Shortcut Epic and Story skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:24 PM UTC
• Version: 1.0.2

Overview

This Shortcut integration is coherent, but it can make real project-management changes using a full-access token without built-in confirmation safeguards.

Install only if you are comfortable giving the agent a full member-level Shortcut token. Prefer a temporary session environment variable where possible, rotate the token if logs or process telemetry may have captured it, and require the agent to show an exact preview before creating or changing stories, epics, comments, or dependency links.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:132

Finding

Full-access Shortcut API token exposed through process command-line arguments

Content

View full analysis

Remediation

View remediation

"$CURL_CONFIG" curl --config "$CURL_CONFIG" \ -H "Content-Type: application/json" \ -d "$DATA" "$BASE/stories" ``` 4. Ensure temporary configuration files are removed on normal exit, errors, and signals. Store them only in a trusted local temporary directory. 5. Disable shell tracing before handling credentials and avoid logging environment variables, headers, curl configuration contents, or expanded commands. 6. Retain the existing mode-`600` protection for the persistent token file and continue offering session-only credential use. 7. Rotate the Shortcut token immediately if process telemetry, shell traces, or logs may already contain it. 8. Apply the corrected authentication mechanism consistently to every curl invocation in both `SKILL.md` and `references/create-stories.md`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: shortcut
description: "Access and manage Shortcut.com (formerly Clubhouse) project management. Use when the user asks to: list stories, view backlog, search issues, check epics, update story state, create stories or epics, add comments, wire story dependencies, or fetch/triage a story. Trigger keywords: shortcut, story, backlog, sc-XXXX, sprint, epic, ticket."
metadata:
  {
    "openclaw": {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs users to persist a full-access API token on disk under a predictable path without a prominent warning about the credential's sensitivity and broad privileges. Although file mode 600 reduces exposure, storing a long-lived unrestricted token locally increases the blast radius if the local account, filesystem, backups, or related tooling are compromised.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

If empty, ask the user for their API token, then save it:

bash

mkdir -p ~/.openclaw/secrets
echo -n "<token>" > ~/.openclaw/secrets/shortcut && chmod 600 ~/.openclaw/secrets/shortcut

Generate a token at app.shortcut.com → Settings → API Tokens. Shortcut tokens have full member-level access — no scope restriction is available. Rotate or delete the token at any time from the same settings page.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

# ✅ Safe — jq handles all escaping
DATA=$(jq -n --arg name "$TITLE" --arg desc "$DESCRIPTION" \
  '{name: $name, description: $desc}')
curl -s -X POST -H "Shortcut-Token: $SHORTCUT_API_TOKEN" \
  -H "Content-Type: application/json" -d "$DATA" "$BASE/stories"

# ❌ Unsafe — never do this

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documents multiple state-changing operations against Shortcut, including story creation, updates, comments, epics, and dependency links, but does not require an explicit user confirmation step before executing them. In an agent setting, this increases the risk of unintended or prompt-induced modifications to production project data, especially because the API token has full member-level access.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md

estimate: $estimate, workflow_state_id: $workflow_state_id,
    group_id: $group_id, epic_id: $epic_id}')

curl -s -X POST \
  -H "Shortcut-Token: $SHORTCUT_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$DATA" "$BASE/stories" | jq '{id, name, app_url}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md

estimate: $estimate, workflow_state_id: $workflow_state_id,
    group_id: $group_id, epic_id: $epic_id}')

curl -s -X POST \
  -H "Shortcut-Token: $SHORTCUT_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$DATA" "$BASE/stories" | jq '{id, name, app_url}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

estimate: $estimate, workflow_state_id: $workflow_state_id,
    group_id: $group_id, epic_id: $epic_id}')

curl -s -X POST \
  -H "Shortcut-Token: $SHORTCUT_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$DATA" "$BASE/stories" | jq '{id, name, app_url}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md

estimate: $estimate, workflow_state_id: $workflow_state_id,
    group_id: $group_id, epic_id: $epic_id}')

