Security audit
Security checks for vulnerabilities and agentic risk
The skill is a real OAuth and secret broker, but it has credential-handling and documentation risks that warrant review before installation.
Review this before installing in environments with valuable OAuth access or shared workspaces. Prefer narrow scopes, avoid the README-style direct token shell examples, keep TAPAUTH_BASE_URL unset outside tests, place TAPAUTH_HOME in a private directory, and revoke grants if the cache or process environment may have been exposed.
scripts/tapauth.sh:4Configurable API Base URL Can Exfiltrate Cached Grant Credentials
scripts/tapauth.sh:121Unsanitized Provider Name Permits Cache-Path Traversal and File Clobbering
README.md:47Documentation Places OAuth Tokens in Process Command-Line Arguments
scripts/check-tapauth-cli.sh:4Mutable Remote CLI Is Recommended as an Unsigned Replacement for the Audited Script
scripts/publish-clawhub.sh:43Publishing Script Automatically Executes an Unpinned Latest CLI Package
SKILL.md:119Broad Default Scope Examples Do Not Enforce Least Privilege
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Consolidated API under /api/v1/ prefix
- Collapsed grant endpoints: GET /api/v1/grants/{id} handles status polling and token retrieval
- .env response format via Accept: text/plain (zero JSON parsing in bash)
- Removed API key requirement — grant_secret is the only credential
- Scopes optional for integration providers (Vercel, Slack, Notion, etc.)
- agent_name optional
The skill is described as a simple exec secrets provider integration, but the documented workflow actually has the agent create grants, poll for approval, maintain local grant state, and orchestrate secret resolution. That gap matters because users may not realize they are authorizing a broader stateful workflow with browser approval and local cache management.
The skill is described as a simple exec secrets provider integration, but the documented workflow actually has the agent create grants, poll for approval, maintain local grant state, and orchestrate secret resolution. That gap matters because users may not realize they are authorizing a broader stateful workflow with browser approval and local cache management.
The skill is described as a simple exec secrets provider integration, but the documented workflow actually has the agent create grants, poll for approval, maintain local grant state, and orchestrate secret resolution. That gap matters because users may not realize they are authorizing a broader stateful workflow with browser approval and local cache management.
The skill is described as a simple exec secrets provider integration, but the documented workflow actually has the agent create grants, poll for approval, maintain local grant state, and orchestrate secret resolution. That gap matters because users may not realize they are authorizing a broader stateful workflow with browser approval and local cache management.
Referenced artifact was not completely inspected
- **`command`**: Absolute path to `scripts/tapauth.sh` in this skill directory
Referenced artifact was not completely inspected
- **`command`**: Absolute path to `scripts/tapauth.sh` in this skill directory
Referenced artifact was not completely inspected
- **`command`**: Absolute path to `scripts/tapauth.sh` in this skill directory
Referenced artifact was not completely inspected
- **`command`**: Absolute path to `scripts/tapauth.sh` in this skill directory
Referenced artifact was not completely inspected
- **`command`**: Absolute path to `scripts/tapauth.sh` in this skill directory
Referenced artifact was not completely inspected
| Discord | `["--token", "discord", "identify"]` | `references/discord.md` |
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### Granular Scopes Require Pre-Registration
All scopes must be registered in the [Asana Developer Console](https://app.asana.com/0/developer-console) before use. Requesting an unregistered scope causes an authorization error.
### Short-Lived Access Tokens
Access tokens expire in **1 hour**. TapAuth automatically handles refresh using long-lived refresh tokens.
### API Response Envelope
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### Granular Scopes Require Pre-Registration
All scopes must be registered in the [Asana Developer Console](https://app.asana.com/0/developer-console) before use. Requesting an unregistered scope causes an authorization error.
### Short-Lived Access Tokens
Access tokens expire in **1 hour**. TapAuth automatically handles refresh using long-lived refresh tokens.
### API Response Envelope
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
All scopes must be registered in the [Asana Developer Console](https://app.asana.com/0/developer-console) before use. Requesting an unregistered scope causes an authorization error.
### Short-Lived Access Tokens
Access tokens expire in **1 hour**. TapAuth automatically handles refresh using long-lived refresh tokens.
### API Response Envelope
All Asana API responses are wrapped in a `{ data: ... }` envelope:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
All scopes must be registered in the [Asana Developer Console](https://app.asana.com/0/developer-console) before use. Requesting an unregistered scope causes an authorization error.
### Short-Lived Access Tokens
Access tokens expire in **1 hour**. TapAuth automatically handles refresh using long-lived refresh tokens.
