T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ms-todo-oauth.py:36- Finding
Published OAuth Client Secret Used as an Automatic Fallback
- Content
View full analysis
- Remediation
View remediation
Security audit
Ms Todo Oauth
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to manage Microsoft To Do as advertised, but it ships a reusable OAuth client secret and persists sensitive login tokens without permission hardening.
Review before installing. Use your own Azure app registration, do not rely on the embedded fallback secret, avoid passing client secrets on the command line, restrict or remove the local token cache when done, treat exported task JSON as private data, and confirm any delete-list or delete-task action before allowing an agent to run it.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ms-todo-oauth.py:64- Finding
OAuth Token Cache Is Persisted Without Enforced Owner-Only Permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ms-todo-oauth.py:1267- Finding
OAuth Client Secret Can Be Supplied Through Process Arguments
- Content
View full analysis
" --client-secret "" lists ``` ### Technical Analysis Command-line arguments are not an appropriate channel for long-lived secrets. Depending on the operating system and execution environment, command arguments may be observable through process inspection, shell history, terminal recording, job-control metadata, CI/CD logs, agent tool transcripts, telemetry, or crash diagnostics. The parser does not mask the argument, warn the user at execution time, or erase it from surrounding logging systems. Although the code does not intentionally print the secret, exposure can occur before the application processes the argument. ### Attack Path 1. A user follows the documented example and places the client secret after `--client-secret`. 2. The shell records the full command in command history, or an orchestration/agent platform records it in execution logs. 3. Alternatively, a local user inspects process arguments while the command is running. 4. An attacker with access to that history, log, transcript, or process metadata retrieves the secret. 5. The attacker uses the credential to impersonate the registered OAuth application, subject to the application's Entra configuration. ### Impact Assessment The exposed value compromises the OAuth application credential rather than directly authenticating as a Microsoft user. Potential scope includes application impersonation, ...[truncated 247 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:6- Finding
Dependencies Are Installed from Unbounded Version Ranges Without Integrity Pinning
- Content
View full analysis
=1.34.0 # HTTP library for API requests requests>=2.32.5 ``` The documented installation command is: ```bash python -m pip install -r requirements.txt ``` ### Technical Analysis The manifest defines only minimum versions. Any future release satisfying these ranges can be selected at installation time, including versions that were never reviewed with this project. No lock file or package hashes are present, and installation is recommended in the active Python environment. The package names are legitimate and no dependency-confusion or typosquatting package was identified. The risk arises from non-reproducible resolution and lack of artifact integrity enforcement rather than from a presently confirmed malicious dependency. Because these libraries participate directly in OAuth processing and HTTP communication, an unsafe or compromised future release would execute in the CLI process and could access client credentials, authorization codes, cached tokens, task data, and network requests. ### Attack Path 1. A dependency publisher account, package index, distribution artifact, or future compatible release is compromised or becomes unsafe. 2. A user runs the documented `pip install -r requirements.txt` command at a later date. 3. Pip resolves a newer release permitted by the `>=` constraint. 4. Package installation or imported runtime code executes in the user's environment. 5. Malicious or compromised code accesses the same process privileges and sensitive OAuth/task data available to the Skill. This path depends on an upstream supply-chain compromise or unsafe future release; the audit did not find evidence that the currently named packages are malicious. ### Impa ...[truncated 428 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (113)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The README admits built-in fallback Azure app credentials and a committed client secret in the script, which is materially more sensitive than a normal task-management CLI. Shipping embedded OAuth confidential-client credentials enables anyone with the skill to reuse the application identity and can facilitate unauthorized Graph access attempts, tenant abuse, or secret leakage and replay.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Built-in fallback values in `scripts/ms-todo-oauth.py`
Static analysis
Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/test_ms_todo_oauth.py:43
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/ms-todo-oauth.py:38
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/test_ms_todo_oauth.py:123