curl -s -X POST \
  -H "Shortcut-Token: $SHORTCUT_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$DATA" "$BASE/stories" | jq '{id, name, app_url}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

bash

DATA=$(jq -n --argjson state "$NEW_STATE_ID" '{workflow_state_id: $state}')

curl -s -X PUT \
  -H "Shortcut-Token: $SHORTCUT_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$DATA" "$BASE/stories/$STORY_ID" | jq '{id, name, workflow_state_id}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file provides ready-to-run instructions for bulk creation of epics, stories, and dependency links in an external project-management system, but it does not require any explicit user confirmation, dry-run mode, scope check, or warning that these actions mutate real organizational data. In an agent skill context, that increases the risk of unintended mass changes from ambiguous prompts or prompt injection because the documented workflow normalizes direct write actions at scale.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/create-stories.md (reported line 7)May include surrounding context.

All JSON is built via jq -n --arg / --argjson — never interpolate values directly into shell strings.

1. Create the Epic First

bash

SHORTCUT_API_TOKEN=$(cat ~/.openclaw/secrets/shortcut)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

bash

SHORTCUT_API_TOKEN=$(cat ~/.openclaw/secrets/shortcut)
BASE="https://api.app.shortcut.com/api/v3"

EPIC=$(jq -n \
  --arg name "My Feature Epic" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/create-stories.md (reported line 11)May include surrounding context.

bash

SHORTCUT_API_TOKEN=$(cat ~/.openclaw/secrets/shortcut)
BASE="https://api.app.shortcut.com/api/v3"

EPIC=$(jq -n \
  --arg name "My Feature Epic" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This POST sends data to Shortcut's external API to create an epic using a locally loaded API token. External transmission itself is expected for this integration, but in a skill/agent setting it is still security-relevant because it performs an authenticated write to a third-party service and can be triggered without any embedded approval or validation controls.

Content

Scanner excerpt · references/create-stories.md (reported line 18)May include surrounding context.

md

--arg description "What this epic delivers and why." \
  --arg group_id "$GROUP_ID" \
  '{name: $name, description: $description, group_id: $group_id, labels: [{name: "mobile"}]}' | \
  curl -s -X POST \
    -H "Shortcut-Token: $SHORTCUT_API_TOKEN" \
    -H "Content-Type: application/json" \
    -d @- "$BASE/epics")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This POST creates stories in bulk and accepts user-controlled fields such as title, type, description, estimate, label, and epic linkage. In context, this is more dangerous than a normal API call because it enables repeated authenticated writes that can create many records, increasing the blast radius of accidental execution, malicious prompting, or abuse of agent autonomy.

Content

Scanner excerpt · references/create-stories.md (reported line 47)May include surrounding context.

md

'{name: $name, story_type: $story_type, description: $description,
      estimate: $estimate, workflow_state_id: $workflow_state_id,
      group_id: $group_id, labels: [{name: $label}], epic_id: $epic_id}' | \
  curl -s -X POST \
    -H "Shortcut-Token: $SHORTCUT_API_TOKEN" \
    -H "Content-Type: application/json" \
    -d @- "$BASE/stories"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

This POST creates dependency links between stories in the external system. Although linking is part of intended functionality, it still mutates project state and can silently alter planning semantics at scale, especially since output is discarded to /dev/null and there is no confirmation or validation of IDs before the write.

Content

Scanner excerpt · references/create-stories.md (reported line 71)May include surrounding context.

md

local blocker=$1 blocked=$2
  jq -n --argjson subject_id "$blocker" --argjson object_id "$blocked" \
    '{subject_id: $subject_id, object_id: $object_id, verb: "blocks"}' | \
  curl -s -X POST \
    -H "Shortcut-Token: $SHORTCUT_API_TOKEN" \
    -H "Content-Type: application/json" \
    -d @- "$BASE/story-links" > /dev/null

Static analysis

No suspicious patterns detected.