Security audit

Picsee Short Link

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent PicSee MCP documentation skill, but users should understand it can create, edit, delete, and analyze PicSee links after OAuth authorization.

Install only if you are comfortable connecting your agent to PicSee and granting OAuth user:read/user:write. Prefer the direct Streamable HTTP MCP setup; avoid the npx bridge unless needed, and pin or control the bridge dependency in managed environments. Confirm any edit or delete operation before allowing the agent to change account links, and do not shorten URLs or render charts that contain secrets, private identifiers, signed parameters, or sensitive analytics.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:42
Finding: Unpinned npm Bridge Is Automatically Downloaded and Executed
Content: View full analysis
Remediation: View remediation
`. 3. Install the dependency through a lockfile-controlled project rather than downloading it dynamically on each launch. 4. Verify package integrity and provenance before deployment. 5. Disable automatic dependency updates in production configurations. 6. Run the bridge in a restricted environment with minimal filesystem, environment-variable, credential, and network access. 7. Document the reviewed package version and update process in both `SKILL.md` and `README.md`. ]]>

other

Note

Location: SKILL.md:210
Finding: QR and Chart Recipes Disclose User Data to External Rendering Services
Content: View full analysis
``` Surface the URL inline if your client renders images; otherwise return it as a link. For a larger code, change `size=500x500`. ### Render a daily-clicks chart 1. Call `get_link_daily_clicks` to get the time series. 2. Build a [QuickChart](https://quickchart.io) URL from the data: ``` https://quickchart.io/chart?c={type:'line',data:{labels:['2026-03-01',...],datasets:[{label:'Clicks',data:[12,38,...]}]}} ``` URL-encode the `c` parameter. Display inline if possible; otherwise return the link. ``` ### Technical Analysis The QR recipe embeds the generated short link in a request to `api.qrserver.com`. The chart recipe embeds click dates and counts in a request to `quickchart.io`. These services are separate from PicSee and consequently receive the submitted values along with ordinary request metadata such as source IP address, timestamp, and user-agent information. A short link may expose private destinations or identifiers when resolved. Analytics data may reveal campaign timing, volume, or business activity. Because the values are carried in request URLs, they may also be retained in browser history, intermediary logs, proxy logs, or service logs. The Skill Card discloses this behavior and identifies local rendering as an alternative. The recipes are optional, and the audit found no evidence that they transmit OAuth tokens or execute automatically. ### Attack Path 1. A user asks the agent to generate a QR code or analytics chart. 2. The agent follows the documented client-side recipe. 3. The agent inserts the s ...[truncated 802 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (46)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 69)May include surrounding context.
Antigravity

Antigravity speaks MCP Streamable HTTP natively. Edit ~/.gemini/config/mcp_config.json (it shares Gemini's config dir, and uses the key serverUrl):

json
{

MCP Config Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
Content: Scanner excerpt · README.md (reported line 69)May include surrounding context.
Antigravity

Antigravity speaks MCP Streamable HTTP natively. Edit ~/.gemini/config/mcp_config.json (it shares Gemini's config dir, and uses the key serverUrl):

json
{

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 106)May include surrounding context.
codex mcp add picsee-short-link --url https://api.picsee.io/mcp

text
Or add it directly to `~/.codex/config.toml`: ```toml [mcp_servers.picsee-short-link]

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: The command removes local token and salt files. Although the paths are specific, it still permanently deletes local credential material and could disrupt user environments if executed blindly or in the wrong account context.
Content: Scanner excerpt · README.md (reported line 267)May include surrounding context.
bash
# 1. Remove the old encrypted token + salt files rm -f ~/.openclaw/.picsee_token ~/.openclaw/.picsee_salt # 2. Remove the old CLI build artifacts wherever the skill was installed rm -rf ~/.claude/skills/picsee-short-link/cli

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The command recursively deletes a directory under ~/.claude/skills. In a human-only README this is moderate risk, but in an agent skill ecosystem destructive instructions can be operationalized, increasing the chance of unintended deletion if path expansion or directory assumptions are wrong.
Content: Scanner excerpt · README.md (reported line 270)May include surrounding context.
md
