ClawHub
Back to skill

Security audit

PandaDoc

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed PandaDoc MCP integration that stores OAuth credentials locally and lets an agent read or write PandaDoc data with confirmation safeguards.

Install only if you intend this agent to use your PandaDoc OAuth account to inspect and, with explicit confirmation, modify PandaDoc records. Keep the OAuth credentials fresh, avoid sending unrelated sensitive content through tool arguments, and revoke the PandaDoc grant when it is no longer needed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description says the skill is a thin pass-through to PandaDoc's official MCP server for reading and writing PandaDoc workspace data. The provided code does something materially different: it provisions OAuth state for a generic MCP server by extracting access/refresh tokens, client ID, and optionally client secret from environment variables, building a JSON payload, and storing it in mcporter's vault. There is no PandaDoc-specific API interaction, no read/write of PandaDoc workspace data, and no live tool pass-through behavior shown in this chunk. This is not merely supporting implementation detail for PandaDoc data access; its primary purpose is credential initialization and secret storage, which is an undeclared capability and a different function from the declared description.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
- `MAVERICK_PANDADOC_MCP_EXPIRES_IN`
- `MAVERICK_PANDADOC_MCP_REFRESH_TOKEN_EXPIRES_AT`

These expiry fields are vault metadata, not tool arguments. They let mcporter make better pre-request refresh decisions for the access token and preserve refresh-token expiry information when the upstream OAuth response includes it.

**Setup-time prerequisites.** Setup needs `bash`, `jq`, and `mcporter` (>= v0.11.0) on `PATH`. These are gated by the install caller, not by `requires.bins` in this file, which gates agent-runtime eligibility. If setup fails, verify those binaries are present and current before retrying.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger text says to use the skill whenever the user asks about PandaDoc work or wants to read or write PandaDoc data, which is broad enough to auto-route many loosely related requests into a write-capable external integration. In agent environments, overly broad invocation criteria increase the chance of unnecessary external data exposure or unintended actions against a live SaaS workspace.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
92% confidence
Finding

The instruction to 'Call any tool from the catalog' grants effectively unbounded access to whatever operations the remote PandaDoc MCP server advertises at runtime. Because the live catalog is external and may include sensitive read, write, send, workflow, or other side-effecting actions, this creates a broad authority surface with limited local policy enforcement.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

The output includes PandaDoc's Instructions: field (read it) and a JSON Schema for every tool's parameters. Treat this as the authoritative reference for the rest of the session.

Step 2 - Call any tool from the catalog using the form maverick-pandadoc-mcp.<tool>:

sh
mcporter --config {baseDir}/mcporter.json call maverick-pandadoc-mcp.<tool> <arg>=<value> ...

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The script invokes init-mcporter-oauth.sh, which is a subprocess execution and therefore a safety-relevant operation under the code-file warning criteria. Although the file has internal comments for maintainers, it provides no user-facing confirmation, prompt, or explicit disclosure to the operator at execution time about what the delegated setup action will do.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.