Meegle Mcp

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:25 PM UTC
• Version: 0.1.1

Overview

The skill appears purpose-built for Meegle project management, but its setup stores live credentials unsafely in shell startup files and can enable persistent shell command execution if a crafted key is entered.

Review this skill before installing. Use a narrowly scoped Meegle account, avoid running the setup script with untrusted key values, and prefer configuring credentials through a safer secret store or OpenClaw config rather than writing them to your shell profile. Treat natural-language create, update, permission, and member-management requests as live workspace changes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:39

Finding

Persistent Shell Command Injection Through Unescaped Credential Values

Content

View full analysis

Vulnerability Details

File Location: scripts/setup.sh, lines 39, 52, and 101–102
Vulnerability Type: Shell command injection through unsafe shell-profile generation
Risk Level: High

Vulnerable Code

bash

read -p "User Key: " USER_KEY

bash

read -p "MCP Key: " MCP_KEY

bash

echo "export MEEGLE_USER_KEY=\"$USER_KEY\"" >> "$SHELL_CONFIG"
echo "export MEEGLE_MCP_KEY=\"$MCP_KEY\"" >> "$SHELL_CONFIG"

Technical Analysis

The setup script incorporates raw credential input into an executable shell initialization file such as .bashrc, .bash_profile, or .zshrc. It does not validate or safely encode the values before writing them.

Shell metacharacters contained in a credential therefore become part of the generated shell program. For example, a supplied value containing:

bash

"; attacker_command; #

produces a profile entry equivalent to:

bash

export MEEGLE_USER_KEY=""; attacker_command; #"

Command substitutions can also be persisted inside the quoted assignment:

bash

$(attacker_command)

Variable expansion performed by the setup script does not immediately evaluate command-substitution syntax contained in the variable. However, the syntax is written literally to the profile and is evaluated when the shell later sources that file.

Because shell profiles are automatically loaded by new interactive or login shells, this flaw creates a persistent code-execution condition rather than a one-time malformed configuration.

Attack Path

1. An attacker distributes or presents a crafted value as a purported Meegle User Key or MCP Key.
2. The user runs scripts/setup.sh.
3. The user pastes the crafted value into one of the credential prompts.
4. The script writes the unescaped value into .bashrc, .bash_profile, or .zshrc.
5. The user starts a new shell or manually sources the affected profile.
6. The injected shell comman ...[truncated 782 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct executable shell-profile statements from raw user input.
• Prefer a dedicated secret manager, operating-system credential store, or permission-restricted configuration file rather than shell initialization files.
• If shell-profile persistence is unavoidable, serialize values with a reliable shell-escaping mechanism such as Bash printf '%q'.
• Reject newline characters, control characters, and other invalid credential characters before storing values.
• Write configuration updates to a temporary file with restrictive permissions and replace the destination atomically after successful validation.
• Avoid broad substring deletion with sed; use a clearly delimited, application-owned configuration block.
• Add automated tests using values containing quotes, semicolons, dollar signs, backticks, command substitutions, backslashes, and whitespace.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:39

Finding

Credentials Are Echoed During Entry and Persisted in Plaintext Shell Profiles

Content

View full analysis

Vulnerability Details

File Location: scripts/setup.sh, lines 39, 52, and 101–102
Vulnerability Type: Insecure handling and plaintext persistence of authentication credentials
Risk Level: Medium

Vulnerable Code

bash

read -p "User Key: " USER_KEY

bash

read -p "MCP Key: " MCP_KEY

bash

echo "export MEEGLE_USER_KEY=\"$USER_KEY\"" >> "$SHELL_CONFIG"
echo "export MEEGLE_MCP_KEY=\"$MCP_KEY\"" >> "$SHELL_CONFIG"

Technical Analysis

The credential prompts use Bash read without the -s option. Consequently, the Meegle User Key and MCP Key are visibly echoed to the terminal while the user enters them. This can expose credentials through shoulder surfing, screen sharing, terminal recording, or captured session output.

The script then stores both credentials as plaintext export statements in a general-purpose shell initialization file. These files are not purpose-built secret stores and may be read by local software running under the same account, included in backups, copied during troubleshooting, or unintentionally disclosed with dotfiles.

