ClawHub
Back to skill

Security audit

ChatGPT MCP Connector

Security checks for vulnerabilities and agentic risk

Overview

The skill is not covertly malicious, but it deserves Review because it asks an agent to expose a local command-capable MCP server to ChatGPT and handle a plaintext owner password during browser automation.

Install only if you are comfortable granting ChatGPT a tunnel to a local DevSpace server that can read/write selected project files and run shell commands. Keep allowedRoots to one low-risk project, do not include secrets or production/customer data, review every install command before running it, close Tailscale Funnel when finished, and consider doing the ownerToken authorization manually instead of letting the agent read the plaintext token.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (99)

Instruction Override

High
Category
Prompt Injection
Confidence
88% confidence
Finding

The skill explicitly instructs the agent to navigate account settings and enable developer mode automatically. Even though this is part of the feature set, it is still an instruction to alter account security-related state through browser automation, which is high-risk if invoked under broad triggers or without narrowly scoped consent.

Content

Scanner excerpt · README.md (reported line 284)May include surrounding context.

md
B) Login-wall check: new_tab("https://chatgpt.com/") + wait_for_load(), then read page_info().
       If you land on a login page, stop and tell me. NEVER fill in passwords, one-time codes or MFA.

    C) Enable developer mode (one-time): Settings -> Account security and login -> Developer mode.
       Read the toggle back afterwards to confirm.

    D) Create the connector. Use the deep link straight into the new-plugin dialog — do not hunt for

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to read a local secret from ~/.devspace/auth.json and use it during browser automation. Even though it says not to print the token, this normalizes model-driven access to password-equivalent credentials, creating a dangerous secret-handling pattern that could be misused, logged indirectly, or extended to exfiltration by a compromised or over-permissive agent environment.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This section repeatedly authorizes the agent to obtain a password-equivalent token from a local file and act on the user's behalf. Repetition and policy-like phrasing institutionalize secret access by natural-language instruction, increasing the chance that future agent behavior treats local credential scraping as acceptable and routine.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Declaring as an 'iron rule' that the agent may read a local secret file and fill a browser authorization form gives the model standing permission to access password-equivalent material. In the context of an agent skill that already automates installs, browser control, and network exposure, this substantially raises the risk of credential misuse and unauthorized account actions.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
见 `references/cross-platform.md`。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

md
见 `references/cross-platform.md`。

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
| 0 | 环境自检 + 补齐依赖 | `env-check.mjs`（`--install` 自动装缺失项） | 脚本报「✅ 全部就绪」，且 **Bash 项为 `[ok]`**（报 `[不可用]` 时 shell 工具会全废，见下） | 装包可能弹 UAC |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md
| 0 | 环境自检 + 补齐依赖 | `env-check.mjs`（`--install` 自动装缺失项） | 脚本报「✅ 全部就绪」，且 **Bash 项为 `[ok]`**（报 `[不可用]` 时 shell 工具会全废，见下） | 装包可能弹 UAC |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md
### ② `scripts/devspace-bootstrap.mjs` —— 写 DevSpace 配置

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instructions explicitly direct the agent to read a local secret from ~/.devspace/auth.json and inject it into a web authorization form. Even though the text says not to print the value, this still normalizes agent-mediated secret access and browser submission, increasing the risk of unintended disclosure, misuse, prompt-injection-induced exfiltration, or use in an untrusted browser/session context.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manual fallback continues to operationalize use of the Owner password from a local secret file as part of the workflow, preserving a natural-language pathway for secret retrieval and use. In context, this is especially dangerous because the same skill also automates browser actions and connector creation, making it easier to bridge from local secret access to remote authorization.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cross-platform.md (reported line 111)May include surrounding context.

md
| 依赖 | Windows | macOS | Linux |
| --- | --- | --- | --- |
| Node | `winget install -e --id OpenJS.NodeJS.LTS` | `brew install node@22 && brew link --overwrite --force node@22` | `curl -fsSL https://deb.nodesource.com/setup_22.x \| sudo -E bash - && sudo apt-get install -y nodejs`<br>`sudo dnf install -y nodejs`<br>`sudo pacman -S --noconfirm nodejs npm` |
| Git | `winget install -e --id Git.Git` | `brew install git` | `sudo apt-get install -y git` / `sudo dnf install -y git` / `sudo pacman -S git` |
| Bash | 装 Git for Windows 即带上 | `brew install bash`（可选，系统已有 3.2） | 一般自带；Alpine `sudo apk add bash` |
| Tailscale | `winget install -e --id Tailscale.Tailscale` | `brew install --cask tailscale` | `curl -fsSL https://tailscale.com/install.sh \| sh` |

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Piping curl output into sudo -E bash - is a classic unsafe command-construction pattern that grants root execution to unverified remote content. In this skill context, where installation guidance may be followed or automated, this is a strong indicator of dangerous tooling behavior.

