T09 · Insecure Skill Coding Practices
Error
- Location
meegle-api-credentials/SKILL.md:19- Finding
Unvalidated API Domain Can Redirect Credentials and Sensitive Data to an Attacker-Controlled Host
- Content
View full analysis
- Remediation
View remediation
Security audit
meegle-api
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Meegle API integration, but it needs review because it persists high-value credentials, sends them through a configurable API domain, and exposes broad mutation and deletion operations without consistent safeguards.
Review this before installing. Use only exact Meegle domains, restrict plugin scopes to the minimum needed, avoid storing the plugin secret in plaintext if OpenClaw supports safer secret injection, protect any config file with owner-only permissions, and require explicit confirmation before delete, batch update, workflow transition, membership, or settings changes.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
meegle-api-credentials/SKILL.md:33- Finding
Long-Term Plugin Secret Is Directed to Plaintext Cross-Session Configuration Storage
- Content
View full analysis
", "MEEGLE_PLUGIN_SECRET": "", "MEEGLE_DOMAIN": "project.feishu.cn", "MEEGLE_PROJECT_KEY": "", "MEEGLE_USER_KEY": "" } } } } } ``` ``` ### Technical Analysis The skill explicitly instructs users to persist the long-term `MEEGLE_PLUGIN_SECRET` as a plaintext JSON value in `~/.openclaw/openclaw.json`. No requirement is given for restrictive file permissions, encrypted storage, operating-system credential storage, log redaction, or separation of secrets from general configuration. Although the plugin secret is legitimately required to obtain a plugin access token, permanent plaintext storage in a general-purpose configuration file is not the minimum exposure needed for token generation. The file may be readable by other local users if permissions are weak and can also be collected by backup utilities, support bundles, configuration synchronization, malware, or accidental repository commits. Caching the short-lived plugin access token ...[truncated 1542 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (34)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Overview Meegle API Skill splits Meegle OpenAPI into multiple sub-skills by functional area. Before calling any Meegle API, read **meegle-api-credentials** first to obtain domain, access token, context (project_key, user_key), and request headers. Other skills (Users, Space, Work Items, Setting, etc.) assume you have already obtained everything from credentials. ## Required Credentials
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Overview Meegle API Skill splits Meegle OpenAPI into multiple sub-skills by functional area. Before calling any Meegle API, read **meegle-api-credentials** first to obtain domain, access token, context (project_key, user_key), and request headers. Other skills (Users, Space, Work Items, Setting, etc.) assume you have already obtained everything from credentials. ## Required Credentials
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Overview Meegle API Skill splits Meegle OpenAPI into multiple sub-skills by functional area. Before calling any Meegle API, read **meegle-api-credentials** first to obtain domain, access token, context (project_key, user_key), and request headers. Other skills (Users, Space, Work Items, Setting, etc.) assume you have already obtained everything from credentials. ## Required Credentials
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: meegle-api-credentials description: | Obtain Meegle API access credentials: domain, token, context (project_key, user_key), and request headers. Read this first before any other Meegle API skill; all call prerequisites are in this skill. metadata: {"openclaw":{"requires":{"env":["MEEGLE_PLUGIN_ID","MEEGLE_PLUGIN_SECRET","MEEGLE_DOMAIN","MEEGLE_PROJECT_KEY","MEEGLE_USER_KEY"]}}} ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: meegle-api-credentials description: | Obtain Meegle API access credentials: domain, token, context (project_key, user_key), and request headers. Read this first before any other Meegle API skill; all call prerequisites are in this skill. metadata: {"openclaw":{"requires":{"env":["MEEGLE_PLUGIN_ID","MEEGLE_PLUGIN_SECRET","MEEGLE_DOMAIN","MEEGLE_PROJECT_KEY","MEEGLE_USER_KEY"]}}} ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: meegle-api-credentials description: | Obtain Meegle API access credentials: domain, token, context (project_key, user_key), and request headers. Read this first before any other Meegle API skill; all call prerequisites are in this skill. metadata: {"openclaw":{"requires":{"env":["MEEGLE_PLUGIN_ID","MEEGLE_PLUGIN_SECRET","MEEGLE_DOMAIN","MEEGLE_PROJECT_KEY","MEEGLE_USER_KEY"]}}} ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: meegle-api-credentials description: | Obtain Meegle API access credentials: domain, token, context (project_key, user_key), and request headers. Read this first before any other Meegle API skill; all call prerequisites are in this skill. metadata: {"openclaw":{"requires":{"env":["MEEGLE_PLUGIN_ID","MEEGLE_PLUGIN_SECRET","MEEGLE_DOMAIN","MEEGLE_PROJECT_KEY","MEEGLE_USER_KEY"]}}} ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- name: meegle-api-credentials description: | Obtain Meegle API access credentials: domain, token, context (project_key, user_key), and request headers. Read this first before any other Meegle API skill; all call prerequisites are in this skill. metadata: {"openclaw":{"requires":{"env":["MEEGLE_PLUGIN_ID","MEEGLE_PLUGIN_SECRET","MEEGLE_DOMAIN","MEEGLE_PROJECT_KEY","MEEGLE_USER_KEY"]}}} ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md --- ## Obtain Access Token When to use, capabilities, request/response, **headers for other APIs**, constraints, and strategy: see **API Spec** below.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### Points to Note **This API only supports user access credentials (user_access_token).** See Get Access Credentials for how to obtain user_access_token. ### When to Use