rm -f ~/.openclaw/.picsee_token ~/.openclaw/.picsee_salt # 2. Remove the old CLI build artifacts wherever the skill was installed rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli rm -rf .cursor/skills/picsee-short-link/cli

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: The command recursively deletes a directory under ~/.claude/skills. In a human-only README this is moderate risk, but in an agent skill ecosystem destructive instructions can be operationalized, increasing the chance of unintended deletion if path expansion or directory assumptions are wrong.
Content: Scanner excerpt · README.md (reported line 270)May include surrounding context.
md
rm -f ~/.openclaw/.picsee_token ~/.openclaw/.picsee_salt # 2. Remove the old CLI build artifacts wherever the skill was installed rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli rm -rf .cursor/skills/picsee-short-link/cli

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: This command recursively deletes the OpenClaw workspace copy of the old CLI. It is narrowly scoped, but recursive deletion in documentation remains dangerous when copied into terminals or executed by agents because mistakes can irreversibly remove data.
Content: Scanner excerpt · README.md (reported line 271)May include surrounding context.
md
# 2. Remove the old CLI build artifacts wherever the skill was installed rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli rm -rf .cursor/skills/picsee-short-link/cli # 3. Reinstall the v3 skill (see Installation above) and register the MCP server.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: This command recursively deletes the OpenClaw workspace copy of the old CLI. It is narrowly scoped, but recursive deletion in documentation remains dangerous when copied into terminals or executed by agents because mistakes can irreversibly remove data.
Content: Scanner excerpt · README.md (reported line 271)May include surrounding context.
md
# 2. Remove the old CLI build artifacts wherever the skill was installed rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli rm -rf .cursor/skills/picsee-short-link/cli # 3. Reinstall the v3 skill (see Installation above) and register the MCP server.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: The command deletes a relative .cursor path recursively. Relative destructive paths are especially error-prone because the effect depends on the current working directory, making accidental deletion more plausible in automated or user copy-paste scenarios.
Content: Scanner excerpt · README.md (reported line 272)May include surrounding context.
md
# 2. Remove the old CLI build artifacts wherever the skill was installed rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli rm -rf .cursor/skills/picsee-short-link/cli # 3. Reinstall the v3 skill (see Installation above) and register the MCP server. # 4. Ask the agent to do something authenticated — sign in via browser when prompted.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.
bash
# Clean up v2 artifacts rm -f ~/.openclaw/.picsee_token ~/.openclaw/.picsee_salt rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.
bash
# Clean up v2 artifacts rm -f ~/.openclaw/.picsee_token ~/.openclaw/.picsee_salt rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.
bash
# Clean up v2 artifacts rm -f ~/.openclaw/.picsee_token ~/.openclaw/.picsee_salt rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.
bash
# Clean up v2 artifacts rm -f ~/.openclaw/.picsee_token ~/.openclaw/.picsee_salt rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.
Clean up v2 artifacts

rm -f ~/.openclaw/.picsee_token ~/.openclaw/.picsee_salt rm -rf ~/.claude/skills/picsee-short-link/cli rm -rf ~/.openclaw/workspace/skills/picsee-short-link/cli

text
Behavioral changes:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 10)May include surrounding context.
md
An **MCP-based [Agent Skill](https://agentskills.io)** for [PicSee](https://picsee.io) — URL shortening, QR code generation, click analytics, and link management. The skill is just documentation: it points your AI agent at the public PicSee MCP server (`https://api.picsee.io/mcp`) and explains how to use the tools. No Node.js install, no CLI, no local token files — authentication is handled by **OAuth 2.1 + PKCE** via the MCP client. ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 40)May include surrounding context.
md
An **MCP-based [Agent Skill](https://agentskills.io)** for [PicSee](https://picsee.io) — URL shortening, QR code generation, click analytics, and link management. The skill is just documentation: it points your AI agent at the public PicSee MCP server (`https://api.picsee.io/mcp`) and explains how to use the tools. No Node.js install, no CLI, no local token files — authentication is handled by **OAuth 2.1 + PKCE** via the MCP client. ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 48)May include surrounding context.
md