Content

Scanner excerpt · references/cross-platform.md (reported line 111)May include surrounding context.

md
| 依赖 | Windows | macOS | Linux |
| --- | --- | --- | --- |
| Node | `winget install -e --id OpenJS.NodeJS.LTS` | `brew install node@22 && brew link --overwrite --force node@22` | `curl -fsSL https://deb.nodesource.com/setup_22.x \| sudo -E bash - && sudo apt-get install -y nodejs`<br>`sudo dnf install -y nodejs`<br>`sudo pacman -S --noconfirm nodejs npm` |
| Git | `winget install -e --id Git.Git` | `brew install git` | `sudo apt-get install -y git` / `sudo dnf install -y git` / `sudo pacman -S git` |
| Bash | 装 Git for Windows 即带上 | `brew install bash`（可选，系统已有 3.2） | 一般自带；Alpine `sudo apk add bash` |
| Tailscale | `winget install -e --id Tailscale.Tailscale` | `brew install --cask tailscale` | `curl -fsSL https://tailscale.com/install.sh \| sh` |

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Piping curl output into sudo -E bash - is a classic unsafe command-construction pattern that grants root execution to unverified remote content. In this skill context, where installation guidance may be followed or automated, this is a strong indicator of dangerous tooling behavior.

Content

Scanner excerpt · references/cross-platform.md (reported line 111)May include surrounding context.

md
| 依赖 | Windows | macOS | Linux |
| --- | --- | --- | --- |
| Node | `winget install -e --id OpenJS.NodeJS.LTS` | `brew install node@22 && brew link --overwrite --force node@22` | `curl -fsSL https://deb.nodesource.com/setup_22.x \| sudo -E bash - && sudo apt-get install -y nodejs`<br>`sudo dnf install -y nodejs`<br>`sudo pacman -S --noconfirm nodejs npm` |
| Git | `winget install -e --id Git.Git` | `brew install git` | `sudo apt-get install -y git` / `sudo dnf install -y git` / `sudo pacman -S git` |
| Bash | 装 Git for Windows 即带上 | `brew install bash`（可选，系统已有 3.2） | 一般自带；Alpine `sudo apk add bash` |
| Tailscale | `winget install -e --id Tailscale.Tailscale` | `brew install --cask tailscale` | `curl -fsSL https://tailscale.com/install.sh \| sh` |

External Script Fetching

High
Category
Supply Chain
Confidence
96% confidence
Finding

curl -fsSL https://tailscale.com/install.sh | sh executes a remote script directly in the shell without local verification. In a setup skill that may automate dependencies, this is dangerous because compromise of the remote source, network path, or script behavior can lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · references/cross-platform.md (reported line 114)May include surrounding context.

md
| Node | `winget install -e --id OpenJS.NodeJS.LTS` | `brew install node@22 && brew link --overwrite --force node@22` | `curl -fsSL https://deb.nodesource.com/setup_22.x \| sudo -E bash - && sudo apt-get install -y nodejs`<br>`sudo dnf install -y nodejs`<br>`sudo pacman -S --noconfirm nodejs npm` |
| Git | `winget install -e --id Git.Git` | `brew install git` | `sudo apt-get install -y git` / `sudo dnf install -y git` / `sudo pacman -S git` |
| Bash | 装 Git for Windows 即带上 | `brew install bash`（可选，系统已有 3.2） | 一般自带；Alpine `sudo apk add bash` |
| Tailscale | `winget install -e --id Tailscale.Tailscale` | `brew install --cask tailscale` | `curl -fsSL https://tailscale.com/install.sh \| sh` |
| DevSpace | `npm install -g @waishnav/devspace` | 同左 | 同左 |
| better-sqlite3 | `npm rebuild better-sqlite3` | 同左 | 同左 |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/devspace-config.md (reported line 209)May include surrounding context.

md
| `DEVSPACE_PUBLIC_BASE_URL` | 公网 origin（临时隧道用） | 配置文件 / `http://host:port` |
| `DEVSPACE_ALLOWED_HOSTS` | Host 头白名单，`*` 关闭（会 warn） | 由 `publicBaseUrl` 推导 |
| `DEVSPACE_OAUTH_OWNER_TOKEN` | 免配置文件提供 Owner password | — |
| `DEVSPACE_OAUTH_ACCESS_TOKEN_TTL_SECONDS` | access token 有效期 | 内置默认 |
| `DEVSPACE_OAUTH_REFRESH_TOKEN_TTL_SECONDS` | refresh token 有效期 | 内置默认（实测约 30 天） |
| `DEVSPACE_OAUTH_SCOPES` | 作用域 | `devspace` |
| `DEVSPACE_OAUTH_ALLOWED_REDIRECT_HOSTS` | 允许的重定向主机 | `chatgpt.com,localhost,127.0.0.1` |