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata and description frame the capability as 'creating, reading, and updating work items,' but the file also exposes destructive and workflow-control operations such as delete, abort/resume, freeze/unfreeze, and batch mutation. This mismatch can mislead downstream agents or users into invoking higher-risk actions without appropriate confirmation, policy gating, or least-privilege handling.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This section enables completing nodes and rolling them back, which are state-changing operations that can affect workflow progress and associated data. The documentation explains parameters but does not clearly warn users that these actions alter workflow state and rollback/owner-clearing actions may have significant operational consequences.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill allows transferring a work item to another state and optionally updating fields and role owners during the transition. While intended behavior is described, the markdown does not explicitly warn that this can alter production workflow state, permissions, and assignments in ways that impact users and processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README recommends caching and reusing plugin_access_token during a session, which is operationally reasonable, but it does so without warning that bearer tokens are sensitive and must not be logged, exposed to other skills, or stored beyond their intended lifetime. If an agent or user mishandles cached tokens, an attacker with access to memory, traces, or logs could reuse them until expiration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file describes a delete operation for comments, which can affect user data, but it only notes that deletion is API-only and creator-limited. It does not explicitly warn that the action removes comment data and may be irreversible, which is the kind of user warning expected for data-affecting behavior in markdown skill descriptions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs users to store sensitive long-lived credentials, including plugin secret and user context, in a cross-session config file for automatic reuse without providing strong warnings about secret handling, filesystem permissions, or rotation. If that file is exposed through local compromise, backups, syncing, or accidental sharing, an attacker could obtain durable API access and impersonate the configured integration.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill exposes configuration-changing operations for creating and updating custom fields but does not explicitly warn that these actions modify project schema/configuration and may have broad operational impact. In an agent context, this increases the risk of unintended destructive or organization-wide changes if a user request is ambiguous, over-broad, or maliciously prompted.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill exposes a destructive delete operation with no guidance to require explicit user confirmation, preview the target relationship, or warn about irreversible effects. In an agent setting, this increases the chance of accidental or prompt-induced deletion of configuration data, especially because the action is a simple parameterized API call using existing credentials.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill exposes a destructive delete operation for workflow roles but does not include an explicit warning, confirmation requirement, or guidance about the operational impact of deleting configuration. In an agent setting, this increases the chance of accidental or unauthorized destructive changes, especially because roles affect workflow behavior and access assignment across templates.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill exposes a destructive delete operation for workflow templates but provides no guidance to require explicit user confirmation, preview the target resource, or warn about irreversibility. In an agent context, this increases the chance of accidental or unauthorized destructive actions if a user prompt is ambiguous, mistaken, or manipulated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file documents an endpoint that returns user_keys for team members and administrators within a space. While the functionality is described, there is no explicit user-facing warning about the privacy implications of retrieving organizational membership data.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **This API only supports user access credentials (user_access_token).** See **meegle-api-credentials** for how to obtain user_access_token. - When adding a user from non-space members, the user is automatically added to space members. - When deleting a user from space members, the user is automatically removed from other user groups. ### When to Use
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill documents a DELETE endpoint that removes views, including fixed, conditional, and panoramic views, but it does not instruct the agent to obtain explicit user confirmation before executing the action. In an agent setting, this increases the risk of accidental or socially engineered destructive operations, especially because view IDs can be sourced from URLs or prior API calls and the action has immediate effect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill documents a destructive delete_attachment operation without explicitly warning that deletion may be irreversible or recommending confirmation before execution. In an agent context, this increases the chance of unintended data loss because an automated assistant may invoke the endpoint on loosely phrased user requests or during cleanup/sync workflows without surfacing the permanence of the action.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documents a DELETE-based unbind operation while explicitly noting that if relation_rule_id and relation_work_item_id are omitted, behavior may remove bindings more broadly. That creates a realistic risk that an agent or user will invoke a destructive operation with underspecified parameters, causing unintended cross-space unlinking or data relationship loss.
- Content
Static analysis
No suspicious patterns detected.