Plaud Unofficial Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:47 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent Plaud API client, but it asks users to extract and persist a long-lived browser bearer token in plaintext, which needs careful review before installation.

Install only if you are comfortable giving this skill access to your Plaud account recordings and transcripts. Use it only with accounts you control, avoid passing tokens on the command line, protect any .env file with owner-only permissions, keep it out of backups and version control, and rotate the Plaud token if it may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:60

Finding

Long-Lived Bearer Token Stored in a Plaintext File Without Enforced Access Controls

Content

View full analysis

~/.claude/skills/plaud-api/.env << 'EOF' PLAUD_TOKEN=bearer eyJ...your_full_token_here... PLAUD_API_DOMAIN=https://api-euc1.plaud.ai EOF ``` ### Technical Analysis The setup instructions direct the user to place a Plaud bearer token in a plaintext `.env` file. The shell redirection used to create the file does not explicitly set owner-only permissions; its resulting mode depends on the user's current `umask`. This is particularly sensitive because the documentation describes the token as long-lived and the client uses it as an Authorization bearer credential. Possession of the token is sufficient to authenticate to the Plaud API. The token grants access to private account content such as recording metadata, transcripts, AI summaries, tags, and downloadable audio. Storing this credential is necessary for unattended API access, but storing it without enforcing restrictive permissions exceeds the minimum safe handling needed for that functionality. The client loads the credential from the file at `plaud_client.py:22-23`: ```python # Load .env from script directory load_dotenv(Path(__file__).parent / ".env") ``` ### Attack Path 1. The user follows the documented setup command and creates `.env`. 2. The file receives permissions determined by the user's `umask`. 3. Another local account, process, backup system, or accidentally exposed development artifact obtains read access to the file. 4. The attacker extracts `PLAUD_TOKEN`. 5. The attacker submits the bearer token to the fixed Plaud API endpoints. 6. The attacker retrieves the victim's recording metadata, transcripts, summaries, tag ...[truncated 657 chars]

Remediation

View remediation

~/.claude/skills/plaud-api/.env << 'EOF' PLAUD_TOKEN=... EOF ``` 3. Have the client reject or warn about credential files readable by group or other users. 4. Prefer an operating-system keychain or dedicated secret manager over a plaintext file. 5. Ensure `.env` is excluded from version control, archives, diagnostics, and support bundles. 6. Document how to revoke or rotate a compromised Plaud token. 7. Avoid unnecessarily retaining a token described as valid for approximately ten months; use the shortest available credential lifetime. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: plaud_client.py:188

Finding

Bearer Token Accepted Through a Command-Line Argument

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Third-Party Dependencies Are Not Reproducibly Pinned or Integrity-Verified

Content

View full analysis

=2.28.0 python-dotenv>=1.0.0 ``` The installation instructions execute: ```bash pip install -r ~/.claude/skills/plaud-api/requirements.txt ``` ### Technical Analysis The dependency declarations specify only minimum versions. Consequently, installations performed at different times may resolve to different, unreviewed future package releases. The requirements file also contains no package hashes, so it does not provide reproducible integrity verification. The packages are obtained under established PyPI names, and the audit found no evidence of typosquatting, dependency confusion, or a currently malicious dependency. The risk is therefore prospective: compromise of a package release, package-maintainer account, package index, or dependency-resolution path could introduce code that runs during installation or import. Because the Skill handles a Plaud bearer token, compromise of either imported dependency could also expose that token and the associated private data. ### Attack Path 1. A user follows the setup instructions and executes `pip install -r requirements.txt`. 2. Pip resolves a future version allowed by the `>=` constraints. 3. A compromised, malicious, or unexpectedly incompatible package version is selected. 4. Package-controlled code executes during installation or when imported by `plaud_client.py`. 5. Malicious code runs with the privileges of the user invoking pip or the client. 6. It may read the `.env` file, steal the bearer token, access local files available to that user, or modify the Python environment. ### Impact Assessment The maximum local scope is the privilege level of the account performing installation or running the client. Potential effects include: - Theft of the Plaud bearer token. - Unauthor ...[truncated 420 chars]

Remediation

View remediation

python-dotenv== ``` 2. Generate and verify cryptographic hashes for all direct and transitive dependencies. 3. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Use a lock-file workflow or a tool such as `pip-tools` to produce reproducible dependency sets. 5. Review dependency updates before changing pinned versions. 6. Run automated vulnerability scanning against the locked dependency set. 7. Install dependencies inside a dedicated virtual environment rather than the user's global Python environment. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

