ClawHub
Back to skill

Security audit

Threads Analytics

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Threads analytics connector, but users should treat its MCP URL as a password because it contains a bearer token.

Install only if you are comfortable giving Boring read-only access to Threads analytics and account metadata. Keep the MCP URL private, avoid pasting it into chats or support tickets, and revoke or regenerate it from Boring settings if it may have been exposed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:11
Finding
Bearer Authentication Token Embedded in MCP Connector URL<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:11, 20-25, 31-32` **Vulnerability Type**: Credential exposure through URL-based bearer authentication **Risk Level**: Medium ### Vulnerable Code ```yaml requires: config: - MCP Connector link from boring.aiagent-me.com (contains embedded auth token) ``` ```markdown - **MCP link is a credential**: Your MCP Server URL (`https://boring.aiagent-me.com/mcp/t/xxxxx...`) contains an embedded authentication token. Treat it like a password — do not share it publicly. - **Token scope**: The embedded token is **read-only** for analytics. It can only fetch performance metrics and account metadata. It cannot publish, delete, or modify any content on your social media accounts. - **Token storage**: The token is stored server-side in Boring's database (MongoDB on DigitalOcean). It is never written to your local filesystem. You can regenerate or revoke it anytime at [boring.aiagent-me.com/settings](https://boring.aiagent-me.com/settings). - **Data flow**: Analytics queries are sent from Boring's server (Google Cloud, us-central1) to the platform's API on your behalf. Only performance metrics are retrieved — no content is uploaded or modified. - **No local credentials**: No local API keys, environment variables, or secrets are needed. All auth is embedded in the MCP link. ``` ```markdown 3. **Get your MCP link**: Go to **Settings** → copy your MCP Server URL (contains your auth token — treat it like a password) 4. **Add to Claude**: Paste the MCP link as a Connector — no install, no API key needed ``` ### Technical Analysis The Skill requires users to copy and configure an MCP URL containing an embedded authentication token. A credential-bearing URL functions as a bearer credential: possession of the complete URL may be sufficient to authenticate requests. Embedding secrets in URL paths or query strings is an insecure credential-handling practice because URLs may be retained or exposed through: - Con ...[truncated 2800 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace credential-bearing URLs with a standard OAuth authorization flow or another connector-native secret exchange. 2. Send access tokens in an `Authorization: Bearer` header rather than embedding them in URL paths or query strings. 3. Issue short-lived, audience-restricted, operation-scoped tokens and rotate them automatically. 4. Store connector credentials in an operating-system or application secret store rather than ordinary configuration. 5. Redact tokens and credential-bearing URLs from client logs, server access logs, proxy logs, telemetry, diagnostics, and error messages. 6. Disable unnecessary publication-history access by default. Request it separately and only when the user explicitly asks for publishing records. 7. Enforce read-only permissions server-side for every endpoint and test that analytics credentials cannot invoke publishing, deletion, account-management, or token-administration operations. 8. Provide token revocation, session visibility, last-used timestamps, and anomaly notifications. 9. Document the connector's actual local and cloud storage behavior instead of asserting that the credential is never written locally without control over the connector implementation. 10. Warn users not to paste the URL into chats, issue trackers, screenshots, or support messages, and provide a safe redacted identifier for troubleshooting. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.