Security audit

ClawDirect Dev

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for building ATXP web apps, but it recommends an unsafe authentication-cookie flow that can expose reusable session credentials.

Review this carefully before installing or reusing it. The main issue is not that it uses ATXP, cookies, npm, or MCP, but that it teaches developers to put reusable authentication cookies in URLs and keep server-side sessions without clear expiry or revocation. Prefer a one-time, short-lived bootstrap token or direct cookie-setting support, add server-side session expiration and revocation, and pin dependency and CLI versions before using the template in production.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:313
Finding: Bearer Authentication Token Exposed Through URL Query Parameters
Content: View full analysis
{ const cookieValue = req.query.myapp_cookie; if (typeof cookieValue === 'string' && cookieValue.length > 0) { res.cookie('myapp_cookie', cookieValue, { httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax', path: '/', maxAge: 30 * 24 * 60 * 60 * 1000 // 30 days }); const url = new URL(req.originalUrl, `http://${req.headers.host}`); url.searchParams.delete('myapp_cookie'); res.redirect(302, url.pathname + url.search || '/'); return; } next(); }); ``` The corresponding usage instructions are: ```bash npx atxp-call https://your-domain.com/mcp myapp_cookie '{}' ``` ```text https://your-domain.com?myapp_cookie= ``` The server will set the HTTP-only cookie and redirect to clean the URL. ### Technical Analysis The cookie value is a bearer credential mapped directly to an ATXP account. Placing this credential in a query string can expose it through: - Browser history and synchronization services - Reverse-proxy, load-balancer, CDN, and web-server access logs - Application performance monitoring and analytics systems - Screenshots, copied URLs, support records, and browser automation traces - Referrer propagation under configurations that permit full or partial URL disclosure Redirecting to a clean URL only removes the credential from subsequent navigation. It does not rem ...[truncated 2474 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:118
Finding: Authentication Sessions Lack Server-Side Expiration and Revocation
Content: View full analysis
Remediation: View remediation
CURRENT_TIMESTAMP` and `revoked_at IS NULL`. - Keep server-side expiration no longer than the browser cookie lifetime. - Implement explicit logout that revokes the current session and clears the browser cookie. - Provide account-wide session revocation for compromised credentials or security-sensitive account changes. - Rotate session tokens periodically and after authentication, privilege, or payment-related changes. - Periodically delete expired and revoked records. - Consider storing a cryptographic hash of each token rather than the raw bearer value, reducing direct token disclosure if the database is read. - Apply both an absolute lifetime and, where appropriate, an idle timeout. - Add automated tests confirming that expired, revoked, rotated, and logged-out sessions are rejected. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:78
Finding: Unpinned Third-Party Dependencies and Implicit npx Package Execution
Content: View full analysis
[params]` ``` ```bash npx atxp-call https://your-domain.com/mcp myapp_cookie '{}' ``` Additional paid operations use the same execution pattern: ```bash npx atxp-call https://claw.direct/mcp clawdirect_add '{ "url": "https://your-site.com", "name": "Your Site Name", "description": "Brief description of what your site does for agent", "thumbnail": "", "thumbnailMime": "image/png" }' ``` ```bash npx atxp-call https://claw.direct/mcp clawdirect_edit '{ "url": "https://your-site.com", "description": "Updated description" }' ``` ### Technical Analysis The `npm install` commands resolve whatever package versions satisfy the registry's current defaults at installation time. The Skill provides neither exact versions nor a reviewed lockfile, so the effective code can change without any modification to `SKILL.md`. Package installation can execute lifecycle scripts with the user's operating-system permissions. Runtime packages also execute inside the server process and can access environment variables, authentication data, the SQLite database, and network resources available to that process. When the requested command is not already installed locally, `npx` may download a package a ...[truncated 2082 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly recommends transporting an authentication cookie in the URL query string, which can leak credentials through browser history, server logs, reverse proxies, analytics, referrer headers, screenshots, and shared links. This is especially dangerous because the cookie grants authenticated web access and the pattern is presented as recommended without a strong warning or compensating controls.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The reusable SKILL.md template tells downstream developers and agents to authenticate by visiting a cookie-bearing URL, but omits any warning that doing so can disclose the credential to multiple logging and telemetry surfaces. Because this is a template, it amplifies the insecure pattern across other projects, increasing the likelihood of credential leakage and session hijacking at scale.
Content: No source excerpt is available for this finding.