ClawHub
Back to skill

Security audit

DocuSign

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only DocuSign MCP wrapper with setup-time OAuth credential storage that fits its stated purpose.

Install only for a DocuSign developer/demo account you intend this agent to inspect. The skill stores DocuSign OAuth credentials in mcporter's local vault and sends requested DocuSign workflow data to DocuSign's hosted developer MCP server over HTTPS. Avoid providing unrelated sensitive content, and rerun setup only with current credential values because the setup script overwrites the vault entry for this server.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The declared purpose is a read-only DocuSign workflow inspection capability. The supplied code does not interact with DocuSign account/envelope/template/signing data at all. Instead, it parses MCP server config, reads OAuth secrets from environment variables, constructs a token/clientInfo payload, and writes that payload to `mcporter vault set`. This is a credential initialization/provisioning utility, not a read-only DocuSign data access implementation. Because it performs credential storage and potential state changes in the vault—explicitly noting it can clobber rotated refresh tokens—its primary purpose and capabilities materially differ from the description.

Credential Access

High
Category
Privilege Escalation
Content
- `MAVERICK_DOCUSIGN_MCP_EXPIRES_IN`
- `MAVERICK_DOCUSIGN_MCP_REFRESH_TOKEN_EXPIRES_AT`

mcporter sends the refreshed bearer token to DocuSign's hosted MCP server and refreshes expired access tokens through DocuSign's demo token endpoint. If calls keep returning authentication errors after retry, the OAuth grant has likely been revoked or expired; reconnect the integration.

## Data flow
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.