2. Copy the example environment file:

   bash

   cd ~/.claude/skills/plaud-api
   cp .env.example .env
   

3. Follow the credential tutorial in SKILL.md to obtain your Plaud API token

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill is presented as guidance and patterns for accessing Plaud data, but the documented behavior includes active account-wide listing and bulk download operations. This description-behavior mismatch can mislead reviewers and users about the real breadth of data access, increasing the chance of over-collection or unintended sensitive-data handling.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This section explicitly guides the user to collect a bearer token and API domain and persist them in a .env file. Because bearer tokens can directly authenticate to the service, any leakage gives an attacker immediate access to the user's Plaud data until expiry or revocation.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

| `tokenstr` | Your bearer token (starts with "bearer eyJ...") |
| `plaud_user_api_domain` | API endpoint (e.g., "https://api-euc1.plaud.ai") |

### Step 5: Create .env File

Create or update the `.env` file in the skill directory (`~/.claude/skills/plaud-api/`):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The command sequence explicitly creates a local credentials file in the skill directory, encouraging persistent storage of an active bearer token. Persistent plaintext secrets materially increase exposure to theft by local malware, accidental sharing, or misconfigured file synchronization.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

bash

# In the skill directory
cd ~/.claude/skills/plaud-api
cp .env.example .env
# Edit .env with your actual credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The instruction to edit .env with actual credentials reinforces manual handling of live tokens in plaintext. Manual copy/paste of bearer tokens is error-prone and increases the likelihood of leakage via clipboard managers, terminal recording, or user mistakes.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

In the skill directory

cd ~/.claude/skills/plaud-api cp .env.example .env

Edit .env with your actual credentials

text

Or create it directly:

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 93% confidence

Finding

The skill directs users to write secrets into the agent's skill directory under ~/.claude, which is part of the agent configuration area. Storing bearer tokens there increases the blast radius if the agent environment, skill files, logs, backups, or local account are accessed by other tools or users.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Or create it directly:

bash

cat > ~/.claude/skills/plaud-api/.env << 'EOF'
PLAUD_TOKEN=bearer eyJ...your_full_token_here...
PLAUD_API_DOMAIN=https://api-euc1.plaud.ai
EOF

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The heredoc example writes a live bearer token directly into a file under ~/.claude/skills/plaud-api/.env. This concretely operationalizes credential persistence in plaintext inside an agent-related directory, making compromise easier and more impactful.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Or create it directly:

bash

cat > ~/.claude/skills/plaud-api/.env << 'EOF'
PLAUD_TOKEN=bearer eyJ...your_full_token_here...
PLAUD_API_DOMAIN=https://api-euc1.plaud.ai
EOF

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The .env format section includes the shape of the bearer token and reinforces the expectation of storing it in plaintext. While primarily documentation, it still encourages insecure secret persistence and can normalize unsafe handling of authenticated credentials.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

pip install -r ~/.claude/skills/plaud-api/requirements.txt

text

## .env File Format

PLAUD_TOKEN=bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The troubleshooting text tells users to resolve authentication issues by re-extracting tokens from localStorage, reinforcing repeated credential harvesting from the browser. This increases operational exposure of the token and normalizes direct handling of high-value session credentials.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

|-------|-------|-----|
| `401 Unauthorized` | Token expired or invalid | Re-extract token from localStorage |
| `Empty response` | Invalid file_id format | Verify file_id is 32 hex characters |
| `Connection error` | Wrong API domain | Check PLAUD_API_DOMAIN in .env |
| `Token required` | Missing .env or PLAUD_TOKEN | Follow credential tutorial above |

## Token Refresh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The surrounding error-handling guidance references the .env credential file as the normal authentication mechanism, which perpetuates insecure secret storage practices. Even when informational, this supports a workflow where active credentials remain in a predictable plaintext location.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md

| `401 Unauthorized` | Token expired or invalid | Re-extract token from localStorage |
| `Empty response` | Invalid file_id format | Verify file_id is 32 hex characters |
| `Connection error` | Wrong API domain | Check PLAUD_API_DOMAIN in .env |
| `Token required` | Missing .env or PLAUD_TOKEN | Follow credential tutorial above |

