ClawHub
Back to skill

Security audit

purrplan

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing PurrPlan social accounts, but its fallback setup runs an unpinned npm bridge and places a bearer token in the command line.

Prefer native HTTP MCP configuration over the npx bridge. If a bridge is required, use a pinned and reviewed version, avoid putting production tokens directly in shell commands, store tokens in a protected secret mechanism, grant minimum scopes, and rotate/revoke the token if it may have been exposed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:25
Finding

Unpinned npm Package Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 25
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code:

shell
npx mcp-remote https://app.purrplan.ai/api/mcp --header "Authorization: Bearer YOUR_TOKEN"

Technical Analysis

The fallback setup directs users to execute mcp-remote through npx without specifying a fixed package version or verifying package integrity. Depending on the local npm configuration and package availability, npx can retrieve the current package release from the npm registry and execute it immediately.

The reviewed Skill therefore does not bind execution to a known, audited artifact. A compromised maintainer account, malicious package release, registry compromise, or unsafe future update could change the code executed by this command after the Skill itself has been reviewed. This is a supply-chain risk; the audit found no evidence that the current package is malicious.

Attack Path

  1. An attacker compromises the mcp-remote package, its publisher account, or its distribution path.
  2. The attacker publishes a malicious version under the package name used by the documented command.
  3. A user follows the fallback setup and runs the unpinned npx mcp-remote ... command.
  4. npx retrieves and executes the attacker-controlled package under the user's local privileges.
  5. The package can inspect local data and capture the PurrPlan bearer token supplied to it.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running npx. Accessible resources may include local files, environment variables, MCP configuration, shell credentials, and other secrets available to that account.

The malicious package would also receive the PurrPlan bearer token. The resulting remote privileges would depend on the token's assigned scopes and could include creating posts, upload ...[truncated 106 chars]

Remediation
View remediation

Remediation Suggestions

  • Prefer the client's native HTTP MCP support so that no additional executable package is required.
  • If the bridge is necessary, pin mcp-remote to a specifically reviewed version rather than resolving the latest available release.
  • Install the dependency through a lockfile-backed workflow and verify the package's provenance and integrity before execution.
  • Periodically review the pinned version and update it through a controlled dependency-review process.
  • Execute the bridge with minimum operating-system privileges and isolate it from unrelated credentials and sensitive files where feasible.
  • Grant the PurrPlan token only the scopes required for the intended workflow and rotate it immediately if package compromise is suspected.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:25
Finding

Bearer Token Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 25
Vulnerability Type: Sensitive credential exposure in process arguments and shell history
Risk Level: Medium

Vulnerable Code:

shell
npx mcp-remote https://app.purrplan.ai/api/mcp --header "Authorization: Bearer YOUR_TOKEN"

Technical Analysis

The documented fallback command instructs users to replace YOUR_TOKEN with a bearer token directly in a command-line argument. A real token entered this way may be retained in shell history, terminal transcripts, diagnostic output, command auditing, or automation logs. On systems where process arguments are visible to other local users or monitoring software, it may also be exposed while the command is running.

The token is additionally passed to the invoked npm package, which must be trusted to handle it securely. A bearer token provides access based on possession, so an attacker who recovers it may authenticate without knowing another credential.

Attack Path

  1. A user substitutes a valid PurrPlan token into the documented command.
  2. The command containing the token is stored in shell history, captured by logging, or exposed through process inspection.
  3. Another local user, compromised process, log reader, or unauthorized operator retrieves the token.
  4. The attacker submits the token to PurrPlan's MCP endpoint.
  5. The attacker performs operations allowed by the token until it expires or is revoked.

Impact Assessment

The obtainable privileges are bounded by the token's configured scopes. The document lists scopes including read, write, ai, media, inbox:read, inbox:reply, and analytics:read.

Depending on the scopes actually granted, disclosure could enable unauthorized access to workspace and analytics information, inbox content, AI or media functionality, post creation or scheduling, and replies sent through connected social-media accounts. The exposure does not itse ...[truncated 56 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not place the bearer token directly in command-line arguments.
  • Use a supported protected secret store or a configuration file with owner-only permissions.
  • If the bridge supports reading headers from standard input, a file descriptor, or a secure credential helper, document that mechanism instead.
  • Avoid examples that encourage users to paste production credentials into interactive shell commands.
  • Ensure secret values are redacted from application logs, terminal recordings, crash reports, and diagnostic output.
  • Explicitly instruct users to issue minimum-scope tokens. Prefer separate read-only and write-capable tokens where practical.
  • Document token expiration, revocation, and rotation procedures, including immediate rotation after suspected disclosure.
  • Warn users to remove any previously entered token-bearing commands from shell history while recognizing that other logs or backups may still retain them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Line L03 says to use the skill when the user wants to "schedule social posts, fill a content calendar, reply to comments/DMs, or check social performance," which is a wide natural-language trigger description rather than a narrowly scoped activation phrase. It does not provide explicit exclusion conditions or negative examples, so the skill could be invoked for loosely related everyday requests about social media.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The skill instructs users to run npx mcp-remote without pinning a specific package version, which creates a supply-chain risk: a future malicious or compromised release could be fetched and executed implicitly. Because this bridge is used to connect an authenticated remote MCP server and may handle bearer tokens, compromise could expose credentials or enable unauthorized actions on the user's social accounts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

Line L44 uses the example "demain 9h" and instructs the agent to interpret ambiguous times in the workspace timezone, but it does not state that language or locale should follow the user's preference. This can be read as assuming a specific language/locale behavior without explicit opt-in or choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.