ClawHub
Back to skill

Security audit

Plan2meal

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Plan2Meal integration that uses OAuth and a Convex backend for recipe and grocery-list commands, with no artifact evidence of hidden, destructive, or deceptive behavior.

Install only if you intend to connect Plan2Meal to a Convex backend and OAuth provider. Prefer your own CONVEX_URL, enable ALLOW_DEFAULT_BACKEND only if you accept the shared backend, keep OAuth callback URLs tight, and update/lock npm dependencies before deploying from source.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The handler treats any message containing `code=` as an OAuth callback and parses attacker-controlled text as a callback URL. This broad trigger can cause unintended processing of arbitrary chat content and increases the attack surface around OAuth state handling, especially in chat environments where URLs or query strings may be echoed or injected.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.2"
  },
  "devDependencies": {
    "@eslint/js": "^9.17.0",
Confidence
97% confidence
Finding
The runtime dependency axios is specified with a caret range, which allows automatic installation of newer minor/patch releases rather than a fully locked version from this manifest alone. This weakens supply-chain reproducibility and can unexpectedly introduce vulnerable or malicious code if dependency resolution changes, which matters because this skill likely performs network/API actions against Plan2Meal.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"axios": "^1.6.2"
  },
  "devDependencies": {
    "@eslint/js": "^9.17.0",
    "@types/node": "^20.10.0",
    "eslint": "^9.17.0",
    "typescript": "^5.3.0",
Confidence
90% confidence
Finding
The dev dependency @eslint/js is version-ranged with a caret, so builds or lint environments may resolve to different package contents over time. While this is less dangerous than a runtime package, it still increases supply-chain and reproducibility risk in development and CI.

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "devDependencies": {
    "@eslint/js": "^9.17.0",
    "@types/node": "^20.10.0",
    "eslint": "^9.17.0",
    "typescript": "^5.3.0",
    "typescript-eslint": "^8.18.0"
Confidence
90% confidence
Finding
The dev dependency @types/node is not fully pinned, allowing dependency drift across installs. This primarily affects build consistency rather than production behavior, but it still reflects weaker supply-chain control.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"devDependencies": {
    "@eslint/js": "^9.17.0",
    "@types/node": "^20.10.0",
    "eslint": "^9.17.0",
    "typescript": "^5.3.0",
    "typescript-eslint": "^8.18.0"
  }
Confidence
90% confidence
Finding
The eslint package is specified with a caret range, so development environments may pick up different releases over time. This is a genuine supply-chain hygiene issue, though the impact is limited because eslint is a dev-only dependency.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"@eslint/js": "^9.17.0",
    "@types/node": "^20.10.0",
    "eslint": "^9.17.0",
    "typescript": "^5.3.0",
    "typescript-eslint": "^8.18.0"
  }
}
Confidence
90% confidence
Finding
The typescript dependency is version-ranged, which can cause builds to vary and can expose the project to supply-chain surprises in CI or developer machines. This is lower risk than an exposed runtime flaw but still a real dependency-management weakness.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"@types/node": "^20.10.0",
    "eslint": "^9.17.0",
    "typescript": "^5.3.0",
    "typescript-eslint": "^8.18.0"
  }
}
Confidence
90% confidence
Finding
The typescript-eslint package is also unpinned, allowing development tooling to drift between installs. This is a low-impact but legitimate supply-chain hygiene problem affecting reproducibility and trust in the build pipeline.

Known Vulnerable Dependency: axios==1.6.2 — 10 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +7 more

High
Category
Supply Chain
Confidence
98% confidence
Finding
The manifest references axios 1.6.2, and the finding reports multiple known advisories affecting that version, including SSRF-related proxy handling issues and prototype-pollution-based attack chains. In a Plan2Meal integration skill that likely makes outbound HTTP requests using user-influenced URLs or API endpoints, a vulnerable HTTP client is especially dangerous because it can enable request redirection, credential leakage, response tampering, or access to internal resources depending on how the code uses axios.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
src/index.ts:20

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
src/index.ts:253