(f.name), label: String(f.label || f.name), type: ['password', 'textarea'].includes(f.type) ? f.type : 'text' })), sessionKey: sessionKey || session_key || null, expiresAt: Date.now() + expireMin * 60 * 1000, submitted: false, values: null, consumed: false, }; secretForms.set(token, entry); const url = 'https://' + RP_ID + '/auth/secrets/' + token; sendJSON(res, 201, { ok: true, token, url, expires_at: entry.expiresAt }); }); } const secretPollMatch = p.match(/^\/(?:auth\/)?secrets\/([a-f0-9]{64})\/poll$/); if (secretPollMatch && req.method === 'GET') { const token = secretPollMatch[1]; const entry = secretForms.get(token); if (!entry.submitted) { sendJSON(res, 202, { submitted: false }); return; } const values = entry.values; entry.consumed = true; secretForms.delete(token); sendJSON(res, 200, { submitted: true, values }); } ``` A second unauthenticated retrieval endpoint is present at lines 1211–1230: ```javascript if ((p ...[truncated 2488 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/auth-server.js:532

Finding

Wildcard CORS Applies to All Security-Sensitive Endpoints

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: assets/auth-server.js:393

Finding

Stored Script Injection in Generated Secret Forms

Content

View full analysis

Secure Form — Max Auth ` terminates the element before JavaScript parsing occurs. For example, a label containing `` can break out of the intended assignment and execute attacker-controlled JavaScript under the Max Auth origin. Because secret-form creation requires no authentication, an external caller can persist such a payload in the in-memory form entry and distr ...[truncated 1155 chars]

Remediation

View remediation

` element and safely parse its text content. - Escape at least `<`, `>`, `&`, U+2028, and U+2029 when serializing JSON for an HTML context. - Prefer server-rendered HTML with context-aware escaping and no inline JavaScript. - Validate field names against a strict character and length allowlist. - Validate labels and impose conservative length limits. - Require authentication to create forms. - Add a restrictive Content Security Policy using nonces or external scripts, with no `unsafe-inline`. - Add regression tests using ``, encoded closing tags, quotes, backslashes, and Unicode separators. ]]>

T08 · Insecure Dependencies

Note

• Location: assets/package.json:1

Finding

Dependency Installation Is Not Reproducibly Locked

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented behavior promises session-scoped authentication and a constrained auth gate, but the analyzed behavior indicates a global authenticated session, undocumented delegated grants, and unauthenticated secret submission/retrieval endpoints. For a security control, this mismatch is dangerous because users and downstream agents may trust stronger isolation and access restrictions than are actually enforced, enabling authorization bypass, privilege leakage across sessions, or unauthorized secret access.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares no explicit tool scope or permission boundaries even though it clearly relies on network and environment-related capabilities. In an auth-related skill, missing scope declarations increase the chance that an agent or integrator grants broader access than intended, weakening least-privilege guarantees and making misuse or unexpected behavior harder to detect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

To derive the relying-party ID, the code imports child_process and runs tailscale status --json. Spawning subprocesses and interrogating host networking state is not an obvious requirement of a local biometric/password authentication gate as described in the manifest.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The server advertised as an authentication gate also contains delegated grant issuance and secret-collection workflows, materially expanding its authority and attack surface. In an auth component, extra capabilities are especially risky because callers may trust it as a narrow security boundary while it can mint downstream authorization artifacts and broker sensitive data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The secret submission and retrieval endpoints operate without any authentication or authorization, allowing anyone who knows or obtains a token to submit or retrieve sensitive values. This turns the auth server into a general-purpose secret broker, which is far more dangerous in the context of a trusted local authentication gate because other components may assume secrets handled by it are protected by prior authentication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

These endpoints collect arbitrary sensitive fields and later return them, but the user-facing form only presents generic 'secure' messaging and does not clearly disclose who will receive the secrets, how they are stored, or that retrieval is plaintext. In a security/auth skill, such opaque secret handling can mislead users into entering credentials or keys under stronger trust assumptions than the implementation actually provides.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Accepting the master password as a command-line argument exposes it to process listings, shell history, audit tooling, and potentially other local users. For a master credential protecting sensitive actions, this is an avoidable secret exposure path that undermines the strength of the authentication system.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

Installation

bash

mkdir -p ~/.max-auth && cd ~/.max-auth
cp <skill-path>/assets/auth-server.js .
cp <skill-path>/assets/package.json .
npm install

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api.md (reported line 19)May include surrounding context.

Installation

bash

mkdir -p ~/.max-auth && cd ~/.max-auth
cp <skill-path>/assets/auth-server.js .
cp <skill-path>/assets/package.json .
npm install

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/api.md (reported line 30)May include surrounding context.

systemd example

bash

sudo tee /etc/systemd/system/max-auth.service > /dev/null <<'EOF'
[Unit]
Description=Max Auth Server
After=network.target

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/api.md (reported line 55)May include surrounding context.

systemd example

bash

sudo tee /etc/systemd/system/max-auth.service > /dev/null <<'EOF'
[Unit]
Description=Max Auth Server
After=network.target

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/integration.md (reported line 92)May include surrounding context.

md

## Rule

Do not proceed with sensitive work if the relevant session key is not authenticated.
Do not ask the user to paste secrets into chat when `request_secret` is available.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The password login failure path returns STRINGS.pt.wrong_pwd regardless of the user's selected or detected language. This violates the language-choice policy because it imposes Portuguese on all users instead of honoring locale selection or using a neutral default consistently.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

On incorrect password during passkey registration, the server responds with STRINGS.pt.wrong_pwd independent of user locale. This is a natural-language policy issue because it overrides language preference and forces Portuguese output.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency is specified with a caret range (^13.0.0), which allows newer minor and patch versions to be installed without review. In a security-sensitive authentication component, this weakens supply-chain control and can unexpectedly pull in vulnerable or behavior-changing releases.

Content

Scanner excerpt · assets/package.json (reported line 7)May include surrounding context.

json

"description": "Max Auth Server — biometric passkey + master password auth for OpenClaw sensitive actions",
  "main": "auth-server.js",
  "dependencies": {
    "@simplewebauthn/server": "^13.0.0"
  }
}

Unverifiable Dependency: @simplewebauthn/server has 1 known advisory(ies) (GHSA-6hxq-p678-4hr2 (SimpleWebAuthn: Registration verification does not sufficiently ensure that atte)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The manifest references @simplewebauthn/server without an exact version pin, while the package has a known advisory affecting some releases. Because this skill implements authentication with WebAuthn, uncertainty about whether an affected version may be installed is more dangerous than in a non-security feature: a vulnerable auth library could undermine registration or attestation validation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: assets/auth-server.js:44

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: assets/auth-server.js:25

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: assets/auth-server.js:242