ClawHub
Back to skill

Security audit

Mixpanel Analytics

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Mixpanel analytics helper, but raw exports and profile lookups may expose sensitive user data and should be used carefully.

Install only for agents/users authorized to access the target Mixpanel project. Use a least-privilege Mixpanel service account, avoid legacy broad API secrets where possible, limit raw exports, and avoid pasting profile or event output into places where personal or internal analytics data should not appear.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tainted flow: 'req' from os.environ.get (line 270, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/mx.py (reported line 53)May include surrounding context.

python
req = urllib.request.Request(url, headers={"Authorization": auth_header})
    try:
        with urllib.request.urlopen(req) as resp:
            content = resp.read().decode()
            try:
                return json.loads(content)

Tainted flow: 'req' from os.environ.get (line 270, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/mx.py (reported line 227)May include surrounding context.

python
req = urllib.request.Request(url, headers={"Authorization": auth_header})
    try:
        with urllib.request.urlopen(req) as resp:
            content = resp.read().decode()
            try:
                return json.loads(content)

Tainted flow: 'req' from os.environ.get (line 270, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/mx.py (reported line 273)May include surrounding context.

python
req = urllib.request.Request(url, headers={"Authorization": auth_header})
    try:
        with urllib.request.urlopen(req) as resp:
            content = resp.read().decode()
            try:
                return json.loads(content)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The code substantially matches the declared Mixpanel analytics purpose: it queries event names and segmentation, funnels, retention, user profiles (read-only), and raw event exports against Mixpanel endpoints. It also uses the declared credential model. However, two declared capabilities are not present in the supplied code: there is no functionality to update user profiles, and there is no command or endpoint usage for listing cohorts. This is a description-to-behavior mismatch due to overclaiming supported capabilities, even though the primary purpose and accessed resource are otherwise consistent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill requires environment secrets and performs outbound network access to Mixpanel, but it does not declare any explicit tool scope or allowed permissions. This weakens least-privilege controls and can let an agent invoke the skill with broader capabilities than reviewers or policy systems expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly supports user profile lookup and raw event export, both of which commonly expose personal data, identifiers, and behavioral telemetry, yet the documentation omits any privacy, minimization, or handling warning. In practice this increases the chance of over-collection, inappropriate use, or accidental disclosure of sensitive analytics data by agents or operators.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

The skill instructs users to export long-lived credentials as environment variables, which commonly persist for the shell session and may be inherited by subprocesses, captured in session history, or exposed to unrelated tools running in the same context. Because these secrets authorize access to analytics data, compromise of the session environment can lead to unauthorized data access or exfiltration.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

export MIXPANEL_PROJECT_ID="12345678"

text

Get these: Mixpanel → Organization Settings → Service Accounts → Create Service Account

### Option B — API Secret (legacy / project-level)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
region = os.environ.get("MIXPANEL_DATA_REGION", "us").lower()
    if region == "eu":
        return "https://data-eu.mixpanel.com/api/2.0"
    return "https://data.mixpanel.com/api/2.0"

def get_auth():
    """Returns (auth_header_value, project_id)"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mx.py (reported line 20)May include surrounding context.

python
region = os.environ.get("MIXPANEL_DATA_REGION", "us").lower()
    if region == "eu":
        return "https://data-eu.mixpanel.com/api/2.0"
    return "https://data.mixpanel.com/api/2.0"

def get_auth():
    """Returns (auth_header_value, project_id)"""

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mx.py (reported line 254)May include surrounding context.

python
region = os.environ.get("MIXPANEL_DATA_REGION", "us").lower()
    if region == "eu":
        return "https://data-eu.mixpanel.com/api/2.0"
    return "https://data.mixpanel.com/api/2.0"

def get_auth():
    """Returns (auth_header_value, project_id)"""

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The profile command retrieves and prints potentially sensitive user profile properties, including identifiers and Mixpanel properties, without any confirmation, warning, redaction, or access-control guardrails. In an agent context, this increases the risk of accidental disclosure of personal or internal user data into logs, chat transcripts, or downstream tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The export command can retrieve and display raw analytics events, including distinct IDs and event properties, directly to stdout with no warning, redaction, or secondary authorization step. In an agent skill, this can expose large volumes of sensitive telemetry or personal data to users, logs, or other integrated systems far beyond what is necessary for many tasks.

Content

No source excerpt is available for this finding.