Cookidoo Thermomix

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:38 PM UTC
• Version: 1.0.0

Overview

This unofficial Cookidoo skill is mostly coherent, but it uses account passwords and can change or delete remote account data without strong scoping or confirmation safeguards.

Install only if you are comfortable giving this unofficial integration your Cookidoo email and password and letting it make persistent changes to your meal plan, shopping list, and collections. Prefer using a dedicated account or tightly controlled environment variables, review commands before running them, and be especially careful with clear/remove/delete operations because the skill does not add its own confirmation step.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cookidoo.py:34

Finding

Hardcoded OAuth Client Credential Enables Client Impersonation

Content

View full analysis

Vulnerability Details

File Location: scripts/cookidoo.py, lines 34–36
Vulnerability Type: Hardcoded OAuth client credential
Risk Level: Medium

python

CLIENT_ID = "kupferwerk-client-nwot"
CLIENT_SECRET = "Ls50ON1woySqs1dCdJge"
AUTH_HEADER = "Basic a3VwZmVyd2Vyay1jbGllbnQtbndvdDpMczUwT04xd295U3FzMWRDZEpnZQ=="

Technical Analysis

The source code embeds an OAuth client identifier and client secret in plaintext. The same credential pair is also included in Base64-encoded form in AUTH_HEADER, which is sent to the Cookidoo authentication endpoint during the password-grant login flow.

Base64 encoding does not provide confidentiality. Anyone who can obtain the Skill package can read CLIENT_SECRET directly or decode AUTH_HEADER and reuse the credential outside this application. If this credential originated from a public mobile client, it cannot function as a securely held secret, but embedding and treating it as one still permits third parties to impersonate that OAuth client.

The transmission of a user's Cookidoo email and password to the declared Vorwerk HTTPS authentication endpoint is consistent with the Skill's documented functionality and was not found to be unrelated exfiltration. However, the hardcoded client credential exceeds secure configuration practices and creates a reusable authentication artifact.

Attack Path

1. An attacker obtains a copy of the publicly distributed or otherwise accessible Skill package.
2. The attacker opens scripts/cookidoo.py and reads CLIENT_SECRET, or Base64-decodes AUTH_HEADER.
3. The attacker constructs requests to the Cookidoo OAuth token endpoint while presenting the embedded Basic authorization credential.
4. The attacker impersonates the identified client in authentication attempts, potentially automating requests or causing activity to be attributed to that client.
5. Abuse may continue until the service provider rotates, restricts, or revoke ...[truncated 847 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove CLIENT_SECRET and the precomputed AUTH_HEADER value from the source repository and distributed Skill package.
2. Prefer an officially supported public-client authorization flow, such as Authorization Code with PKCE, which does not depend on a confidential secret embedded in client-side code.
3. If the provider requires a confidential client, move authentication behind a controlled backend capable of securely storing the credential. Do not distribute that credential to Skill users.
4. If runtime configuration is unavoidable, retrieve the client credential from a dedicated secret manager or protected runtime configuration rather than source code. Environment variables improve source hygiene but do not make a secret safe when distributed to untrusted clients.
5. Rotate or revoke the exposed credential in coordination with the service provider, because removing it from future versions does not invalidate copies already distributed.
6. Avoid retaining duplicate credential representations. Construct authorization headers only at runtime from securely obtained values and prevent credentials from appearing in logs or error output.
7. Validate commands and their arguments before invoking the login routine so malformed or unknown commands do not unnecessarily use account credentials or contact the authentication service.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The documented behavior does not cleanly match the implemented capabilities: some advertised features are absent, while account/profile/subscription access appears broader than the headline description. Security reviews and users rely on accurate descriptions to understand what data is accessed and what actions may occur; mismatches can hide sensitive behavior or cause users to invoke the skill under false assumptions. Because this skill touches authenticated personal account data, description drift is more dangerous than for a purely local utility.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cookidoo.py (reported line 92)May include surrounding context.

python

def login(base_url, email, password):
    """Authenticate and return access token."""
    token_url = f"{base_url}/ciam/auth/token"
    form_data = urllib.parse.urlencode({
        "grant_type": "password",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares access to environment variables and networked account operations but does not define an explicit permission or allowed-tools scope. That creates an authorization transparency gap: a caller or reviewer cannot easily tell that the skill can read secrets and perform authenticated remote actions against a user account. In the context of an unofficial API that uses account credentials, undeclared capability scope materially increases risk of unintended secret use or unauthorized account modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases include broad everyday language such as 'was kochen' and generic meal-planning phrases, which can cause the skill to activate in conversations that do not clearly imply consent to access a Cookidoo account. Since the skill can use stored credentials and perform account-affecting actions, accidental invocation could expose personal data or modify shopping lists and calendars without clear user intent. Broad triggers are especially risky for authenticated third-party integrations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to provide account email and password via environment variables but does not include a privacy or credential-handling warning. This normalizes direct credential use for an unofficial integration and may lead users to expose sensitive account secrets without understanding storage, logging, or transmission risks. Because the service is accessed through a reverse-engineered unofficial API, the sensitivity is heightened.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The command list includes destructive account-modifying operations like calendar changes, shopping-list clearing, item deletion, and collection deletion, but the skill description does not prominently warn that these actions alter persistent remote account state. Users may reasonably assume a recipe helper is read-only, making silent write/delete capabilities particularly hazardous. In an authenticated household planning context, this can cause loss of planning data or shopping data with real-world consequences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

If the environment does not specify country or language, the script silently defaults to Switzerland ('ch') and 'de-CH'. This imposes a locale choice without asking the user, which matches the policy's language/locale violation criterion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code fetches authenticated Cookidoo profile and subscription information and pretty-prints the returned JSON to stdout. Although the operations are part of the CLI's purpose, there is no explicit warning or disclosure that potentially sensitive personal account data will be displayed in the terminal.

Content

No source excerpt is available for this finding.