An **MCP-based [Agent Skill](https://agentskills.io)** for [PicSee](https://picsee.io) — URL shortening, QR code generation, click analytics, and link management. The skill is just documentation: it points your AI agent at the public PicSee MCP server (`https://api.picsee.io/mcp`) and explains how to use the tools. No Node.js install, no CLI, no local token files — authentication is handled by **OAuth 2.1 + PKCE** via the MCP client. ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 60)May include surrounding context.
md
An **MCP-based [Agent Skill](https://agentskills.io)** for [PicSee](https://picsee.io) — URL shortening, QR code generation, click analytics, and link management. The skill is just documentation: it points your AI agent at the public PicSee MCP server (`https://api.picsee.io/mcp`) and explains how to use the tools. No Node.js install, no CLI, no local token files — authentication is handled by **OAuth 2.1 + PKCE** via the MCP client. ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 65)May include surrounding context.
md
An **MCP-based [Agent Skill](https://agentskills.io)** for [PicSee](https://picsee.io) — URL shortening, QR code generation, click analytics, and link management. The skill is just documentation: it points your AI agent at the public PicSee MCP server (`https://api.picsee.io/mcp`) and explains how to use the tools. No Node.js install, no CLI, no local token files — authentication is handled by **OAuth 2.1 + PKCE** via the MCP client. ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 74)May include surrounding context.
md
An **MCP-based [Agent Skill](https://agentskills.io)** for [PicSee](https://picsee.io) — URL shortening, QR code generation, click analytics, and link management. The skill is just documentation: it points your AI agent at the public PicSee MCP server (`https://api.picsee.io/mcp`) and explains how to use the tools. No Node.js install, no CLI, no local token files — authentication is handled by **OAuth 2.1 + PKCE** via the MCP client. ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 90)May include surrounding context.
md
An **MCP-based [Agent Skill](https://agentskills.io)** for [PicSee](https://picsee.io) — URL shortening, QR code generation, click analytics, and link management. The skill is just documentation: it points your AI agent at the public PicSee MCP server (`https://api.picsee.io/mcp`) and explains how to use the tools. No Node.js install, no CLI, no local token files — authentication is handled by **OAuth 2.1 + PKCE** via the MCP client. ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 103)May include surrounding context.
md
An **MCP-based [Agent Skill](https://agentskills.io)** for [PicSee](https://picsee.io) — URL shortening, QR code generation, click analytics, and link management. The skill is just documentation: it points your AI agent at the public PicSee MCP server (`https://api.picsee.io/mcp`) and explains how to use the tools. No Node.js install, no CLI, no local token files — authentication is handled by **OAuth 2.1 + PKCE** via the MCP client. ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 110)May include surrounding context.
md
An **MCP-based [Agent Skill](https://agentskills.io)** for [PicSee](https://picsee.io) — URL shortening, QR code generation, click analytics, and link management. The skill is just documentation: it points your AI agent at the public PicSee MCP server (`https://api.picsee.io/mcp`) and explains how to use the tools. No Node.js install, no CLI, no local token files — authentication is handled by **OAuth 2.1 + PKCE** via the MCP client. ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 139)May include surrounding context.
md
An **MCP-based [Agent Skill](https://agentskills.io)** for [PicSee](https://picsee.io) — URL shortening, QR code generation, click analytics, and link management. The skill is just documentation: it points your AI agent at the public PicSee MCP server (`https://api.picsee.io/mcp`) and explains how to use the tools. No Node.js install, no CLI, no local token files — authentication is handled by **OAuth 2.1 + PKCE** via the MCP client. ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 148)May include surrounding context.
md
An **MCP-based [Agent Skill](https://agentskills.io)** for [PicSee](https://picsee.io) — URL shortening, QR code generation, click analytics, and link management. The skill is just documentation: it points your AI agent at the public PicSee MCP server (`https://api.picsee.io/mcp`) and explains how to use the tools. No Node.js install, no CLI, no local token files — authentication is handled by **OAuth 2.1 + PKCE** via the MCP client. ---

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: README.md:271

Overview

A.I.G

T08 · Insecure Dependencies

other

SkillSpector

Agent Config Directory Access

Antigravity

MCP Config Access

Antigravity

Agent Config Directory Access

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Clean up v2 artifacts

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis

Documentation contains a destructive delete command without an explicit confirmation gate.