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/devspace-config.md (reported line 256)May include surrounding context.

md
| 表 | 内容 |
| --- | --- |
| `oauth_clients` | DCR 注册的客户端（`client_id` = `devspace-<uuid>`） |
| `oauth_access_tokens` | access token（按 hash 存） |
| `oauth_refresh_tokens` | refresh token（按 hash 存，带 `expires_at`） |

> 库文件是 `~/.local/share/devspace/devspace.sqlite`（WAL 模式，会有 `-wal` / `-shm`）。

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The | sudo pattern is especially dangerous because untrusted network-delivered content is streamed straight into a privileged interpreter. In a setup skill whose purpose is end-to-end automation, this context makes the issue more dangerous because users may be inclined to copy-paste exactly as written and grant root execution without scrutiny.

Content

Scanner excerpt · references/env-setup.md (reported line 37)May include surrounding context.

md
| 依赖 | Windows | macOS | Linux |
| --- | --- | --- | --- |
| Node | `winget install -e --id OpenJS.NodeJS.LTS --accept-package-agreements --accept-source-agreements` | `brew install node@22 && brew link --overwrite --force node@22` | `curl -fsSL https://deb.nodesource.com/setup_22.x \| sudo -E bash - && sudo apt-get install -y nodejs` / `sudo dnf install -y nodejs` / `sudo pacman -S nodejs npm` |
| Git | `winget install -e --id Git.Git --accept-package-agreements --accept-source-agreements` | `brew install git` | `sudo apt-get install -y git` 等 |
| Bash | 同上装 Git.Git（自带 Git Bash）；或 `winget install -e --id Microsoft.WSL` | `brew install bash`（**可选**，系统自带的 3.2 对 DevSpace 够用） | 通常自带 `/bin/bash`；Alpine 等精简发行版要 `sudo apk add bash` |
| Tailscale | `winget install -e --id Tailscale.Tailscale --accept-package-agreements --accept-source-agreements` | `brew install --cask tailscale` | `curl -fsSL https://tailscale.com/install.sh \| sh` |

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The | sudo pattern is especially dangerous because untrusted network-delivered content is streamed straight into a privileged interpreter. In a setup skill whose purpose is end-to-end automation, this context makes the issue more dangerous because users may be inclined to copy-paste exactly as written and grant root execution without scrutiny.

Content

Scanner excerpt · references/env-setup.md (reported line 37)May include surrounding context.

md
| 依赖 | Windows | macOS | Linux |
| --- | --- | --- | --- |
| Node | `winget install -e --id OpenJS.NodeJS.LTS --accept-package-agreements --accept-source-agreements` | `brew install node@22 && brew link --overwrite --force node@22` | `curl -fsSL https://deb.nodesource.com/setup_22.x \| sudo -E bash - && sudo apt-get install -y nodejs` / `sudo dnf install -y nodejs` / `sudo pacman -S nodejs npm` |
| Git | `winget install -e --id Git.Git --accept-package-agreements --accept-source-agreements` | `brew install git` | `sudo apt-get install -y git` 等 |
| Bash | 同上装 Git.Git（自带 Git Bash）；或 `winget install -e --id Microsoft.WSL` | `brew install bash`（**可选**，系统自带的 3.2 对 DevSpace 够用） | 通常自带 `/bin/bash`；Alpine 等精简发行版要 `sudo apk add bash` |
| Tailscale | `winget install -e --id Tailscale.Tailscale --accept-package-agreements --accept-source-agreements` | `brew install --cask tailscale` | `curl -fsSL https://tailscale.com/install.sh \| sh` |

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

curl -fsSL https://tailscale.com/install.sh | sh fetches and immediately executes a remote shell script. Even without sudo, this is still dangerous because it grants arbitrary code execution to whatever content is served at that URL and normalizes an unsafe installation pattern in a security-sensitive skill.

