Cartogopher

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:30 PM UTC
• Version: 1.0.1

Overview

The skill mostly matches its CartoGopher setup purpose, but it asks users to run unverified downloaded code, persist an API key in plaintext, and modify a system identity file.

Review before installing. Only run this in a workspace and account where you are comfortable installing vendor-provided code, avoid running the setup as root, do not let it create /etc/machine-id unless you intentionally control that container, and prefer storing the CartoGopher API key in a dedicated secret mechanism instead of shell profiles or multiple plaintext MCP configs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:77

Finding

Unverified Remote Payload Retrieval and Execution

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:125

Finding

API Key Persisted in Multiple Plaintext Configuration Files

Content

View full analysis

/dev/null; then echo "export CARTOGOPHER_API_KEY=API_KEY_HERE" >> "$SHELL_PROFILE" fi source "$SHELL_PROFILE" ``` The OpenClaw configuration duplicates the key: ```json { "mcpServers": { "cartogopher": { "command": "node", "args": ["~/.cartogopher/mcp-server/cartogopher-mcp.js"], "env": { "CURSOR_WORKSPACE": ".", "CARTOGOPHER_API_KEY": "API_KEY_HERE" } } } } ``` The Cursor configuration also duplicates the key: ```json { "mcpServers": { "cartogopher": { "command": "node", "args": ["~/.cartogopher/mcp-server/cartogopher-mcp.js"], "env": { "CURSOR_WORKSPACE": "${workspaceFolder}", "CARTOGOPHER_API_KEY": "API_KEY_HERE" } } } } ``` The Claude Code command places the key directly in command arguments: ```bash claude mcp add cartogopher node ~/.cartogopher/mcp-server/cartogopher-mcp.js \ -e CURSOR_WORKSPACE=. \ -e CARTOGOPHER_API_KEY=API_KEY_HERE ``` ### Technical Analysis The setup instructs users to write the API key into a shell startup file and then duplicate it in an MCP configuration. These are persistent plaintext files that may be readable by local processes operating as the user and may be copied into backups, diagnostic bundles, synchronized profiles, or shared configuration. The Claude command additionally exposes the literal secret to shell history and may expose it transiently through process argument inspection, depending on how the CLI handles the supplied arguments. ...[truncated 1440 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:66

Finding

Setup Modifies the System-Wide Machine Identity File

Content

View full analysis

/etc/machine-id) ``` ### Technical Analysis The installation procedure writes directly to `/etc/machine-id` when that file is absent. This is a system-level identity file consumed by operating-system components and unrelated applications. Creating or maintaining it is normally the responsibility of the operating system or container initialization process, not a per-user code-intelligence plugin. The command succeeds only when the invoking context already has permission to write under `/etc`, such as a root shell or a sufficiently privileged container. It does not independently bypass operating-system access controls. Nevertheless, instructing users or agents to perform this global modification encourages execution with permissions beyond those required to install an MCP server in the user's home directory. Generating the identifier through an ad hoc shell pipeline also bypasses platform-supported machine-ID initialization and lifecycle behavior. ### Attack Path 1. CartoGopher is installed in a container or environment where `/etc/machine-id` is absent. 2. The user or agent runs the setup under root or another context with write access to `/etc`. 3. The command generates a value and writes it to the global `/etc/machine-id` path. 4. Other applications and services in the same environment begin consuming the newly created identifier. 5. The changed identity semantics may persist for the lifetime of the container or writable image and affect software unrelated to CartoGopher. ### Impact Assessment The immediate privilege exercised is write access to a system configuration file. The action may alter machine identity be ...[truncated 471 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs appending an API key directly into a shell startup file, which stores credentials in plaintext in a broadly reused location. This increases the chance of accidental disclosure through backups, dotfile syncing, shell history mistakes, local multi-user access, or later exfiltration by unrelated tools.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

openclaw:
    requires:
      bins:
        - curl
        - unzip
        - node
        - npm

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells the agent to send the user's email address to an external service to obtain a trial key, but provides no explicit privacy notice or consent checkpoint. This creates unnecessary risk of sharing personal data with a third party without informed user approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs downloading a remote bundle and running npm install, which executes third-party code and dependency lifecycle scripts, without warning the user about supply-chain risk or verifying authenticity. This expands the trust boundary substantially and could lead to arbitrary code execution if the server or package contents are compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs creating or modifying /etc/machine-id, a system-wide host identifier, to satisfy a container prerequisite. This changes operating-system state beyond the scoped task of configuring an MCP server and can affect identity, telemetry, licensing, or host-level assumptions inside containers.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This step downloads a remote archive from an external domain and installs it locally without integrity verification or trust warnings. Because the archive is then extracted and followed by dependency installation, compromise of the distribution channel could lead to execution of malicious code.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

esac

Download, extract, and clean up

curl -sL "$DOWNLOAD_URL" -o cg.zip && unzip cg.zip -d ~/.cartogopher/mcp-server && rm cg.zip

text

**Platform-specific one-liners (if you already know the platform):**

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

Lines L135-L145 state the API key must be added to the shell profile so the MCP server process can access it, implying shell-profile inheritance matters. But L201 says the MCP server must have CARTOGOPHER_API_KEY explicitly in its env config and does not inherit from the shell, which contradicts the rationale for permanently exporting the key in the profile.

Content

No source excerpt is available for this finding.