ClawHub
Back to skill

Security audit

PandaDoc

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed PandaDoc MCP connector that stores PandaDoc OAuth credentials locally and instructs the agent to get confirmation before write actions.

Install this only if you want an agent to act through your connected PandaDoc account. Review the OAuth grant, avoid sending unrelated sensitive content through tool arguments, require clear confirmation for edits or sends, and revoke the PandaDoc connection when it is no longer needed.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
This is a mismatch because the description says the skill is used to read and write PandaDoc workspace data through PandaDoc's hosted MCP server, but the provided code does not implement any PandaDoc data access at all. Its sole behavior is setup/provisioning: it parses a configured MCP server entry, reads OAuth tokens/client information from environment variables, and stores them in mcporter's vault. That is materially different from a user-facing PandaDoc pass-through skill, and it is not specific to PandaDoc beyond whatever server may happen to be configured in `mcporter.json`.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The description says to use the skill whenever the user 'asks about PandaDoc work or wants to read or write PandaDoc data,' which is a very broad natural-language trigger. It does not clearly distinguish when this skill should activate versus when a general conversational response about PandaDoc would be more appropriate, increasing the risk of unintended invocation.

Credential Access

High
Category
Privilege Escalation
Content
- `MAVERICK_PANDADOC_MCP_EXPIRES_IN`
- `MAVERICK_PANDADOC_MCP_REFRESH_TOKEN_EXPIRES_AT`

These expiry fields are vault metadata, not tool arguments. They let mcporter make better pre-request refresh decisions for the access token and preserve refresh-token expiry information when the upstream OAuth response includes it.

**Setup-time prerequisites.** Setup needs `bash`, `jq`, and `mcporter` (>= v0.11.0) on `PATH`. These are gated by the install caller, not by `requires.bins` in this file, which gates agent-runtime eligibility. If setup fails, verify those binaries are present and current before retrying.
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.