Security audit

Token Alert

Security checks for vulnerabilities and agentic risk

Overview

This token-monitoring skill includes useful alerting code, but its dashboard and setup scripts grant and persist much broader access than token checking needs.

Review carefully before installing. The CLI checker is much closer to the stated token-alert purpose, but the dashboard/proxy and notification setup should be avoided or redesigned until the gateway token is removed, proxy access is narrowly scoped and authenticated, auto-export and memory writes require explicit confirmation, provider keys are stored securely, and the LaunchAgent installation is validated and reversible.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/proxy-server.py:10
Finding: Unauthenticated CORS Proxy Exposes Privileged Gateway Tool Invocation
Content: View full analysis
0 else b'' # Forward to Gateway url = f'{GATEWAY_URL}{path}' headers = { 'Authorization': f'Bearer {GATEWAY_TOKEN}', 'Content-Type': 'application/json' } req = urllib.request.Request(url, data=body, headers=headers, method='POST') with urllib.request.urlopen(req) as response: response_data = response.read() ``` ### Technical Analysis The localhost proxy accepts arbitrary POST bodies under `/api/*`, does not authenticate callers, and automatically attaches a privileged gateway bearer token. Its wildcard CORS policy permits JavaScript fro ...[truncated 1843 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/dashboard.html:838
Finding: Hardcoded Gateway Bearer Credential Shipped in Source and Browser Assets
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: scripts/setup-notifications.sh:14
Finding: Notification Setup Installs a Persistent macOS LaunchAgent
Content: View full analysis
/dev/null launchctl load "$PLIST_DST" ``` ### Technical Analysis The setup script copies a plist into the user's `~/Library/LaunchAgents` directory and loads it with `launchctl`, establishing execution that survives the current Skill invocation and user session. The referenced `com.clawdbot.token-alert.plist` is absent from the audited project. The script also lacks `set -e`, does not check whether the copy succeeded, and does not verify the destination content. Consequently, if copying the missing source fails but a destination plist already exists, the script continues and loads that existing plist. Automated recurring token checks are related to notification functionality, but installing persistence is a higher-privilege action than an on-demand monitor and should not occur without explicit, informed consent and strict validation. ### Attack Path 1. An attacker or another local process creates or modifies `~/Library/LaunchAgents/com.clawdbot.token-alert.plist`. 2. The user executes `scripts/setup-notifications.sh`. 3. Copying the absent source plist fails. 4. Because the script does not stop on error, execution continues. 5. `launchctl load` loads the pre-existing destination plist. 6. The commands specified by that plist execute persistently under the user's account. ### Impact Assessment The mechanism can establish recurring code execution with the current user's privileges. A malicious or stale d ...[truncated 145 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/config.py:62
Finding: Provider API Keys Are Persisted in Plaintext Configuration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/show_dashboard.py:82
Finding: Predictable Temporary Dashboard Path Permits Symlink-Based File Overwrite
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/dashboard.html:15
Finding: Third-Party JavaScript Executes Without Integrity Verification
Content: View full analysis
``` ### Technical Analysis The dashboard loads executable JavaScript from a third-party CDN without a Subresource Integrity hash. No restrictive Content Security Policy was identified. Although the package version is specified, the browser does not cryptographically verify that the returned artifact is the reviewed Chart.js build. The dependency executes in the dashboard's origin and can access dashboard data, local storage, DOM content, and same-origin `/api/` endpoints. This is particularly dangerous because the same origin hosts the privileged gateway proxy. No evidence was found that the current CDN payload is malicious; the vulnerability is the absence of integrity controls and origin isolation. ### Attack Path 1. The user opens the dashboard while connected to the network. 2. The browser requests Chart.js from the third-party CDN. 3. A compromised CDN, account, build artifact, or delivery path supplies modified JavaScript. 4. The browser executes the modified code with the dashboard's origin privileges. 5. The code reads displayed session information or invokes the same-origin gateway proxy. 6. The code sends collected information to an attacker-controlled endpoint or performs unauthorized gateway actions. ### Impact Assessment A compromised dependency would gain all browser-side privileges available to the dashboard. This includes access to token history stored in `localStorage`, rendered session metadata, and same-origin gateway operations. The ultimate gateway impact depends on the proxy's permissions. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (99)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The planned web-scraping fallback includes browser scraping and session cookie management for provider services, but the TODO contains no privacy, account-safety, or terms-of-service safeguards. Handling live session cookies is especially dangerous because possession of those tokens may enable direct account hijacking, bypass normal authentication controls, and expose highly sensitive conversation or billing data.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The export path retrieves up to 1000 session messages and writes user and assistant content into a local markdown file. This is high-risk because it can exfiltrate sensitive session contents from the managed application context into a broadly accessible local artifact, where secrets or personal data may be exposed or mishandled.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · scripts/dashboard-v3.backup.html (reported line 513)May include surrounding context.
html
</div> <div class="content">  <div class="provider-tabs"> <button class="provider-tab active" onclick="switchProvider('anthropic')"> 🤖 Anthropic

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · scripts/dashboard-v3.multi-provider-backup.html (reported line 594)May include surrounding context.
html
</div> <div class="content">  <div class="provider-tabs"> <button class="provider-tab active" onclick="switchProvider('anthropic')"> 🤖 Anthropic

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A hardcoded bearer token is embedded in client-side HTML/JavaScript and used for authenticated API requests. Any user who can load or inspect the page can recover the token and use it to invoke backend tools, potentially reading sessions, sending messages, or exporting history outside intended controls.
Content: No source excerpt is available for this finding.

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · scripts/dashboard-v2.0-backup.html (reported line 2851)May include surrounding context.
