ClawHub
Back to skill

Security audit

Beeminder

Security checks for vulnerabilities and agentic risk

Overview

The skill is a straightforward Beeminder API helper, but it gives an agent direct authenticated commands to create, edit, and delete commitment data without confirmation or credential-handling safeguards.

Review before installing. Only use this skill with a Beeminder token you are comfortable granting to an agent, avoid exposing the token in shared logs or transcripts, and require explicit approval before any add, update, or delete datapoint command. Rotate the token if it may have been exposed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:25
Finding

Authentication Token Exposed Through Command-Line Arguments and URL Query Strings

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-30, 47-53, 63-71, 77-84, and 91-98
Vulnerability Type: Credential exposure through process arguments, request URLs, and logs
Risk Level: Medium

The documented commands expand BEEMINDER_AUTH_TOKEN directly into curl command-line arguments. Several commands also transmit the credential as a URL query parameter.

bash
curl -s "$BASE/goals.json?auth_token=$BEEMINDER_AUTH_TOKEN" | jq '[.[] | {slug, safebuf, baremin, limsum}]'

curl -s "$BASE/goals/GOAL.json?auth_token=$BEEMINDER_AUTH_TOKEN"

curl -s "$BASE/goals.json?auth_token=$BEEMINDER_AUTH_TOKEN" \
  | jq '[.[] | select(.safebuf <= 0)] | sort_by(.losedate) | .[] | {slug, baremin, limsum}'

curl -s "$BASE/goals.json?auth_token=$BEEMINDER_AUTH_TOKEN" \
  | jq --arg cutoff "$(date -d '+2 days' +%s)" \
    '[.[] | select(.losedate <= ($cutoff | tonumber))] | sort_by(.losedate) | .[] | {slug, baremin, limsum}'

curl -s -X POST "$BASE/goals/GOAL/datapoints.json" \
  -d "auth_token=$BEEMINDER_AUTH_TOKEN" \
  -d "value=N" \
  -d "comment=TEXT"

curl -s "$BASE/goals/GOAL/datapoints.json?auth_token=$BEEMINDER_AUTH_TOKEN&count=5&sort=daystamp"

curl -s -X PUT "$BASE/goals/GOAL/datapoints/DATAPOINT_ID.json" \
  -d "auth_token=$BEEMINDER_AUTH_TOKEN" \
  -d "value=N" \
  -d "comment=TEXT"

curl -s -X DELETE "$BASE/goals/GOAL/datapoints/DATAPOINT_ID.json?auth_token=$BEEMINDER_AUTH_TOKEN"

curl -s "$BASE/goals.json?auth_token=$BEEMINDER_AUTH_TOKEN" \
  | jq '[.[] | select(.safebuf <= 1)] | sort_by(.safebuf) | .[] | {slug, baremin, limsum, safebuf}'

curl -s -X POST "$BASE/goals/GOAL/datapoints.json" \
  -d "auth_token=$BEEMINDER_AUTH_TOKEN" \
  -d "value=1" \
  -d "comment=done" \
  -d "requestid=GOAL-$(date +%Y%m%d)"

Technical Analysis

Shell expansion inserts the secret into curl's argument vector. Depending on operating-system controls and execution environmen ...[truncated 2209 chars]

Remediation
View remediation

Remediation Suggestions

  1. Use Beeminder's supported authorization-header mechanism, if available, instead of query-string authentication.
  2. Avoid expanding credentials directly into command-line arguments. Load secrets through a permission-restricted curl configuration file, protected credential provider, or other mechanism that does not expose them in the process argument vector.
  3. If the API only supports form or query authentication, generate a temporary curl configuration with restrictive permissions such as mode 0600, remove it immediately after use, and ensure cleanup occurs on failure.
  4. Disable shell tracing around credential-bearing operations and configure CI, agent, and observability systems to redact auth_token values.
  5. Ensure request logging excludes or sanitizes query strings and authentication fields.
  6. Use short-lived or narrowly scoped credentials if supported, rotate any token suspected of exposure, and revoke obsolete tokens.
  7. Make mutating operations explicit and confirmation-gated, especially datapoint update and deletion requests.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill tells users to pass a personal auth token directly in curl commands and query strings without warning that such tokens are sensitive and may be exposed through shell history, process listings, logs, screenshots, or agent transcripts. Anyone obtaining the token could read and modify Beeminder data as the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill documents create, update, and delete datapoint operations but does not instruct the agent to obtain explicit user confirmation before performing state-changing actions. In an agent context, this increases the risk of unintended modifications to commitment-tracking data, including accidental deletions or changes that could affect reminders, progress tracking, or derailment outcomes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This example sends authenticated data to an external service and performs a state-changing POST that creates a datapoint. In a skill intended for an autonomous or semi-autonomous agent, external transmission combined with account modification is risky because mistaken inputs or prompt-induced execution could alter user commitments.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Add datapoint

bash
curl -s -X POST "$BASE/goals/GOAL/datapoints.json" \
  -d "auth_token=$BEEMINDER_AUTH_TOKEN" \
  -d "value=N" \
  -d "comment=TEXT"

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This is another authenticated external POST that creates data on the user's Beeminder account. Although idempotent retry reduces duplication risk, it does not mitigate the core risk of unintended outbound actions or incorrect datapoints being submitted.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

Add with idempotent retry

bash
curl -s -X POST "$BASE/goals/GOAL/datapoints.json" \
  -d "auth_token=$BEEMINDER_AUTH_TOKEN" \
  -d "value=1" \
  -d "comment=done" \

Static analysis

No suspicious patterns detected.