AuditClaw Idp

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:53 PM UTC
• Version: 1.0.2

Overview

The skill appears to do the promised identity-provider compliance checks, but it needs Review because its setup can expose highly privileged Google Workspace and Okta access and stores detailed user security posture locally.

Install only after creating dedicated least-privilege Google Workspace and Okta service identities, removing the unused Google audit-report scope, restricting OKTA_ORG_URL to your exact tenant, protecting and rotating tokens, and accepting that the local GRC database will contain identifiable user security-posture data.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/idp_evidence.py:298

Finding

Okta API Token Can Be Transmitted to an Arbitrary HTTPS Host

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:97

Finding

Unused Google Audit-Report Scope Is Requested During Setup

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:108

Finding

Okta Setup Can Produce an Overprivileged Inherited-Permission Token

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/idp_evidence.py:62

Finding

Identifiable User Security Posture Is Persisted Without Data Minimization

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/requirements.txt:1

Finding

Required Okta SDK Dependency Is Not Declared

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tainted flow: 'headers' from os.environ (line 303, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/idp_evidence.py (reported line 305)May include surrounding context.

python

token = os.environ["OKTA_API_TOKEN"]
            headers = {"Authorization": f"SSWS {token}", "Accept": "application/json"}
            # Test user endpoint
            resp = requests.get(f"{org_url}/api/v1/users?limit=1", headers=headers, timeout=10)
            if resp.status_code == 200:
                results.append({"service": "Okta Auth", "status": "ok", "detail": "credentials valid"})
                results.append({"service": "Okta Users API", "status": "ok", "detail": "accessible"})

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is described as performing read-only compliance checks, but the documented behavior includes writing evidence and integration status into a shared SQLite database and invoking an external helper to do so. This discrepancy can mislead operators into granting trust under a read-only assumption when the skill in fact mutates local state and interacts with another script, expanding the attack surface and enabling unintended data tampering or persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README tells users to place sensitive credentials into environment variables, including an Okta API token and a path to a Google Workspace service-account key, but gives no guidance on secure handling, storage, rotation, or avoiding shell history and accidental disclosure. While using environment variables is common, documenting secret setup without safety warnings increases the chance of credential exposure through shared shells, process inspection, logs, screenshots, or copied command history.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises executable behavior with access to environment variables, network APIs, and shell execution, but does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens reviewability and enforcement because consumers cannot easily tell what capabilities the skill expects, increasing the risk of overbroad execution or hidden capability abuse if the implementation changes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The security model claims Google Workspace uses only the admin.directory.user.readonly scope, while the setup instructions additionally require admin.reports.audit.readonly. Inconsistent scope documentation can cause underestimation of privilege, making reviewers and operators believe the integration is less sensitive than it really is and potentially approving broader access without proper scrutiny.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes '8 read-only checks' across Google Workspace and Okta, which implies observation-only behavior. In addition to running checks, this script inserts evidence records into the database and updates integration status fields, which are state-changing write operations outside a purely read-only checking role.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/idp_evidence.py (reported line 77)May include surrounding context.

python

"--file-content", json.dumps(result, default=str),
    ]

    proc = subprocess.run(cmd, capture_output=True, text=True)
    if proc.returncode != 0:
        return _store_evidence_direct(db_path, check_name, result)

Known Vulnerable Dependency: requests==2.31.0 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more

Medium

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The file pins requests to version 2.31.0, which is identified by the static analysis as having multiple published advisories, including credential leakage and TLS verification/session handling issues. In an identity-provider auditing skill that likely makes authenticated outbound HTTP requests to Google or Okta APIs, a vulnerable HTTP client library increases the risk of token, credential, or response-handling compromise.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The top-level documentation describes running compliance checks and storing evidence, but omits that the script also mutates the integrations table by changing status, timestamps, and error counters. Because the documentation frames the behavior more narrowly than the code's actual state changes, it creates an intent/code mismatch for operators reviewing what the script affects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.