ClawHub
Back to skill

Security audit

Oauth Helper

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent OAuth-helper purpose, but it uses live logged-in browser sessions and sends authentication screenshots through Telegram without enough scoping or safeguards.

Review before installing. Use this only with a Telegram destination you control, a browser profile dedicated to OAuth testing, and websites you trust. Avoid sending full authentication screenshots; prefer cropped or redacted images, and confirm the exact site, provider, account, and requested permissions before allowing the agent to click through consent.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:228
Finding

Unrestricted Transmission of Sensitive Authentication Screenshots

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 228–228
Vulnerability Type: Sensitive information exposure through unrestricted screenshot transmission
Risk Level: Medium

Vulnerable Code Snippet:

text
- Login failed → Screenshot and send to user for debugging

Related authentication screenshot instructions also appear at lines 170 and 178:

text
- Screenshot QR code to user
text
QR: Screenshot to user

Technical Analysis

The error-handling instruction permits the agent to capture and transmit a failed login page through Telegram without requiring cropping, redaction, recipient verification, renewed user consent, or message deletion. Authentication pages may contain email addresses, account identifiers, OAuth request details, error diagnostics, QR login tokens, or other security-sensitive information.

The QR instructions are expected parts of the declared WeChat and QQ workflows, but they further demonstrate that live authentication artifacts may be sent through the messaging channel. A QR login token can act as a temporary bearer-like authentication artifact. Unrestricted full-page screenshots increase disclosure beyond the minimum information required to complete the workflow.

Attack Path

  1. A legitimate, compromised, or attacker-controlled authentication page displays sensitive account information, OAuth details, or a live QR token.
  2. The authentication attempt fails or invokes the QR workflow.
  3. The skill directs the agent to capture the displayed content.
  4. The screenshot is transmitted to the configured Telegram destination without mandatory redaction or destination verification.
  5. A person with access to the Telegram account, channel, notification preview, connected device, or message history obtains the exposed information.
  6. If the screenshot contains a still-valid QR token or similar authentication artifact, it may be used before expiration; ...[truncated 593 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the blanket instruction to screenshot failed login pages.
  2. Capture only the smallest necessary region instead of the entire page.
  3. Redact email addresses, account identifiers, OAuth parameters, tokens, cookies, passwords, 2FA values, and unrelated page content before transmission.
  4. Require explicit user confirmation immediately before sending any authentication screenshot.
  5. Verify that the Telegram recipient matches the user who initiated the login workflow.
  6. Treat QR codes as sensitive temporary credentials: send them only when necessary, prevent forwarding where supported, enforce short timeouts, and invalidate or refresh them after use.
  7. Delete sensitive messages after the workflow completes where the messaging platform permits it.
  8. For debugging, send a sanitized textual error summary or non-sensitive error code rather than a page screenshot.
  9. Add strict rules prohibiting screenshots whenever password, 2FA, recovery-code, session-token, or cookie data is visible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill routes OAuth decisions and troubleshooting data through Telegram and explicitly instructs screenshot sharing for QR codes and failed logins, but the description does not warn that sensitive authentication-related data may be transmitted off-platform. In this context, that omission is dangerous because OAuth pages, account selectors, consent screens, and QR codes can expose account identifiers, session-linked artifacts, or login metadata to a third-party messaging channel.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill depends on a browser profile already logged into multiple identity providers, but this trust model is not clearly disclosed in the main description. In this context, pre-authenticated sessions substantially increase risk because any mistaken domain detection, malicious login page, or overbroad automation can trigger account-linked OAuth authorization using live identities with only a lightweight Telegram confirmation step.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest and supported-provider sections repeatedly scope the skill to 7 named providers, but the example workflow shows behavior for additional providers not listed anywhere in the declared support set. This is an active contradiction in the skill documentation about what the skill is intended to handle.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.