Dashform

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:10 AM UTC
• Version: 0.1.0

Overview

The skill is for creating Dashform forms, but its authentication flow asks users to expose a live browser session cookie and caches account identifiers locally.

Review before installing. The main risk is not that the skill creates forms, but that it tells you to paste a live Dashform browser session cookie into the agent and uses it through a shell script. Only use this if you trust the environment and Dashform endpoint, understand that account identifiers will be cached locally, and have a way to revoke the session afterward. A safer version would use OAuth, a device-code login, or a scoped API token instead of a browser cookie.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup-credentials.sh:13
• Finding: Browser Session Token Exposed Through Agent Conversation and Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup-credentials.sh:13-48`; related instructions in `SKILL.md:45-64` **Vulnerability Type**: Unsafe handling of a bearer-equivalent browser session token **Risk Level**: High ### Vulnerable Code ```bash # Get session token from argument or prompt if [ -n "$1" ]; then SESSION_TOKEN="$1" else echo "Step 1: Get your session token" echo "1. Sign in to https://getaiform.com" echo "2. Open browser DevTools (F12)" echo "3. Go to Application → Cookies" echo "4. Find 'better-auth.session_token'" echo "5. Copy its value" echo "" read -p "Paste your session token: " SESSION_TOKEN fi if [ -z "$SESSION_TOKEN" ]; then echo "Error: Session token is required" exit 1 fi echo "" echo "Fetching your user information via MCP..." # Call MCP get_user_info tool RESPONSE=$(curl -s -X POST "$MCP_URL" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d "{ \"jsonrpc\": \"2.0\", \"id\": 1, \"method\": \"tools/call\", \"params\": { \"name\": \"get_user_info\", \"arguments\": { \"sessionToken\": \"$SESSION_TOKEN\" } } }") ``` The corresponding Skill instruction explicitly tells the user to disclose the cookie and passes it as a command-line argument: ```bash .claude/skills/dashform/scripts/setup-credentials.sh "user-provided-token" ``` ### Technical Analysis The Skill asks the user to copy the `better-auth.session_token` browser cookie into the Agent conversation. A browser session cookie is a bearer credential: possession may be sufficient to act with the authenticated user's Dashform privileges until the session expires or is revoked. Although transmission to `https://getaiform.com/api/mcp` is declared and relevant to the Skill's function, the credential-handling mechanism is unsafe: 1. The token enters the Agent conversation ...[truncated 2368 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace browser-cookie collection with OAuth, device authorization, or another server-supported authentication flow. 2. Issue a short-lived token scoped only to required operations such as `get_user_info` and `create_form`. 3. Never ask users to paste session cookies into an Agent conversation. 4. Never pass secrets through command-line arguments. Read them from a protected credential store, a restricted file descriptor, or silent standard input. 5. If interactive input is temporarily unavoidable, use `read -r -s` and clear the variable immediately after use. 6. Construct the request with a JSON-aware tool such as `jq --arg` rather than directly interpolating the credential. 7. Prevent secret values from appearing in shell tracing, tool logs, telemetry, error output, and command histories. 8. Support explicit token revocation and expiration, and document how users can invalidate a potentially exposed session. 9. Clearly state that `https://getaiform.com/api/mcp` is a remote service and that authentication data leaves the local environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-credentials.sh:69
• Finding: Cached Personal and Tenant Identifiers Lack Explicit File-Permission Protection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup-credentials.sh:69-89` **Vulnerability Type**: Insecure local storage and logging of identity information **Risk Level**: Medium ### Vulnerable Code ```bash # Save credentials mkdir -p "$(dirname "$CREDENTIALS_FILE")" cat > "$CREDENTIALS_FILE" << JSON { "userId": "$USER_ID", "organizationId": "$ORG_ID", "userName": "$USER_NAME", "userEmail": "$USER_EMAIL", "cachedAt": "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" } JSON echo "" echo "Credentials saved successfully!" echo "" echo "User: $USER_NAME ($USER_EMAIL)" echo "User ID: $USER_ID" echo "Organization ID: $ORG_ID" echo "" echo "You can now use the Dashform agent skill without manually providing credentials." echo "Credentials are cached in: $CREDENTIALS_FILE" ``` ### Technical Analysis The script writes the user's name, email address, user ID, and organization ID to `credentials.json` without setting a restrictive `umask` or explicitly applying mode `0600`. The resulting permissions therefore depend on the caller's environment. Under a permissive `umask`, other local users or processes may be able to read the file. The script also prints all cached identifiers, including the email address and organization ID, to standard output. Agent tool output, CI logs, terminal capture, or diagnostic telemetry may retain that information. The session token itself is not written to `credentials.json`, which limits the severity. Nevertheless, the stored data includes personal information and tenant identifiers useful for reconnaissance and targeted attacks. The Skill also instructs the Agent to read the entire credential file even though form creation only needs the user ID and organization ID. ### Attack Path 1. A user completes the Dashform credential setup process. 2. The script creates `credentials.json` under the Skill directory using permissions determined by the current `umask`. 3. In a shared or permissively configured environment, another l ...[truncated 924 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set `umask 077` before creating the credential directory and file. 2. Create the file atomically and enforce mode `0600`; ensure the containing directory is accessible only to the intended user. 3. Store only the minimum required values. Remove `userName` and `userEmail` unless they are strictly necessary. 4. Avoid printing email addresses, user IDs, and organization IDs to standard output. Use a generic success message. 5. Use an operating-system credential store or encrypted secret-management facility instead of a plaintext JSON file where available. 6. Add `credentials.json` to version-control ignore rules and exclude it from artifact packaging, backups, and diagnostic bundles where appropriate. 7. Provide a logout or cleanup command that securely removes cached account metadata and revokes associated authorization. 8. Validate and serialize server response values with a JSON parser rather than using regular expressions and an unescaped here-document. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The advertised purpose is form creation, but the actual workflow includes collecting a browser session token, deriving identity information, and caching credentials locally. This hidden expansion of scope is dangerous because users and agent operators may authorize the skill for form management while unknowingly enabling credential collection and local secret storage.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

