T02 · Agent Memory Poisoning
Warning
- Location
references/HEARTBEAT.md:5- Finding
Persistent Heartbeat Instructions Permit Unapproved External Actions
- Content
View full analysis
- Remediation
View remediation
Security audit
theothers
Security checks for vulnerabilities and agentic risk
Overview
This is a legitimate marketplace integration, but it asks for persistent agent behavior that can post listings or message people and stores reusable OAuth tokens locally with weak handling.
Review before installing. Use it only if you are comfortable authenticating an agent to this marketplace and storing tokens under ~/.mcporter. Rewrite or skip the heartbeat instructions unless you explicitly want autonomous outreach, and require approval before any listing, message, location, schedule, or business detail is published.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auth-device-flow.sh:263- Finding
OAuth Secrets Are Exposed in Process Command-Line Arguments
- Content
View full analysis
/cmdline`, process-monitoring software, audit tooling, debugging utilities, or process-listing APIs. Actual visibility depends on the operating system and its process-isolation configuration. The exposure window is brief, but refresh tokens are long-lived credentials and are particularly sensitive. The credential access itself is necessary for the declared OAuth functionality. The vulnerability is the use of process arguments as the transport mechanism, not the decision to store credentials for authenticated calls. ### Attack Path 1. A user runs `scripts/auth-device-flow.sh` and completes device authorization. 2. The service returns an access token and refresh token. 3. The script invokes ...[truncated 1152 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auth-device-flow.sh:253- Finding
Credential Vault Is Written Non-Atomically Without Symlink Protection
- Content
View full analysis
"$VAULT_PATH" chmod 600 "$VAULT_PATH" ``` ### Technical Analysis The credential vault is overwritten directly using shell redirection. This creates several related weaknesses: - If the vault does not exist, its initial permissions are determined by the process umask. The script applies mode `0600` only after secret data has been written. - If execution is interrupted after truncation or during the write, the shared mcporter credential vault may be empty or partially written. - Shell redirection follows symbolic links. The script does not verify that the destination is a regular file owned by the current ...[truncated 2094 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is presented as a marketplace/posting tool, but the documentation also instructs authentication flows, client registration, token persistence, and modification of local mcporter configuration. This mismatch can cause users or agents to grant broader trust than intended, increasing the chance that sensitive local state and credentials are created or modified without informed consent.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 83% confidence
- Finding
Referencing a persistent credentials file for OAuth tokens indicates storage of reusable authentication material on disk, which can enable credential theft if the host is compromised, the file is over-permissioned, or the user is induced to disclose it. The risk is heightened by the skill context because agents often automate setup and may inspect filesystem artifacts, increasing the chance that long-lived tokens are accessed beyond the user's intent.
- Content
md 1. Register the server in mcporter config (`~/.mcporter/mcporter.json`) 2. Register an OAuth client 3. Show you a device code and URL to authorize 4. Save tokens to `~/.mcporter/credentials.json` **TIME LIMIT:** Once the script shows the device code and URL, you have **15 minutes** for authorization to complete. The device code expires after that. If you don't complete in time, run the script again.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The script is explicitly designed to access and modify a local credentials store containing OAuth tokens and client registration data. Handling bearer and refresh tokens in a predictable plaintext path materially increases the consequences of local compromise, malware, insecure backups, or accidental disclosure.
- Content
sh # The Others - Device Flow OAuth Helper for mcporter # This script authenticates using device flow and saves tokens directly to mcporter vault VAULT_PATH="$HOME/.mcporter/credentials.json" SERVER_NAME="theothers" SERVER_URL="https://theothers.richardkemp.uk/mcp" REGISTER_URL="https://theothers.richardkemp.uk/register"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md $(basename "$0") --force # Force reset (skip prompt) NOTES: - Tokens are saved to ~/.mcporter/credentials.json (vault) - Server config is saved to ~/.mcporter/mcporter.json - Access tokens expire after 30 minutes; mcporter should auto-refresh EOF
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md $(basename "$0") --force # Force reset (skip prompt) NOTES: - Tokens are saved to ~/.mcporter/credentials.json (vault) - Server config is saved to ~/.mcporter/mcporter.json - Access tokens expire after 30 minutes; mcporter should auto-refresh EOF
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh $(basename "$0") --force # Force reset (skip prompt) NOTES: - Tokens are saved to ~/.mcporter/credentials.json (vault) - Server config is saved to ~/.mcporter/mcporter.json - Access tokens expire after 30 minutes; mcporter should auto-refresh EOF
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md NOTES: - Tokens are saved to ~/.mcporter/credentials.json (vault) - Server config is saved to ~/.mcporter/mcporter.json - Access tokens expire after 30 minutes; mcporter should auto-refresh EOF exit 0 ;;
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh NOTES: - Tokens are saved to ~/.mcporter/credentials.json (vault) - Server config is saved to ~/.mcporter/mcporter.json - Access tokens expire after 30 minutes; mcporter should auto-refresh EOF exit 0 ;;
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh NOTES: - Tokens are saved to ~/.mcporter/credentials.json (vault) - Server config is saved to ~/.mcporter/mcporter.json - Access tokens expire after 30 minutes; mcporter should auto-refresh EOF exit 0 ;;
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh done # Check dependencies for cmd in curl jq mcporter; do if ! command -v "$cmd" &>/dev/null; then echo "Error: '$cmd' is required but not found in PATH." >&2 exit 1
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill declares shell-capable behavior via mcporter and setup/auth scripts but does not define any explicit tool scope or allowed-tools boundary. That increases the risk that an agent executes shell commands beyond the narrowly intended marketplace actions, especially because the skill also references local credential files and configuration paths.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill encourages posting listings, searching, and sending messages to an external marketplace, but it provides no clear privacy warning about sharing potentially sensitive personal, professional, location, or scheduling data. In this context, agents may disclose information about their human that the human did not intend to publish externally.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
The skill explicitly encourages writing long, detailed marketplace descriptions and supports persistent listings and messages that may remain available until expiry or closure. In this context, that creates a real risk of oversharing personal, business, location, and schedule information that persists in an external service and can be searched or contacted by others.
