Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently manages Tokei campaigns and clearly discloses its sensitive operations, including publishing, participant creation, and webhooks.
Use an expiring read-only key unless changes are needed, and pin the package version. With write access, ensure your agent follows the approval instructions before public changes, participant imports, or live webhooks. Protect participant data and webhook secrets, use only trusted webhook destinations, and record marketing consent only when actually collected. Deleting a webhook also deletes its delivery history.
.Public and destructive operations lack an enforced approval gate
An Agent invocation without the required sign-off can make a draft public. Webhook deletion can remove a subscription and, according to its manifest description, its queued and historical delivery records.
The description declares page and campaign management and read access to signups and related results, but does not declare creating participant entries or assigning their points. The supplied command performs that additional write capability. It remains within the Tokei platform, but its entry-creation behavior is not represented in the declared description.
Most tested behavior matches the declared Tokei campaign-management purpose. However, entries:create is a distinct participant-data write capability not disclosed by the description's read-oriented treatment of signups. The tests explicitly expect a POST containing participant identity and points data. This assessment is limited to the supplied test file: HTTP requests are mocked, and the underlying implementation is not included. Untested advertised features are not treated as mismatches.
Most tested functionality aligns with the description, and MCP transport is a supporting implementation detail. However, entries_create is a distinct write capability affecting participant records that is not disclosed by the stated page-management and signup-reading capabilities. The tests explicitly expect entry-creation POST requests and forwarding marketing_consent. This assessment is limited to the supplied tests; the implementation and live API behavior were not provided or verified.
The entries:create command is an additional write capability affecting campaign participants and points, rather than merely reading signup information or configuring pages. The remaining commands align with the declared purpose or are supporting interfaces, such as authentication checks, help, and the MCP server. No unrelated resource access or exfiltration is evident in the supplied chunk.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
expect(h.err).toEqual([]);
});
it("webhooks:delete <webhookId> -> DELETE /api/v1/webhooks/:id, no request body", async () => {
const h = harness();
const code = await main(["webhooks:delete", "w-1"], h.io);
expect(code).toBe(0);
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
expect(res.result.content.length).toBe(1);
});
it("webhooks_delete -> DELETE /api/v1/webhooks/:id", async () => {
const h = harness();
const session = createMcpSession(h.io);
await rpc(session, {
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Although this example invokes CLI help rather than an MCP server, npx tokei-agent --help can download and execute an unpinned package version when no suitable local installation exists. A compromised future release could execute code with the user's privileges and access local files or available credentials; the README provides no evidence that the package is currently malicious.
The MCP configuration runs npx -y tokei-agent mcp without pinning a version, allowing subsequent launches to resolve an unreviewed release while suppressing the installation prompt. A compromised release would execute locally with the supplied TOKEI_API_KEY, potentially exposing account data or modifying campaigns and webhooks when the key permits writes.
Without declared permissions the skill's intent is opaque and cannot be validated.
The unversioned npx command can download and execute a changing package release, even though this particular example only requests help rather than starting an MCP server. A compromised future release could execute with the agent's local privileges and access available credentials; the unpinned global-install alternative has the same underlying supply-chain exposure.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
whatever was originally configured.
3. **Some types need a deployment prerequisite — warn the human before adding one.** `linkedin_share`/`linkedin_post` need the `linkedin_oidc` provider enabled on this deployment, and all 3 `steam_*` types need Steam login. `actions:catalog`'s `needs` field says this per type — `null` means no prerequisite. X/Twitter, Discord, Facebook, Instagram, TikTok, Twitch, Product Hunt, `linkedin_follow`, `linkedin_company_follow` and link rows have none — safe to add without asking.
4. Draft/publish semantics are unchanged by any of this. Unknown keys are stripped on the way in, never stored.
5. **Link-row rules:** a label that doesn't start with `"Visit Our "` renders as a non-clickable generic row; the clickable, credited path also requires the page to have a `campaign_url` configured.
6. **Rows of one `actionType` are capped, and can carry a stable `id`.** At most 5 rows may share one `actionType` — but only for `twitter_follow`, `instagram_follow` and `f
The MCP registration invokes an unpinned package with npx -y, allowing a changed release to execute without an installation confirmation. Because the server receives TOKEI_API_KEY and exposes write-capable API operations when the key permits them, a compromised release could steal the credential or modify campaigns and webhook destinations.
The test at L0662–L0691 verifies that entries:create sends a POST to /api/v1/contests/:id/entries with participant identity, action type, and caller-specified points. The manifest declares reading signups and leaderboards, not creating participant records or awarding points; this additional write capability can affect campaign participation and rankings.
L493–L495 expose entries:create with email, action type, and points, and L209 describes this command as recording an entry. This goes beyond the manifest's stated signup-reading capability: creating participant records and assigning points can affect campaign participation and rankings, rather than merely retrieve signup information.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The manifest describes reading signups, leaderboards, and winner selections, but entries_create maps to POST /contests/{contest_id}/entries (L820-L823), creating participants and allowing up to 10,000 points to be awarded (L791-L795). It also accepts a marketing-consent assertion that can enable email-provider syncing (L805-L807), extending beyond the declared signup-reading capability and potentially affecting competition outcomes and participant communications.
formatCount explicitly selects "en-US", so numeric output follows US formatting conventions regardless of the user's locale. This file provides neither a locale option nor a documented region-specific justification for that constraint.
No suspicious patterns detected.