### API Response Envelope
All Asana API responses are wrapped in a `{ data: ... }` envelope:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
All scopes must be registered in the [Asana Developer Console](https://app.asana.com/0/developer-console) before use. Requesting an unregistered scope causes an authorization error.
### Short-Lived Access Tokens
Access tokens expire in **1 hour**. TapAuth automatically handles refresh using long-lived refresh tokens.
### API Response Envelope
All Asana API responses are wrapped in a `{ data: ... }` envelope:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The `guilds` scope returns the user's server (guild) list only — names, icons, and IDs. It does NOT grant access to channels, messages, or members within those servers.
### Token Expiry (~7 Days)
Discord access tokens expire after approximately 7 days. TapAuth handles automatic refresh using the refresh token, so subsequent calls to `$(scripts/tapauth.sh --token discord identify)` return a fresh token without user interaction.
### No Granular Permissions
Discord OAuth scopes are coarse — you can't request "read messages in one channel." The scopes control what user data you can read, not what actions you can take in servers.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The `guilds` scope returns the user's server (guild) list only — names, icons, and IDs. It does NOT grant access to channels, messages, or members within those servers.
### Token Expiry (~7 Days)
Discord access tokens expire after approximately 7 days. TapAuth handles automatic refresh using the refresh token, so subsequent calls to `$(scripts/tapauth.sh --token discord identify)` return a fresh token without user interaction.
### No Granular Permissions
Discord OAuth scopes are coarse — you can't request "read messages in one channel." The scopes control what user data you can read, not what actions you can take in servers.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The `guilds` scope returns the user's server (guild) list only — names, icons, and IDs. It does NOT grant access to channels, messages, or members within those servers.
### Token Expiry (~7 Days)
Discord access tokens expire after approximately 7 days. TapAuth handles automatic refresh using the refresh token, so subsequent calls to `$(scripts/tapauth.sh --token discord identify)` return a fresh token without user interaction.
### No Granular Permissions
Discord OAuth scopes are coarse — you can't request "read messages in one channel." The scopes control what user data you can read, not what actions you can take in servers.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The `guilds` scope returns the user's server (guild) list only — names, icons, and IDs. It does NOT grant access to channels, messages, or members within those servers.
### Token Expiry (~7 Days)
Discord access tokens expire after approximately 7 days. TapAuth handles automatic refresh using the refresh token, so subsequent calls to `$(scripts/tapauth.sh --token discord identify)` return a fresh token without user interaction.
### No Granular Permissions
Discord OAuth scopes are coarse — you can't request "read messages in one channel." The scopes control what user data you can read, not what actions you can take in servers.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
TapAuth extracts `authed_user.access_token` as the grant's access token.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# Swap SKILL-OPENCLAW.md → SKILL.md
cp "$TMP_DIR/SKILL-OPENCLAW.md" "$TMP_DIR/SKILL.md"
rm "$TMP_DIR/SKILL-OPENCLAW.md"
echo " Swapped SKILL-OPENCLAW.md → SKILL.md"
The script persists TAPAUTH_GRANT_SECRET and grant metadata in a local .env file, then later reads it back to authenticate to the TapAuth service. Even with mode 600 file permissions and a 700 parent directory, storing long-lived bearer-style secrets on disk increases exposure to local compromise, accidental backup/log inclusion, workspace sharing, or reuse by other processes running as the same user; in this skill's context, that is especially sensitive because the tool brokers access to OAuth tokens and user-supplied secrets for many external services.
sorted_scopes=$(echo "$scopes" | tr "," "\n" | sort | tr "\n" "," | sed "s/,$//")
safe_scopes=$(echo "$sorted_scopes" | tr '/:' '__')
fi
env_file="${TAPAUTH_DIR}/${provider}-${safe_scopes}.env"
TAPAUTH_GRANT_ID="" TAPAUTH_GRANT_SECRET="" TAPAUTH_EXPIRES="" TAPAUTH_APPROVE_URL="" TAPAUTH_STATUS="" TAPAUTH_TOKEN_B64=""
[ -f "$env_file" ] && parse_env_response "$(cat "$env_file")"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
printf '%s %s\n' "$method" "$url" >> "${CURL_MOCK_STATE}/calls.log"
printf '%s\n' "${original_args[@]}" > "${CURL_MOCK_STATE}/call-${count}.args"
response="${CURL_MOCK_RESPONSE}/${count}.env"
http_status=200
if [ -f "$response" ]; then
first_line="$(sed -n '1p' "$response")"
The README instructs users to run npx skills add tapauth/skill without pinning a specific package version or immutable source. That creates a supply-chain risk because users may fetch whatever package is current at execution time, and if the upstream package or resolution path is compromised, arbitrary code could be installed or run.
Detected: suspicious.secret_argv_exposure