ClawHub
Back to skill

Security audit

Mixpanel Analytics

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Mixpanel analytics helper, but raw exports and profile lookups may expose sensitive user data and should be used carefully.

Install only for agents/users authorized to access the target Mixpanel project. Use a least-privilege Mixpanel service account, avoid legacy broad API secrets where possible, limit raw exports, and avoid pasting profile or event output into places where personal or internal analytics data should not appear.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tainted flow: 'req' from os.environ.get (line 270, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req = urllib.request.Request(url, headers={"Authorization": auth_header})
    try:
        with urllib.request.urlopen(req) as resp:
            content = resp.read().decode()
            try:
                return json.loads(content)
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 270, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req = urllib.request.Request(url, headers={"Authorization": auth_header})
    try:
        with urllib.request.urlopen(req) as resp:
            content = resp.read().decode()
            try:
                return json.loads(content)
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 270, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req = urllib.request.Request(url, headers={"Authorization": auth_header})
    try:
        with urllib.request.urlopen(req) as resp:
            content = resp.read().decode()
            try:
                return json.loads(content)
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The code substantially matches the declared Mixpanel analytics purpose: it queries event names and segmentation, funnels, retention, user profiles (read-only), and raw event exports against Mixpanel endpoints. It also uses the declared credential model. However, two declared capabilities are not present in the supplied code: there is no functionality to update user profiles, and there is no command or endpoint usage for listing cohorts. This is a description-to-behavior mismatch due to overclaiming supported capabilities, even though the primary purpose and accessed resource are otherwise consistent.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill requires environment secrets and performs outbound network access to Mixpanel, but it does not declare any explicit tool scope or allowed permissions. This weakens least-privilege controls and can let an agent invoke the skill with broader capabilities than reviewers or policy systems expect.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly supports user profile lookup and raw event export, both of which commonly expose personal data, identifiers, and behavioral telemetry, yet the documentation omits any privacy, minimization, or handling warning. In practice this increases the chance of over-collection, inappropriate use, or accidental disclosure of sensitive analytics data by agents or operators.

Session Persistence

Medium
Category
Rogue Agent
Content
export MIXPANEL_PROJECT_ID="12345678"
```

Get these: Mixpanel → Organization Settings → Service Accounts → Create Service Account

### Option B — API Secret (legacy / project-level)
Confidence
80% confidence
Finding
The skill instructs users to export long-lived credentials as environment variables, which commonly persist for the shell session and may be inherited by subprocesses, captured in session history, or exposed to unrelated tools running in the same context. Because these secrets authorize access to analytics data, compromise of the session environment can lead to unauthorized data access or exfiltration.

External Transmission

Medium
Category
Data Exfiltration
Content
region = os.environ.get("MIXPANEL_DATA_REGION", "us").lower()
    if region == "eu":
        return "https://data-eu.mixpanel.com/api/2.0"
    return "https://data.mixpanel.com/api/2.0"

def get_auth():
    """Returns (auth_header_value, project_id)"""
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
region = os.environ.get("MIXPANEL_DATA_REGION", "us").lower()
    if region == "eu":
        return "https://data-eu.mixpanel.com/api/2.0"
    return "https://data.mixpanel.com/api/2.0"

def get_auth():
    """Returns (auth_header_value, project_id)"""
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
region = os.environ.get("MIXPANEL_DATA_REGION", "us").lower()
    if region == "eu":
        return "https://data-eu.mixpanel.com/api/2.0"
    return "https://data.mixpanel.com/api/2.0"

def get_auth():
    """Returns (auth_header_value, project_id)"""
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The profile command retrieves and prints potentially sensitive user profile properties, including identifiers and Mixpanel properties, without any confirmation, warning, redaction, or access-control guardrails. In an agent context, this increases the risk of accidental disclosure of personal or internal user data into logs, chat transcripts, or downstream tools.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The export command can retrieve and display raw analytics events, including distinct IDs and event properties, directly to stdout with no warning, redaction, or secondary authorization step. In an agent skill, this can expose large volumes of sensitive telemetry or personal data to users, logs, or other integrated systems far beyond what is necessary for many tasks.

Static analysis

No suspicious patterns detected.