Monkeytype Tracker and Advisor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:21 AM UTC
• Version: 1.1.0

Overview

The skill is mostly aligned with tracking Monkeytype stats, but it handles an API key and optional scheduled jobs in ways users should review carefully before installing.

Review this before installing if you care about credential handling. Prefer setting MONKEYTYPE_APE_KEY yourself instead of pasting the ApeKey into chat, avoid plaintext config storage on shared machines, and only enable automated reports if you are comfortable with cron-based persistence and know how to remove it later.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/monkeytype_stats.py:59

Finding

Monkeytype ApeKey Persisted Without Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes capabilities to read environment variables, write configuration files, and make network-backed script calls, but it does not declare an explicit tool scope or permissions boundary. That weakens reviewability and can let an agent use broader capabilities than users or operators would reasonably infer from the manifest.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill asks the user to paste their ApeKey directly into chat, which exposes a bearer credential to conversation logs, downstream tooling, and anyone with transcript access. API keys should be treated as secrets, and collecting them through chat unnecessarily expands exposure compared with dedicated secret-input mechanisms.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs persistent storage of the user's API key in a local config file without an explicit warning about plaintext credential storage, file permissions, or safer alternatives. If the host is shared or the workspace is exposed, the stored key could be recovered and abused for ongoing API access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill establishes session persistence by instructing creation of a local config file that stores the API key for future use. Persistence is not inherently malicious here, but it does increase risk by retaining a reusable credential beyond the immediate task and should therefore be treated as a security-sensitive design choice.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

- Linux/Mac: `export MONKEYTYPE_APE_KEY="YOUR_KEY_HERE"`

**Option 2: Config File**
Create this file: `~/.openclaw/workspace/config/monkeytype.json`
With this content:
{
  "apeKey": "YOUR_KEY_HERE"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow tells the agent to save a user-provided API key and then create cron-based automations, but it does not surface a clear warning that credentials will be persisted and system state will be modified. Combining secret storage with background execution increases the chance of unnoticed continued access or misuse.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

After receiving the credential through chat, the skill directs the agent to persist it in configuration, compounding the original exposure by adding long-term local storage. This creates two secret-handling risks at once: transcript leakage and plaintext persistence.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs the agent to create cron jobs, which is a persistent system-level modification extending beyond one-time typing-stat retrieval. For a stats-tracking skill, scheduled task creation increases the blast radius and creates opportunities for unauthorized persistence or repeated execution if the skill or underlying script is modified later.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup flow explicitly tells the agent to ask for the user's API key and save it to a config file, but provides no warning that the key is sensitive or that environment variables are preferred. This encourages insecure secret handling and increases the risk of credential exposure through logs, transcripts, config-file leakage, or accidental sharing.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Directing the agent to solicit the user's ApeKey in plain language normalizes sharing secrets in chat or agent-mediated workflows. In this skill context, the danger is elevated because the key grants API access and the same codebase already supports safer retrieval via environment variable, making the less secure guidance unnecessary.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The fallback error path tells the agent to ask the user for their ApeKey, again steering users toward exposing a secret through conversational channels. This is risky because agent transcripts, debugging, and workspace artifacts may retain the credential, creating unnecessary credential-handling exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest only states that the skill requires the user's Monkeytype ApeKey for API access, but the implementation guidance tells the agent to inspect environment variables and a file under the user's home directory to obtain credentials. Reading host-stored secrets is a sensitive capability that should be explicitly declared if intended, rather than implied by the need for API access.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest says the skill requires the user's Monkeytype ApeKey for API access, which fits reading a provided key or config. This code additionally accesses process environment variables as a credential source, which is a broader capability than the typing-stats purpose itself requires and is not mentioned in the manifest.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill writes recent typing results to a local cache file without any disclosure, retention limit, or file-permission hardening. Even though the data is not highly sensitive, it is still personal activity history and could be exposed to other local users, included in backups, or retained longer than the user expects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code sends a fixed natural-language/config value of "english" for leaderboard queries, which forces a specific language/locale behavior. There is no indication that the user can opt in to a language choice or that this restriction is required for a documented region-specific purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.