ClawHub
Back to skill

Security audit

TokPortal

Security checks for vulnerabilities and agentic risk

Overview

The files do not show malware, but the skill gives an agent broad TokPortal control to spend credits, publish social content, and retrieve account credentials with weak safety guidance.

Review this skill carefully before installing. Only use it with a TokPortal key that has the minimum needed permissions and spending limits, avoid storing live keys directly in shared config files, pin and review the MCP package before running it, and require explicit approval before bulk creation, publishing, uploads, credit spending, or retrieving account credentials and verification codes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:24
Finding

Unpinned Third-Party MCP Package Is Automatically Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:24 and SKILL.md:52-63
Vulnerability Type: Unpinned and automatically executed third-party dependency
Risk Level: High

Vulnerable code snippets:

bash
npm install -g tokportal-mcp
json
{
  "mcpServers": {
    "tokportal": {
      "command": "npx",
      "args": ["-y", "tokportal-mcp"],
      "env": {
        "TOKPORTAL_API_KEY": "tok_live_your_key_here"
      }
    }
  }
}

Technical Analysis

The installation command and MCP configuration reference tokportal-mcp without an exact version or integrity constraint. In particular, npx -y may retrieve the package's current registry release and execute it automatically without interactive confirmation.

Because the package implementation is not present in the audited project, its behavior cannot be verified from the repository. The effective executable can also change after this Skill has been reviewed if a new package version is published. A compromised maintainer account, registry compromise, malicious update, or package ownership transfer could therefore introduce arbitrary code into subsequent installations.

The global installation recommendation further increases exposure by placing an unverified package in a broadly accessible command environment.

Attack Path

  1. An attacker compromises the package publisher account, package distribution channel, or a newly released package version.
  2. The attacker publishes a modified tokportal-mcp release containing malicious installation or runtime code.
  3. A user follows the documented setup or starts the configured MCP server.
  4. npm install -g tokportal-mcp or npx -y tokportal-mcp resolves the mutable package name to the attacker-controlled release.
  5. npm downloads and executes package lifecycle or runtime code with the permissions of the invoking user.
  6. The malicious process can access resources available ...[truncated 763 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin tokportal-mcp to a reviewed, exact version rather than resolving the latest release.
  • Commit and enforce a lockfile containing package integrity hashes.
  • Avoid npx -y, which combines remote retrieval with automatic execution. Install a reviewed dependency locally and invoke its pinned binary instead.
  • Avoid global installation unless it is operationally necessary.
  • Publish or vendor the MCP server source so its implementation can be audited alongside the Skill.
  • Verify package provenance through npm provenance attestations, signed releases, and trusted publisher controls.
  • Run the MCP server under a dedicated, least-privileged account or sandbox with limited filesystem and network access.
  • Restrict the API key supplied to the process to the minimum permissions and spending limits required.
  • Establish a controlled dependency-update process that reviews source changes and integrity metadata before upgrading.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

Live API Key Is Instructed to Be Stored in Plaintext Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:31-42 and SKILL.md:52-63
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: Medium

Vulnerable code snippets:

json
{
  "skills": {
    "entries": {
      "tokportal": {
        "enabled": true,
        "apiKey": "tok_live_your_key_here"
      }
    }
  }
}
json
{
  "mcpServers": {
    "tokportal": {
      "command": "npx",
      "args": ["-y", "tokportal-mcp"],
      "env": {
        "TOKPORTAL_API_KEY": "tok_live_your_key_here"
      }
    }
  }
}

Technical Analysis

The documented examples instruct users to replace a placeholder with a live TokPortal API key directly inside JSON configuration files. The repository itself does not contain an actual secret; the issue is the recommended secret-handling pattern.

Plaintext configuration credentials can be exposed through permissive filesystem permissions, source-control commits, workstation backups, configuration synchronization, support bundles, or unrelated processes running under the same user account. Supplying the secret as an environment variable within the MCP configuration does not protect it when the literal value remains stored in the JSON file.

The Skill states that the API key authenticates through the X-API-Key header. Anyone who obtains the key may therefore be able to impersonate its owner within the authorization scope assigned by TokPortal.

Attack Path

  1. A user replaces tok_live_your_key_here with a valid API key in an OpenClaw or MCP JSON configuration file.
  2. The file is accidentally committed, synchronized, backed up, included in diagnostic output, or read by another local user or process.
  3. An attacker extracts the plaintext API key.
  4. The attacker submits the key to the declared TokPortal API using the X-API-Key header.
  5. The attacker performs operations permitted by that key until it is re ...[truncated 779 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not place literal API keys in version-controlled or routinely synchronized JSON configuration.
  • Configure the file to reference a protected environment variable or retrieve the credential from an operating-system secret store.
  • If the host application cannot resolve secret references, document a secure credential-injection mechanism rather than recommending an inline value.
  • Restrict configuration-file permissions to the owning user and prevent inclusion in backups, diagnostics, and source control where practical.
  • Add relevant configuration and secret files to .gitignore, while recognizing that ignore rules do not protect already committed secrets.
  • Apply least-privilege scopes, credit limits, and resource restrictions to API keys if supported.
  • Use separate keys for development, production, and individual MCP installations.
  • Document key rotation and immediate revocation procedures, and rotate any credential that may have been exposed.
  • Avoid logging request headers, environment values, or configuration objects that may contain the key.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The changelog explicitly advertises access to delivered account credentials and TokMail verification codes, which are highly sensitive authentication artifacts. In the context of a social-media automation skill that provisions and manages accounts at scale, exposing or normalizing retrieval of credentials and MFA/verification data materially increases the risk of account takeover, abuse, and unauthorized access if strong safeguards and warnings are not clearly documented.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: tokportal
description: Automate social media at scale — create TikTok/Instagram accounts, distribute videos, upload content, and track analytics with 30 AI-native MCP tools via the TokPortal API.
version: 1.0.0
homepage: https://developers.tokportal.com
metadata: {"openclaw":{"emoji":"🎵","homepage":"https://developers.tokportal.com","requires":{"env":["TOKPORTAL_API_KEY"]},"primaryEnv":"TOKPORTAL_API_KEY"}}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises automation for account creation, publishing, uploads, and analytics at scale, but it does not clearly warn that these tools can trigger real external actions and consume paid credits. In an agent setting, that omission increases the risk of users or downstream agents invoking destructive or billable operations without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The delivered account and verification-code tools expose highly sensitive credentials, yet the skill text does not warn that these outputs should be treated like secrets. In an agent workflow, this can lead to accidental display, logging, or reuse of account credentials and 2FA/verification material, enabling account takeover or unauthorized access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.