When the user asks to create a form, **ALWAYS check for cached credentials first**:

```bash
cat .claude/skills/dashform/credentials.json
```

- **If credentials exist**: Extract `userId`, `organizationId`, and `userName`, proceed to Step 4

• Confidence: 95% confidence
• Finding: The skill instructs direct reading of `.claude/skills/dashform/credentials.json`, which is within the agent configuration area and likely to contain sensitive state. Accessing that path from a skill expands the skill's reach into privileged local context and can expose credentials or identity data unrelated to the immediate user request.

Credential Access

High

• Category: Privilege Escalation

Content

When the user asks to create a form, **ALWAYS check for cached credentials first**:

```bash
cat .claude/skills/dashform/credentials.json
```

- **If credentials exist**: Extract `userId`, `organizationId`, and `userName`, proceed to Step 4

• Confidence: 99% confidence
• Finding: The skill explicitly accesses `credentials.json`, indicating direct handling of credential-related material. In the broader context of also collecting session tokens and running local scripts, this creates a clear secret-exposure path through local files, shell execution, logs, and agent transcripts.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs the user to extract and send a raw session cookie from browser DevTools, which is effectively a bearer credential. Possession of that token can enable account takeover or unauthorized API access, and using an agent as the collection path expands exposure to logs, transcripts, and downstream tools.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The workflow combines two risky actions: prompting the user to reveal a browser cookie and then caching derived credentials locally for future reuse. That combination creates a persistent authentication foothold and increases the blast radius from a one-time disclosure into repeated unauthorized access if the local environment or transcripts are compromised.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The instructions ask the user to disclose a sensitive browser session token and state that credentials will be cached automatically, but they do not warn about token sensitivity, persistence, reuse, or revocation. This creates a strong risk of unsafe user behavior and long-lived compromise if the token is exposed or retained improperly.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

Then read the cached credentials:

```bash
cat .claude/skills/dashform/credentials.json
```

Extract `userId`, `organizationId`, and `userName` for use in form creation.

• Confidence: 95% confidence
• Finding: This second direct read of the agent config directory again accesses `credentials.json` for operational use, reinforcing a pattern of retrieving sensitive local state from a privileged location. Repeated dependence on `.claude/` makes the skill more dangerous because compromise of the skill or its scripts could expose persistent credential material.

Credential Access

High

• Category: Privilege Escalation

Content

Then read the cached credentials:

```bash
cat .claude/skills/dashform/credentials.json
```

Extract `userId`, `organizationId`, and `userName` for use in form creation.

