T09 · Insecure Skill Coding Practices
Warning
- Location
export.py:26- Finding
Reversible Plex token obfuscation is presented as secure encryption
- Content
View full analysis
- Remediation
View remediation
Security audit
PlexMedia2HTML Export
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to export Plex libraries as advertised, but it handles a Plex token in ways users should review carefully before installing.
Review this skill before installing if your Plex token has broad access. Prefer normal HTTPS with valid certificates, avoid --insecure unless you understand the interception risk, and treat the stored token as obfuscated rather than strongly encrypted. Rotate the Plex token if the config file may have been exposed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
export.py:241- Finding
Optional TLS verification bypass can expose the Plex authentication token
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill documentation indicates capabilities to read and write files, make network requests to a Plex server, and invoke shell commands, but the manifest does not declare any corresponding tool scope or permissions. This creates a transparency and least-privilege problem: users and hosting platforms cannot accurately constrain what the skill may do, increasing the risk of overbroad execution if the implementation is compromised or behaves unexpectedly.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - Use `--insecure` flag only for self-signed certificates (not recommended) **File Permissions:** - Config file is automatically set to `chmod 600` (owner read/write only) - After first run, verify: `ls -la ~/.openclaw/workspace/data/plexmedia2html-export/config.json` ---
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - Use `--insecure` flag only for self-signed certificates (not recommended) **File Permissions:** - Config file is automatically set to `chmod 600` (owner read/write only) - After first run, verify: `ls -la ~/.openclaw/workspace/data/plexmedia2html-export/config.json` ---
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
md **File Permissions:** - Config file is automatically set to `chmod 600` (owner read/write only) - After first run, verify: `ls -la ~/.openclaw/workspace/data/plexmedia2html-export/config.json` ---
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file-level documentation claims 'Secure Token Storage', but the implementation only uses reversible XOR obfuscation with a predictable machine-derived key. This can mislead users into trusting the storage mechanism as cryptographically secure when anyone with filesystem access and the script can recover the Plex token.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The comment and behavior indicate the token is 'encrypted' before storage, but XOR with a static machine-bound string is only obfuscation and is trivially reversible. This weak protection exposes the Plex token to recovery by a local attacker or any code able to read the config and reproduce the key derivation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code prompts the user for a Plex token, decrypts it from local storage, and sends it in the X-Plex-Token HTTP header to the Plex server. While there is logging about secure storage and insecure SSL mode, there is no explicit user-facing warning that the token will be used for authenticated network transmission and that library metadata will be fetched from the server.
- Content
Excessive Permissions
Low
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.
- Content
md - By default, SSL certificate verification is enabled (secure) - Use `--insecure` flag only for self-signed certificates (not recommended) **File Permissions:** - Config file is automatically set to `chmod 600` (owner read/write only) - After first run, verify: `ls -la ~/.openclaw/workspace/data/plexmedia2html-export/config.json`
Static analysis
No suspicious patterns detected.