html
<div style="margin-bottom: 20px;"> <label style="display: block; font-size: 14px; color: var(--text-primary); margin-bottom: 12px; font-weight: 600;"> 🔄 Reset History (Last 24h) </label> <div id="resetHistory"></div> </div>

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · scripts/dashboard-v3.backup.html (reported line 1667)May include surrounding context.
html
<div style="margin-bottom: 20px;"> <label style="display: block; font-size: 14px; color: var(--text-primary); margin-bottom: 12px; font-weight: 600;"> 🔄 Reset History (Last 24h) </label> <div id="resetHistory"></div> </div>

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · scripts/dashboard-v3.html (reported line 2851)May include surrounding context.
html
<div style="margin-bottom: 20px;"> <label style="display: block; font-size: 14px; color: var(--text-primary); margin-bottom: 12px; font-weight: 600;"> 🔄 Reset History (Last 24h) </label> <div id="resetHistory"></div> </div>

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · scripts/dashboard-v3.multi-provider-backup.html (reported line 2014)May include surrounding context.
html
<div style="margin-bottom: 20px;"> <label style="display: block; font-size: 14px; color: var(--text-primary); margin-bottom: 12px; font-weight: 600;"> 🔄 Reset History (Last 24h) </label> <div id="resetHistory"></div> </div>

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · scripts/dashboard.html (reported line 2921)May include surrounding context.
html
<div style="margin-bottom: 20px;"> <label style="display: block; font-size: 14px; color: var(--text-primary); margin-bottom: 12px; font-weight: 600;"> 🔄 Reset History (Last 24h) </label> <div id="resetHistory"></div> </div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · scripts/dashboard-v2.0-backup.html (reported line 670)May include surrounding context.
html
</div> <div class="content">  <div style="text-align: center; margin-bottom: 20px;"> <div style="display: inline-block; padding: 10px 20px; border-radius: 12px; background: linear-gradient(135deg, var(--bg-gradient-start), var(--bg-gradient-end)); color: white; font-weight: 700; font-size: 14px;"> 🤖 Anthropic Claude

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · scripts/dashboard-v3.html (reported line 670)May include surrounding context.
html
</div> <div class="content">  <div style="text-align: center; margin-bottom: 20px;"> <div style="display: inline-block; padding: 10px 20px; border-radius: 12px; background: linear-gradient(135deg, var(--bg-gradient-start), var(--bg-gradient-end)); color: white; font-weight: 700; font-size: 14px;"> 🤖 Anthropic Claude

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The page embeds a gateway authentication token in client-side JavaScript and also supports storing it in localStorage, exposing the credential to any user who can view source, to browser extensions, and to any XSS on the origin. Because that token is then used for authenticated API calls, compromise of the page directly becomes compromise of backend capabilities and session data.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A hardcoded bearer token in front-end code is directly retrievable and is used to authenticate network requests to privileged tools. Anyone with access to the page or its source can reuse that token to query sessions, fetch histories, or trigger actions against the gateway.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The page automatically triggers export and summary behavior when thresholds are crossed, without an explicit confirmation at the moment sensitive actions occur. That can cause unintended disclosure, persistence, or transmission of conversation data, especially because the actions are tied to backend tools rather than merely local UI state.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The auto-export and auto-summary sequence can capture full session history and cause downstream persistence without requiring a contemporaneous user decision. In a monitoring dashboard, this is particularly risky because users may not expect threshold alerts to trigger sensitive data operations.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The dashboard sends a natural-language command instructing the backend to summarize the session and store it in persistent memory. Automatically persisting session-derived content can retain sensitive information beyond the user's expectations and expands the blast radius of any data leak or misuse of backend memory features.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A hardcoded bearer token is embedded directly in client-side HTML/JavaScript and then used for authenticated API requests. Any user or attacker with access to the page source can recover the token and use it to call backend tools, potentially accessing session data or issuing privileged actions.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · scripts/dashboard.html (reported line 675)May include surrounding context.
html
</h1> </div>  <div class="provider-tabs" id="providerTabs"> <button class="provider-tab active" data-provider="anthropic" onclick="switchProvider('anthropic')"> <img src="../assets/icons/anthropic.svg" alt="Anthropic">

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The auto-export logic silently captures and downloads complete session history, including user messages, when thresholds are crossed. Automatic bulk extraction of conversation content is a serious confidentiality issue because it can duplicate sensitive data without a clear, immediate consent step.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code can send remote commands to the gateway using the 'sessions_send' tool, causing the agent to create summaries and write them to memory. For a dashboard, this is dangerous because a page that appears informational can silently issue state-changing commands to backend agent infrastructure.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The summary instruction explicitly tells the backend agent to create a compact summary and save it into memory storage, which can preserve sensitive user-provided information beyond the live session. This persistence increases data retention risk and may store secrets or personal information without adequate review or consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The export function retrieves full session history via 'sessions_history' and downloads user and assistant messages into a local file. This exceeds the justified scope of monitoring and creates a clear confidentiality risk if sensitive conversation content is exposed, mishandled, or triggered without informed consent.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document describes automatic export and automatic summary generation when usage reaches 90%, including delayed execution, without indicating explicit opt-in, confirmation, or clear disclosure of what data is exported and where it goes. Data-affecting automation can leak sensitive session contents, create unintended persistence, or trigger secondary actions without user consent, which is especially risky in a dashboard handling token/session data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.