## Token Refresh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · plaud_client.py (reported line 6)May include surrounding context.

python

Plaud API Client - Fetch recordings from your Plaud account

Usage:
    1. Token is loaded automatically from .env file
    2. Run: python plaud_client.py details <file_id>

Or set PLAUD_TOKEN environment variable, or use --token flag.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · plaud_client.py (reported line 22)May include surrounding context.

python

Plaud API Client - Fetch recordings from your Plaud account

Usage:
    1. Token is loaded automatically from .env file
    2. Run: python plaud_client.py details <file_id>

Or set PLAUD_TOKEN environment variable, or use --token flag.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · plaud_client.py (reported line 23)May include surrounding context.

python

from dotenv import load_dotenv

# Load .env from script directory
load_dotenv(Path(__file__).parent / ".env")


class PlaudClient:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly instructs users how to retrieve long-lived bearer tokens from browser localStorage and use them against private endpoints for recordings, transcripts, summaries, and share metadata. In a skill whose purpose is to access Plaud account data, this materially enables handling of highly sensitive user content without any warning, consent guidance, secure storage requirements, or boundary on authorized use, increasing the risk of credential misuse and privacy compromise.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents commands that rely on environment-stored credentials and network access, but it declares no explicit tool scope or permissions. That mismatch weakens reviewability and can cause an agent or user to invoke credentialed network operations without clear upfront disclosure of the required capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill normalizes access to recordings, transcripts, and AI summaries without warning that these may contain highly sensitive personal, business, or regulated information. Missing privacy and data-handling guidance makes accidental overexposure more likely, especially when downloading or processing content in bulk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to extract a bearer token from browser localStorage and save it in a local .env file, but it does not warn that this token grants authenticated access and must be protected as a secret. That omission increases the risk of accidental exposure through shell history, backups, screenshots, file sync, or other local compromise.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The skill explicitly instructs users to persist a long-lived bearer token in a .env file, creating durable session persistence outside the browser. If that file is read by other processes or copied via backups/sync, the authenticated session can be reused for months without re-login.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

| `tokenstr` | Your bearer token (starts with "bearer eyJ...") |
| `plaud_user_api_domain` | API endpoint (e.g., "https://api-euc1.plaud.ai") |

### Step 5: Create .env File

Create or update the `.env` file in the skill directory (`~/.claude/skills/plaud-api/`):

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes access to recordings, transcripts, and AI summaries, suggesting broader recorder-data retrieval coverage. In this file, the implemented API methods and CLI expose file details, file lists, tags, AI task status, and audio download, but no transcript or AI summary retrieval endpoints or commands are present.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The top-level documentation frames the script as a fetch/details client, which implies read/retrieve behavior. The implementation includes download commands and file writes via download_audio and download-all, so the documentation understates the side effects of saving local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This code automatically loads credentials from a local .env file and also accepts the PLAUD_TOKEN environment variable. While the module docstring mentions where the token comes from, it does not clearly warn users that the script reads sensitive authentication material or advise secure handling, which fits the missing-user-warning criterion for credential access in code files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Multiple commands send authenticated requests to Plaud cloud endpoints to retrieve file metadata and audio, which necessarily transmits user/account data over the network. Although network access is inherent to an API client, the code lacks an explicit disclosure in comments, help text, or docstrings warning users that account data and recording information are sent to remote services.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only (requests>=2.28.0), which makes builds non-reproducible and can pull in unexpected versions over time. In a skill that may access recordings, transcripts, and summaries, dependency drift increases supply-chain risk and makes it harder to verify whether a deployed version includes known security fixes or newly introduced vulnerabilities.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28.0
python-dotenv>=1.0.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

requests has known advisories, and because the manifest does not pin a specific version, there is no reliable way to determine whether the installed package is affected. In a skill that may communicate with an external API and potentially handle sensitive Plaud data, unverifiable dependency state increases the risk of credential leakage, TLS-related issues, or other library-level flaws depending on the resolved version.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Using python-dotenv>=1.0.0 without an upper bound or exact pin allows installation of different versions in different environments, weakening reproducibility and security review. Because this skill handles credential setup, lax dependency control around environment-file tooling increases the chance of pulling a vulnerable or behavior-changing release into a sensitive context.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.28.0
python-dotenv>=1.0.0

Static analysis

No suspicious patterns detected.