• Confidence: 99% confidence
• Finding: This repeated access to `credentials.json` confirms the skill operationally depends on locally persisted credential data. That persistence makes compromise more damaging because an attacker or another process could reuse the stored values beyond the original session.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

Before generating the form JSON configuration, **ALWAYS read these files**:

```bash
cat .claude/skills/dashform/references/SCHEMA.md
cat .claude/skills/dashform/references/API.md
```

• Confidence: 85% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

Before generating the form JSON configuration, **ALWAYS read these files**:

```bash
cat .claude/skills/dashform/references/SCHEMA.md
cat .claude/skills/dashform/references/API.md
```

• Confidence: 85% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Credential Access

High

• Category: Privilege Escalation

Content

# This script uses the MCP get_user_info tool to cache credentials

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
CREDENTIALS_FILE="$SCRIPT_DIR/../credentials.json"
MCP_URL="https://getaiform.com/api/mcp"

echo "Dashform Credentials Setup..."

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# This script uses the MCP get_user_info tool to cache credentials

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
CREDENTIALS_FILE="$SCRIPT_DIR/../credentials.json"
MCP_URL="https://getaiform.com/api/mcp"

echo "Dashform Credentials Setup..."

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill invokes shell commands to read local files and run scripts, but it does not declare any tool scope or permission boundary. That mismatch increases the chance an agent will execute local file access and credential-handling actions without transparent user consent or least-privilege controls.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill directs the agent to read and later rely on a local credentials file in the agent configuration area. Even if the file only contains identifiers, this establishes undocumented secret/state management in a sensitive directory and normalizes local credential persistence for a task that should not require it.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: This form collects personally identifiable information including full name, email, company, and job title, and also asks about dietary restrictions, which can reveal sensitive health-related information. Presenting the collection without any privacy notice, retention policy, consent language, or data-use explanation creates privacy and compliance risk and may cause users to disclose data without informed consent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The form solicits an email address for follow-up but provides no visible privacy notice, purpose limitation, retention disclosure, or consent language near the field. This can lead to collection of personal data without adequate user awareness, increasing privacy, compliance, and trust risks if the example is reused as-is in production.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs users to provide a raw browser session token (`better-auth.session_token`) so the tool can derive user and organization credentials. Session tokens are highly sensitive bearer secrets; collecting and transmitting them through an MCP skill greatly expands the attack surface and is not necessary for normal form-authoring workflows if proper delegated auth is used. In this context, a compromised or misused token could allow account takeover or unauthorized access to organizational resources.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The docs normalize copying a browser session token into the tool for 'credential caching' without prominently warning that this value is equivalent to an authenticated session secret. That creates a phishing-like UX pattern where users may disclose reusable credentials to an intermediary system without understanding the risk, increasing the chance of accidental credential exposure or replay.

External Transmission

Medium

• Category: Data Exfiltration

Content

Test MCP server directly:

```bash
curl -X POST https://getaiform.com/api/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo ""

# Call MCP create_form tool
RESPONSE=$(curl -s -X POST "$MCP_URL" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json, text/event-stream" \
    -d "{

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This shell script sends merged form contents together with user and organization identifiers to an external HTTPS endpoint via curl. Although the script prints progress messages, it does not clearly disclose to the user that local form data and credential-derived identifiers will be transmitted off-host.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script instructs the user to manually extract a live browser session cookie from DevTools and paste it into the script. Session cookies are authentication secrets; collecting them outside the browser materially increases account-takeover risk if the terminal history, process list, shell logs, or copied value are exposed. In the context of a form-management skill, asking for raw session cookies is unnecessarily dangerous and expands the trust boundary well beyond normal usage.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script handles a highly sensitive session token and gives users step-by-step instructions to retrieve it from browser cookies, but it does not clearly and explicitly warn that the value will be transmitted to a remote API endpoint. Users may reasonably assume the token is only used locally, when in fact it is sent off-host for authentication, increasing the risk of unintentional secret disclosure. Because the secret is a session cookie, compromise can directly enable account access.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Fetching your user information via MCP..."

# Call MCP get_user_info tool
RESPONSE=$(curl -s -X POST "$MCP_URL" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json, text/event-stream" \
    -d "{

• Confidence: 89% confidence
• Finding: The script transmits user-supplied authentication material to an external service via curl. External transmission by itself can be legitimate, but here it carries a browser session token obtained through manual extraction, which substantially raises the impact of mistakes, interception through local logging, or endpoint misuse. In this skill context, that makes the transmission security-sensitive and deserving of stronger controls and disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script writes credential-related account data to disk without clearly informing the user beforehand that local persistence will occur. Even though the cached file contains identifiers rather than the raw session token, undisclosed storage of account metadata can create privacy and operational risks, especially on shared systems or in source-controlled directories. The danger is elevated by the file name credentials.json, which implies sensitive authentication material and may attract mishandling.