- Content
md List your listings (filter by open/closed). - `create_listing(description, expires_at, exchange_i_offer?, exchange_i_seek?, location_lat?, location_lon?, location_radius_km?, time_window?)` Post to marketplace. Write a long, detailed description to make it easier for others to find you. expires_at must be a future date. At least one of exchange_i_offer or exchange_i_seek is required. Description max 10k chars, exchange fields max 5k each.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation states that access and refresh tokens, plus client credentials, are stored in a local credentials file without any user-facing security warning or handling guidance. This is dangerous because compromise of that file could allow persistent unauthorized access to the marketplace account and associated messaging or listings.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The heartbeat guidance authorizes the agent to decide whether to respond to new messages, ignore them, or alert the user, implying the agent may send replies autonomously. In a human-connection marketplace, autonomous replies can misrepresent the user's intent, create commitments, or disclose information in ongoing conversations without the user's knowledge.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
These instructions explicitly encourage the agent to take external actions on the user's behalf by creating marketplace listings and initiating contact with other users, without requiring clear user consent, approval gates, or notice. In a marketplace and messaging context, that can lead to unauthorized public postings, unintended disclosures about the user's needs, and outbound communications the user did not approve.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The setup instructions explicitly state that OAuth tokens will be saved to a local credentials file but provide no warning that these tokens are sensitive secrets equivalent to account access. In an agent-oriented workflow, users may share logs, home-directory contents, or screenshots with assistants, making silent local token storage more dangerous because the credentials can be exposed or mishandled.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
sh EXAMPLES: $(basename "$0") # Interactive authentication (prompts if tokens exist) $(basename "$0") --force # Force reset (skip prompt) NOTES: - Tokens are saved to ~/.mcporter/credentials.json (vault)
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
sh echo # Check if already authenticated (check vault) HAS_EXISTING_AUTH=false if [ -f "$VAULT_PATH" ]; then if jq -e --arg key "$VAULT_KEY" '.entries[$key].tokens.access_token // empty' "$VAULT_PATH" >/dev/null 2>&1; then HAS_EXISTING_AUTH=true
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh CLIENT_ISSUED_AT=$(jq -r --arg key "$VAULT_KEY" '.entries[$key].clientInfo.client_id_issued_at // 0' "$VAULT_PATH" 2>/dev/null) || true echo -e "${GREEN}✓ Reusing existing client: $CLIENT_ID${NC}" else if ! CLIENT_RESPONSE=$(curl -sf -X POST "$REGISTER_URL" \ -H "Content-Type: application/json" \ -d '{ "client_name": "mcporter (device flow)",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # Step 2: Initiate device flow echo -e "${BLUE}Step 2: Initiating device authorization...${NC}" if ! DEVICE_RESPONSE=$(curl -sf -X POST "$DEVICE_AUTH_URL" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "client_id=$CLIENT_ID&scope=offers:read+offers:write"); then echo -e "${RED}✗ Failed to initiate device flow${NC}" >&2
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh sleep "$INTERVAL" ATTEMPT=$((ATTEMPT + 1)) TOKEN_RESPONSE=$(curl -s -X POST "$TOKEN_URL" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d "grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code=$DEVICE_CODE&client_id=$CLIENT_ID") || true
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script writes access tokens, refresh tokens, and client credentials to a plaintext JSON file on disk. Although it later sets mode 600, the write occurs without an explicit pre-write warning or consent at the point of storage, and plaintext local token storage increases exposure if the host is compromised, backed up insecurely, or read by other local processes before permissions are corrected.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh echo "$VAULT_CONTENT" | jq --arg key "$VAULT_KEY" --argjson entry "$NEW_ENTRY" ' .entries[$key] = $entry ' > "$VAULT_PATH" chmod 600 "$VAULT_PATH" echo -e "${GREEN}✓ Credentials saved to vault${NC}" echo
Static analysis
No suspicious patterns detected.