Content

Scanner excerpt · references/env-setup.md (reported line 40)May include surrounding context.

md
| Node | `winget install -e --id OpenJS.NodeJS.LTS --accept-package-agreements --accept-source-agreements` | `brew install node@22 && brew link --overwrite --force node@22` | `curl -fsSL https://deb.nodesource.com/setup_22.x \| sudo -E bash - && sudo apt-get install -y nodejs` / `sudo dnf install -y nodejs` / `sudo pacman -S nodejs npm` |
| Git | `winget install -e --id Git.Git --accept-package-agreements --accept-source-agreements` | `brew install git` | `sudo apt-get install -y git` 等 |
| Bash | 同上装 Git.Git（自带 Git Bash）；或 `winget install -e --id Microsoft.WSL` | `brew install bash`（**可选**，系统自带的 3.2 对 DevSpace 够用） | 通常自带 `/bin/bash`；Alpine 等精简发行版要 `sudo apk add bash` |
| Tailscale | `winget install -e --id Tailscale.Tailscale --accept-package-agreements --accept-source-agreements` | `brew install --cask tailscale` | `curl -fsSL https://tailscale.com/install.sh \| sh` |
| DevSpace | `npm install -g @waishnav/devspace` | 同左 | 同左 |
| better-sqlite3 | `npm rebuild better-sqlite3` | 同左 | 同左 |

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The Linux install instruction pipes a remote script directly into sh, which executes fetched code immediately without an opportunity for inspection or integrity verification. Because installation typically runs with elevated privileges or modifies system state, a compromised upstream script, DNS/TLS interception edge case, or mirror issue could lead to full system compromise.

Content

Scanner excerpt · references/tailscale-funnel.md (reported line 22)May include surrounding context.

md
| Windows 静默（自动化） | `winget install -e --id Tailscale.Tailscale --silent --accept-package-agreements --accept-source-agreements` |
| Windows 手动 | 从 `tailscale.com/download/windows` 下 `.msi` |
| macOS | `brew install --cask tailscale`（会要求管理员密码，**正常**，不是卡死） |
| Linux | `curl -fsSL https://tailscale.com/install.sh \| sh` |

**CLI 在哪 —— 三平台不一样，照平台取：**

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The script advises curl -fsSL https://tailscale.com/install.sh | sh, which executes network-fetched code directly in the shell without local inspection or integrity verification. If the remote endpoint, TLS trust chain, DNS resolution, or delivery path is compromised, the user may run arbitrary attacker-controlled code with their account and potentially elevated privileges depending on follow-on steps.

Content

Scanner excerpt · scripts/devspace-bootstrap.mjs (reported line 374)May include surrounding context.

js
fail('未找到 tailscale CLI');
    log('        Windows: winget install -e --id Tailscale.Tailscale');
    log('        macOS  : brew install --cask tailscale');
    log('        Linux  : curl -fsSL https://tailscale.com/install.sh | sh');
  } else {
    ok(`tailscale CLI: ${ts}`);
    try {

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The use of --noconfirm in package-manager commands suppresses interactive review and allows immediate system modification. In an agent-operated installation workflow, that weakens user oversight and can turn a dependency check into unintended host changes.

Content

Scanner excerpt · scripts/env-check.mjs (reported line 799)May include surrounding context.

js
...pick(
        'winget install -e --id OpenJS.NodeJS.LTS --accept-package-agreements --accept-source-agreements',
        'brew install node@22 && brew link --overwrite --force node@22',
        'curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && sudo apt-get install -y nodejs   # Debian/Ubuntu\nsudo dnf install -y nodejs   # Fedora/RHEL\nsudo pacman -S --noconfirm nodejs npm   # Arch'
      )
    );
  }

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Piping curl output directly into sudo bash is a high-risk chaining pattern because it turns remote content into immediate privileged code execution. In an agent skill whose purpose is automated environment preparation, this pattern is especially dangerous because users may treat it as a trusted remediation step and run it verbatim.

Content

Scanner excerpt · scripts/env-check.mjs (reported line 799)May include surrounding context.

js
...pick(
        'winget install -e --id OpenJS.NodeJS.LTS --accept-package-agreements --accept-source-agreements',
        'brew install node@22 && brew link --overwrite --force node@22',
        'curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && sudo apt-get install -y nodejs   # Debian/Ubuntu\nsudo dnf install -y nodejs   # Fedora/RHEL\nsudo pacman -S --noconfirm nodejs npm   # Arch'
      )
    );
  }

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Piping curl output directly into sudo bash is a high-risk chaining pattern because it turns remote content into immediate privileged code execution. In an agent skill whose purpose is automated environment preparation, this pattern is especially dangerous because users may treat it as a trusted remediation step and run it verbatim.

Content

Scanner excerpt · scripts/env-check.mjs (reported line 799)May include surrounding context.

js
...pick(
        'winget install -e --id OpenJS.NodeJS.LTS --accept-package-agreements --accept-source-agreements',
        'brew install node@22 && brew link --overwrite --force node@22',
        'curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - && sudo apt-get install -y nodejs   # Debian/Ubuntu\nsudo dnf install -y nodejs   # Fedora/RHEL\nsudo pacman -S --noconfirm nodejs npm   # Arch'
      )
    );
  }