ClawHub
Back to skill

Security audit

Mixpanel

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Mixpanel analytics helper, but it asks the agent to store broad future activation preferences in shared memory and persists analytics context locally, which users should review before installing.

Install only if you are comfortable giving the agent access to Mixpanel through a service account. Use a least-privileged account, avoid broad raw exports unless needed, and review or disable any memory behavior that would make the skill activate on generic future discussions about metrics or user behavior.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T02 · Agent Memory Poisoning

Warning
Location
setup.md:13
Finding

Cross-Session Activation Rules Written to Shared Agent Memory

Content
View full analysis

Vulnerability Details

File Location: setup.md, lines 13–17
Vulnerability Type: Persistent agent-memory poisoning
Risk Level: Medium

markdown
Early in the conversation, figure out:
- "Should I help with Mixpanel analytics whenever you mention metrics or user behavior?"
- "Want me to proactively suggest funnel or retention analysis?"

Save to their main memory so future sessions know when to activate.

Technical Analysis

The Skill instructs the agent to save broad activation preferences to the user's unspecified “main memory.” This conflicts with the Skill's otherwise scoped storage design, which places Mixpanel-specific state in ~/mixpanel/memory.md.

Writing activation rules into shared, long-term agent memory can persistently alter behavior beyond the current Skill invocation. The stored rule could cause Mixpanel-oriented behavior to activate whenever future conversations mention broad concepts such as “metrics” or “user behavior,” including conversations unrelated to Mixpanel.

Although the setup process asks the user about this behavior, the instruction does not define the exact persisted content, constrain it to Skill-specific storage, establish retention or deletion controls, or ensure that the preference is isolated from unrelated sessions.

Attack Path

  1. The Mixpanel Skill is loaded for the first time.
  2. The setup instructions prompt the agent to ask whether it should proactively activate for broad analytics-related topics.
  3. The user agrees, or the agent interprets the response as approval.
  4. The agent writes the activation preference into shared “main memory” rather than ~/mixpanel/memory.md.
  5. In a later, unrelated session, the user mentions metrics or user behavior.
  6. The persistent rule causes the agent to inject or prioritize Mixpanel analysis outside the original Skill context.
  7. The behavioral modification may remain after the immediate task ends and may survive removal of the Skill, depending on the ...[truncated 650 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace “main memory” with the explicitly scoped ~/mixpanel/memory.md location.
  2. Store only a narrowly defined preference, such as whether the Mixpanel Skill may be suggested when Mixpanel is explicitly mentioned.
  3. Do not persist activation rules for generic concepts such as “metrics” or “user behavior.”
  4. Obtain explicit, informed user consent immediately before writing the preference.
  5. Show the exact value and destination that will be persisted.
  6. Define retention, review, revocation, and deletion procedures for the preference.
  7. Ensure uninstall or reset operations remove all Skill-specific state.
  8. Prevent Mixpanel memory from being loaded into unrelated sessions unless the user explicitly invokes the Skill.
  9. Keep analytics context, saved queries, and insights isolated from global or shared agent memory.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
AUTH=$(echo -n "$MP_SERVICE_ACCOUNT:$MP_SERVICE_SECRET" | base64)

# Insights query (event counts)
curl -s "$BASE/insights?project_id=$MP_PROJECT_ID" \
  -H "Authorization: Basic $AUTH" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

3. Funnel Analysis

bash
curl -s "$BASE/funnels?project_id=$MP_PROJECT_ID" \
  -H "Authorization: Basic $AUTH" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

4. Retention Cohorts

bash
curl -s "$BASE/retention?project_id=$MP_PROJECT_ID" \
  -H "Authorization: Basic $AUTH" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

This example retrieves user profile data including email and name from Mixpanel, which increases privacy sensitivity compared with aggregate analytics queries. Although the transmission is to the legitimate Mixpanel endpoint and appears intended, exposing or normalizing examples that pull identifiable user data can encourage over-collection and unnecessary access to PII.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

5. User Profiles

bash
curl -s "https://mixpanel.com/api/query/engage?project_id=$MP_PROJECT_ID" \
  -H "Authorization: Basic $AUTH" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The raw export example enables bulk extraction of event-level data from Mixpanel, which can materially increase data-exfiltration and privacy risk if the local environment, downstream tooling, or operator is not tightly controlled. Even though the destination is a legitimate Mixpanel export endpoint, bulk export functionality is more dangerous than standard aggregate queries because it can expose large volumes of potentially sensitive telemetry.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

6. Export Raw Events

bash
curl -s "https://data.mixpanel.com/api/2.0/export?project_id=$MP_PROJECT_ID" \
  -H "Authorization: Basic $AUTH" \
  -d "from_date=2024-01-01" \
  -d "to_date=2024-01-07" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The raw export example enables bulk extraction of event-level data from Mixpanel, which can materially increase data-exfiltration and privacy risk if the local environment, downstream tooling, or operator is not tightly controlled. Even though the destination is a legitimate Mixpanel export endpoint, bulk export functionality is more dangerous than standard aggregate queries because it can expose large volumes of potentially sensitive telemetry.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

6. Export Raw Events

bash
curl -s "https://data.mixpanel.com/api/2.0/export?project_id=$MP_PROJECT_ID" \
  -H "Authorization: Basic $AUTH" \
  -d "from_date=2024-01-01" \
  -d "to_date=2024-01-07" \

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The activation guidance is broad enough to trigger the skill whenever the user mentions metrics or user behavior, which can cause unintended invocation outside clear Mixpanel-related requests. Over-broad activation increases the chance of collecting context, steering the conversation, or invoking analytics workflows when the user did not intend to use this integration.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs the agent to save activation preferences to long-term memory early in the conversation, even though the stated purpose is querying Mixpanel analytics. Persisting behavioral preferences without clear necessity or user consent expands data retention beyond the minimum needed and can create privacy and scope-creep risks across future sessions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The setup directs the agent to write project context, tracked events, common queries, and discovered insights to a local memory file, which exceeds the narrow function of executing Mixpanel queries. This creates unnecessary persistent storage of potentially sensitive business and usage information that could later be exposed, misused, or retained longer than the user expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly instructs persistent storage of user and project information in a local memory file without any user-facing notice that this data will be retained. Silent persistence undermines informed consent and may capture sensitive product strategy, event taxonomy, and analytical history in a way users do not anticipate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.