Security audit

myClub

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to fetch myclub.fi schedules as advertised, but it handles account passwords and session cookies in ways that deserve careful review before installation.

Install only if you are comfortable giving this skill your myclub.fi password and storing it locally. Avoid using the documented --password command with a real password in shared shells or logged agent sessions, and avoid --debug because it can write session cookies and private schedule pages to disk.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: README.md:24
Finding: Plaintext password exposed through command-line arguments
Content: View full analysis
/cmdline` on compatible systems. - Terminal recording and command auditing. - Agent execution transcripts and orchestration logs. - Diagnostic or monitoring software that records process invocations. The setup command subsequently stores the password locally, but that does not remove copies already retained by the shell, process monitor, or calling Agent. ### Attack Path 1. A user follows the documented setup command and places the real myclub.fi password after `--password`. 2. The shell records the command in its history, or the process remains briefly visible in the system process table. 3. Another local user, monitoring process, log collector, or person with later access to the history file retrieves the plaintext password. 4. The attacker authenticates to myclub.fi using the exposed credentials. 5. The attacker gains access to the account and associated account, club, and schedule ...[truncated 443 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fetch_myclub.py:91
Finding: Authenticated HTML and session cookies written to predictable temporary files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_myclub.py:42
Finding: Credential file written before restrictive permissions are applied
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch_myclub.py:267
Finding: HTTPS and myclub.fi endpoint restrictions are not enforced across navigation and redirects
Content: View full analysis
]*href="(https?://([a-z0-9-]+)\.myclub\.fi/flow/select_account\?id=\d+)"[^>]*>(.*?)', html, re.DOTALL, ) ``` The discovered URL is then requested without another scheme or hostname check: ```python # Navigate to club — select_account redirects to the events page session.get(club_url) initial_html = session.last_html events_url = session.last_url ``` ### Technical Analysis The Skill documentation states that schedule information is fetched from `*.myclub.fi` over HTTPS. The implementation does not completely enforce this boundary: - The discovery regular expression explicitly accepts `http://`. - Redirects are followed automatically. - The final response URL is recorded but not rejected when it has an unexpected scheme or hostname. - Generic `get()` and `post()` methods do not enforce an endpoint allowlist. The credential POST itself uses a fixed HTTPS URL at `id.myclub.fi`, so the reviewed code does not intentionally send the username or password to a third party. The risk applies primarily to subsequent authenticated navigation, cookies, request metadata, and schedule content. Whether a cookie is exposed during cross-domain or HTTP navigation depends on its domain and `Secure` attributes. Nevertheless, relying solely on server-provided cookie attributes does not satisfy the Skill's documented network boundary. ### Attack Path 1. A compromised or altered myclub.fi response supplies an `ht ...[truncated 1138 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly instructs users to provide and store their myclub.fi username and password locally, and while it mentions file permissions later, it does not clearly warn that these are plaintext credentials whose exposure would enable full account access. This is dangerous because local compromise, backups, shell history leakage, screenshots, or accidental file sharing could reveal the credentials and allow unauthorized access to private account and schedule data.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares no explicit tool scope or permissions despite requiring capabilities that can write local files, access the network, and invoke shell commands. Even though the documented behavior appears legitimate for setup and schedule fetching, the lack of declared restrictions weakens containment and makes it harder for a host agent or reviewer to enforce least privilege or detect unexpected future behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The debug helper writes full authenticated HTML responses and the complete session cookie jar to predictable local files under /tmp and the current working context. Those artifacts can contain active session tokens, account identifiers, and private schedule data, enabling local session hijacking or sensitive data disclosure if another local user, process, or backup/logging system can read them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Debug mode silently saves authenticated page contents and session cookies to disk, but the CLI help does not clearly communicate that enabling debug will persist highly sensitive authentication material. In a credentialed skill that accesses personal account data, this increases the chance users expose secrets unintentionally during troubleshooting.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest asserts secure local credential storage, but load_config() reads the credential file without verifying ownership or restrictive permissions. If the file permissions are loosened later or the file is replaced through misconfiguration, credentials may be exposed while the tool continues operating as if storage were safe.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The code submits the literal string "Kirjaudu sisään" as part of the login POST, which embeds a Finnish locale assumption directly into the skill behavior. There is no user opt-in or documented justification that the skill is intentionally Finnish-only or region-specific.
Content: No source excerpt is available for this finding.