Security audit

Mingdata Dmp Auth

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate DMP API-auth purpose, but it handles long-lived credentials in chat and persistent shared configuration in a way users should review carefully.

Install only if you are comfortable giving this skill Mingdata DMP credentials and allowing them to be reused across sessions by related skills. Prefer entering credentials through a dedicated secret manager or scoped environment mechanism, avoid pasting secrets into normal chat, rotate credentials if they were exposed in logs, and review any gateway restart or OpenClaw config changes before allowing them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation makes conflicting security claims: it says credentials are only stored locally and not uploaded to the cloud, while also instructing persistence through OpenClaw configuration and gateway restart. This can mislead users about where secrets are stored and who can access them, causing unsafe disclosure decisions based on inaccurate trust assumptions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill documentation authorizes the AI to execute persistent OpenClaw configuration changes and restart the gateway, which exceeds a narrow API-authentication role. Granting infrastructure-modifying authority inside a credential helper increases the blast radius from simple secret setup to system-wide configuration changes and service disruption.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The test-credentials path prints masked portions of both the access key and secret key to stdout. Even partial secret disclosure increases exposure in logs, terminal history captures, CI output, or shared debugging sessions, and a credential-management utility has no strong need to reveal secret material during validation.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The workflow says the AI will automatically set persistent environment values and restart the gateway without clearly warning that these are durable configuration changes and an infrastructure restart. Users may provide approval without understanding the operational and security consequences, which defeats meaningful consent.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The unified API gateway accepts arbitrary JSON request bodies for external transmission to Mingdata, but the documentation does not clearly warn that these payloads may contain user, audience, or business data leaving the local environment. This creates a privacy and compliance risk because users may not realize sensitive datasets are being sent to a third-party service.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The save-credentials workflow persists long-lived secrets to disk and later echoes the full access key plus a preview of the secret key to stdout. This creates avoidable exposure through shell history, process inspection, screenshots, logs, and terminal recording, especially because this module is intended to centrally manage credentials for multiple downstream skills.

Ssd 3

High

Confidence: 98% confidence
Finding: The skill explicitly instructs users to paste plaintext AK/SK credentials into chat and states that the AI will automatically persist them into shared environment configuration. Collecting secrets through conversational text and then storing them in shared persistent settings materially increases exposure to logs, session history, other skills, and unintended reuse across contexts.

Ssd 4

Medium

Confidence: 90% confidence
Finding: The documentation uses a reassuring setup narrative and then asks the user to hand over sensitive credentials for automatic handling by the AI. Even if not overtly malicious, this pattern lowers user caution and normalizes secret sharing in chat, making credential theft or misuse more likely in adjacent workflows.

Static analysis

No suspicious patterns detected.