The effective file permissions depend on the user's existing shell-profile permissions and environment. Nevertheless, plaintext persistence unnecessarily expands the number of places from which the credentials can be recovered.

Attack Path

Visible-input attack:

1. The user runs scripts/setup.sh in a visible, shared, recorded, or remotely observed terminal.
2. The user enters the Meegle User Key and MCP Key.
3. Because silent input is not enabled, the credential values appear on screen.
4. An observer or recording captures the credentials and uses them against the Meegle MCP service.

Stored-secret attack:

1. The setup script appends both credentials to the detected shell profile in plaintext.
2. Local software operating as the user, a person with access to the profile, or a party obtaining a copied backup reads t ...[truncated 722 chars]

Remediation

View remediation

Remediation Suggestions

• Read secrets without terminal echo, for example:

  bash

  read -r -s -p "User Key: " USER_KEY
  printf '\n'
  read -r -s -p "MCP Key: " MCP_KEY
  printf '\n'
  

• Store credentials in an operating-system credential manager or supported secret-management service.

• If a local credential file is required, create a dedicated file with mode 0600, verify ownership, and avoid placing secrets in general-purpose shell profiles.

• Ensure credentials are not printed in diagnostic output, shell tracing, logs, or troubleshooting commands.

• Update the documentation to discourage commands such as echo $MEEGLE_USER_KEY, which display the complete secret.

• Recommend immediate key rotation after suspected terminal, profile, backup, or log exposure.

• Use narrowly scoped service-account credentials and apply the minimum Meegle permissions required by the integration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README presents natural-language examples that can create tasks, update workflow state, and add collaborators, but it does not clearly warn users that these prompts trigger real write operations in their Meegle workspace. This increases the risk of accidental destructive or unauthorized changes, especially because users may assume examples are read-only or merely illustrative.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises user-invocable behavior and documents environment-variable use plus execution of local setup and MCP proxy commands, but it does not declare a restrictive tool scope such as permissions or allowed-tools. That gap can cause the agent platform to expose broader shell/environment capabilities than users expect, increasing the chance of unintended command execution or credential access during normal use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes many state-changing operations such as creating projects, updating tasks, applying workflows, and adding members, but it does not prominently warn users that invoking it can modify live data in their Meegle workspace. In an agent setting, missing modification warnings can lead to accidental destructive or unauthorized changes because users may assume the integration is read-only or low risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This proxy blindly forwards whatever MCP/JSON-RPC payload arrives on stdin to an external Meegle endpoint, creating an unguarded data egress path. In a skill context, upstream callers may unknowingly send sensitive prompts, project data, or tokens off-host without explicit consent, request validation, allowlisting, or user-visible notice.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The script modifies the user's shell configuration to maintain Meegle credentials across future sessions, creating durable session/credential persistence rather than a one-time runtime configuration. In the context of an MCP integration, this broadens the blast radius of any local account compromise or accidental file disclosure because the tokens remain automatically available to future shells and tools.

Content

Scanner excerpt · scripts/setup.sh (reported line 80)May include surrounding context.

sh

# Check if MEEGLE_USER_KEY already exists
    if grep -q "MEEGLE_USER_KEY" "$SHELL_CONFIG"; then
        echo -e "${YELLOW}Warning: MEEGLE_USER_KEY already exists in $SHELL_CONFIG${NC}"
        read -p "Overwrite? (y/n): " OVERWRITE
        if [ "$OVERWRITE" == "y" ]; then
            sed -i.bak '/MEEGLE_USER_KEY/d' "$SHELL_CONFIG"
        fi

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup script stores the Meegle user key and MCP key in the user's shell startup file as plaintext environment exports, causing long-lived credential persistence beyond the immediate setup action. This increases exposure to local compromise, accidental disclosure through dotfile backups/sync, shell history or support bundle collection, and other tools that read startup files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script prompts for credential-like values and then writes them into the user's shell profile without explicitly warning that they will be persisted in plaintext. Users may reasonably assume the values are only used for the current setup session, so the lack of informed consent increases the chance of unsafe secret handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.