T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:57
- Finding
- Overly Broad OAuth Scopes Used with a Fixed Application Identity## Vulnerability Details **File Location**: `SKILL.md:57-72`, `SKILL.md:91-96`, and `SKILL.md:116-122` **Vulnerability Type**: Excessive OAuth permissions and unverified fixed client identity **Risk Level**: Medium ### Vulnerable Code ```markdown **Configuration:** - Client ID: `1479302369723285736` - Redirect URI: `http://127.0.0.1:11111/callback` **OAuth2 Scopes:** Discord user OAuth2 supports **read-only operations**. It cannot send messages or manage servers as a user (use Bot Token for those operations). **Recommended Scopes (Full Functionality):** ```bash --scope "identify email connections guilds guilds.members.read messages.read openid" ``` **Minimal Read-Only Scopes:** ```bash --scope "identify email connections guilds guilds.members.read" ``` ``` ```bash uxc auth oauth start discord-user \ --endpoint https://discord.com/api/oauth2/token \ --client-id 1479302369723285736 \ --redirect-uri http://127.0.0.1:11111/callback \ --scope "identify email connections guilds guilds.members.read messages.read openid" ``` ```bash uxc auth oauth login discord-user \ --endpoint https://discord.com/api/oauth2/token \ --flow authorization_code \ --client-id 1479302369723285736 \ --redirect-uri http://127.0.0.1:11111/callback \ --scope "identify email connections guilds guilds.members.read messages.read openid" ``` ### Technical Analysis The documented OAuth workflow directs all users through the fixed Discord OAuth client ID `1479302369723285736`. The project does not identify who controls this application or instruct users to create and verify an application under their own control. The recommended and purportedly minimal configurations also request several permissions simultaneously, including access to the user's email address, linked third-party accounts, guild list, and guild membership information. These permissions exceed the needs of common operations such as re ...[truncated 2008 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the fixed client ID from the default instructions and require users to provide an OAuth client ID belonging to an application they created or explicitly verified. 2. Clearly identify the owner, purpose, privacy policy, and trust boundary of any preconfigured OAuth application if retaining one is unavoidable. 3. Default to the smallest operation-specific scope. For basic profile retrieval, request only `identify`. 4. Add `email`, `connections`, `guilds`, and `guilds.members.read` individually and only after the user explicitly requests functionality that requires each scope. 5. Remove `messages.read` from the recommended HTTP API flow because the skill itself notes that it does not enable HTTP channel-message access. 6. Present the exact data exposed by every requested scope before starting authorization and require explicit confirmation for sensitive scopes. 7. Document credential revocation and cleanup procedures so users can revoke the Discord authorization and delete the locally stored UXC credential after use. 8. Add validation checks that reject bundled broad scopes in examples designated as minimal.