T09 · Insecure Skill Coding Practices
Warning
- Location
meegle-api-credentials/SKILL.md:54- Finding
Unvalidated API Host Can Redirect Meegle Credentials and Access Tokens
- Content
View full analysis
- Remediation
View remediation
Security audit
Meegle API
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Meegle API skill pack, but it gives agents broad business-data and admin-changing authority with weak confirmation and destination-validation guidance.
Install only if you intend to let the agent operate Meegle with real project credentials. Use least-privilege Meegle plugin scopes, validate the API domain is exactly project.larksuite.com or project.feishu.cn before any token request, avoid storing long-lived secrets in plain shell files, and require explicit confirmation for delete, replace, overwrite, membership, and settings changes.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (39)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Overview Meegle API Skill splits Meegle OpenAPI into multiple sub-skills by functional area. Before calling any Meegle API, read **meegle-api-credentials** first to obtain domain, access token, context (project_key, user_key), and request headers. Other skills (Users, Space, Work Items, Setting, etc.) assume you have already obtained everything from credentials. ## Required Credentials
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Overview Meegle API Skill splits Meegle OpenAPI into multiple sub-skills by functional area. Before calling any Meegle API, read **meegle-api-credentials** first to obtain domain, access token, context (project_key, user_key), and request headers. Other skills (Users, Space, Work Items, Setting, etc.) assume you have already obtained everything from credentials. ## Required Credentials
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Overview Meegle API Skill splits Meegle OpenAPI into multiple sub-skills by functional area. Before calling any Meegle API, read **meegle-api-credentials** first to obtain domain, access token, context (project_key, user_key), and request headers. Other skills (Users, Space, Work Items, Setting, etc.) assume you have already obtained everything from credentials. ## Required Credentials
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: meegle-api-credentials description: | Obtain Meegle API access credentials: domain, token, context (project_key, user_key), and request headers. Read this first before any other Meegle API skill; all call prerequisites are in this skill. metadata: openclaw: {}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: meegle-api-credentials description: | Obtain Meegle API access credentials: domain, token, context (project_key, user_key), and request headers. Read this first before any other Meegle API skill; all call prerequisites are in this skill. metadata: openclaw: {}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: meegle-api-credentials description: | Obtain Meegle API access credentials: domain, token, context (project_key, user_key), and request headers. Read this first before any other Meegle API skill; all call prerequisites are in this skill. metadata: openclaw: {}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: meegle-api-credentials description: | Obtain Meegle API access credentials: domain, token, context (project_key, user_key), and request headers. Read this first before any other Meegle API skill; all call prerequisites are in this skill. metadata: openclaw: {}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: meegle-api-credentials description: | Obtain Meegle API access credentials: domain, token, context (project_key, user_key), and request headers. Read this first before any other Meegle API skill; all call prerequisites are in this skill. metadata: openclaw: {}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: meegle-api-credentials description: | Obtain Meegle API access credentials: domain, token, context (project_key, user_key), and request headers. Read this first before any other Meegle API skill; all call prerequisites are in this skill. metadata: openclaw: {}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- ## Obtain Access Token Generate Meegle access credentials for OpenClaw to call OpenAPI.
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md ### Points to note - This interface is for **overwrite updates**: the provided **name** and **relation_details** replace the existing configuration for the given **relation_id**. ### When to Use
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### Points to Note **This API only supports user access credentials (user_access_token).** See Get Access Credentials for how to obtain user_access_token. ### When to Use
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README encourages storing sensitive credentials such as plugin secrets in environment variables but does not mention basic safeguards like using a secure secret store, limiting scope, avoiding logs, or preventing accidental disclosure in shell history and process dumps. While environment variables are common, documenting them without security caveats can lead operators to expose long-lived secrets in shared development or CI environments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file describes a delete operation for comments, including API-only deletion, but it does not clearly warn users that deleting a comment affects stored user data and may be irreversible. Under the markdown criteria for missing user warnings, destructive behavior that can affect user data should be explicitly disclosed.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | `project_key` | Meegle platform: double-click the **project icon** (space name); or from the project URL | | `user_key` | Meegle platform: double-click the **avatar**; or from the `user_key` field in the user_access_token API response | Then ask the user to provide the value(s) and retry after they are supplied. **Before asking**, always check [environment variables](#environment-variables) first; if a credential is set there, use it and do not prompt the user. ## Environment variables
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | `project_key` | Meegle platform: double-click the **project icon** (space name); or from the project URL | | `user_key` | Meegle platform: double-click the **avatar**; or from the `user_key` field in the user_access_token API response | Then ask the user to provide the value(s) and retry after they are supplied. **Before asking**, always check [environment variables](#environment-variables) first; if a credential is set there, use it and do not prompt the user. ## Environment variables
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Space unique identifier. How to get: In Meegle platform, double-click the project icon; or use project_key from project URL. behavior: - First check environment variable MEEGLE_PROJECT_KEY; if set, use it (do not prompt user) - Else if default project_key is configured, use it - Otherwise ask user to provide outputs:
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Space unique identifier. How to get: In Meegle platform, double-click the project icon; or use project_key from project URL. behavior: - First check environment variable MEEGLE_PROJECT_KEY; if set, use it (do not prompt user) - Else if default project_key is configured, use it - Otherwise ask user to provide outputs:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill documents update operations that include destructive actions such as deleting field options (
action: 2 delete) but does not instruct the agent to warn or confirm with the user before making irreversible configuration changes. In a configuration-management context, this can lead to accidental data loss, broken workflows, or invalid historical records if an agent performs the update directly from a user request without surfacing the risk.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill documents a destructive delete capability without a strong warning that the action removes relationship configuration and may be hard to recover. In an agent setting, a model could invoke this operation from an ambiguous user request or without explicit confirmation, causing unintended configuration loss.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill documents a role-deletion API but does not clearly warn the agent or end user that invoking it will permanently remove workflow-role configuration and may disrupt project setup. In an agent setting, missing an explicit confirmation/safety step increases the chance of accidental destructive actions, especially because the endpoint is presented as a normal callable operation alongside read/update APIs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documents a DELETE endpoint for workflow templates without clearly warning that the action is destructive and may be irreversible. In an agent setting, this increases the chance that a user or autonomous workflow invokes template deletion without informed confirmation, potentially causing loss of workflow configuration and operational disruption.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly documents an endpoint that returns team member user_keys and administrator lists for a space, but it provides no privacy, data-minimization, or handling guidance for this identity and role data. Even though the API is permission-gated, exposing or normalizing bulk member/admin enumeration in a skill without sensitivity warnings can encourage over-collection, logging, or downstream disclosure of organizational relationship data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill documents an API with destructive side effects: deleting a user from space members automatically removes them from other user groups, and replacing members can overwrite the full membership set. Without an explicit operator warning or confirmation requirement in the skill guidance, an agent or user could perform unintended bulk access changes that are hard to detect before execution.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **This API only supports user access credentials (user_access_token).** See **meegle-api-credentials** for how to obtain user_access_token. - When adding a user from non-space members, the user is automatically added to space members. - When deleting a user from space members, the user is automatically removed from other user groups. ### When to Use
Static analysis
No suspicious patterns detected.