ClawHub
Back to skill

Security audit

Interactive LeetCode practice

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed LeetCode practice integration that asks before installing a pinned MCP server and before saving LeetCode session cookies locally.

Install only if you trust the referenced npm/GitHub MCP server. Keep the package version pinned, review changelogs before updating, authenticate only when needed, and delete ~/.leetcode-mcp/credentials.json or remove the MCP config when you stop using it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Content
clawdbot:
    requires:
      bins: [npx]
      config: [~/.leetcode-mcp/credentials.json]
    credentials:
      stores: ~/.leetcode-mcp/credentials.json
      contents: csrftoken, LEETCODE_SESSION, createdAt timestamp
Confidence
81% confidence
Finding
The skill declares that it requires a local credentials file containing active LeetCode session cookies. Even though storage is disclosed and intended for legitimate authentication, session cookies are highly sensitive bearer secrets; compromise of this file can enable account access until expiry. The context makes this somewhat less suspicious because the skill is for LeetCode integration, but it still creates real credential-handling risk.

Credential Access

High
Category
Privilege Escalation
Content
bins: [npx]
      config: [~/.leetcode-mcp/credentials.json]
    credentials:
      stores: ~/.leetcode-mcp/credentials.json
      contents: csrftoken, LEETCODE_SESSION, createdAt timestamp
      permissions: "0600"
---
Confidence
88% confidence
Finding
This finding confirms the skill stores `csrftoken` and `LEETCODE_SESSION` in a local file. Although `0600` permissions are a good control, these values are still reusable authentication artifacts, so any local compromise, backup leakage, or accidental disclosure could expose the user's LeetCode account. Because the skill's purpose is authenticated LeetCode actions, the behavior is contextually expected but still security-sensitive.

Credential Access

High
Category
Privilege Escalation
Content
## Auth Flow

1. Before auth-sensitive actions → call `check_auth_status`
2. If not authenticated or expired → **ask the user if they want to authenticate.** Explain that this will store LeetCode session cookies locally at `~/.leetcode-mcp/credentials.json` (owner-read/write only). Do not proceed without consent.
3. After consent → invoke `leetcode_authentication_guide` prompt
4. Call `start_leetcode_auth` → the prompt will guide the user through providing credentials → call `save_leetcode_credentials` with the values the user provides
5. On success → retry original action
Confidence
84% confidence
Finding
The auth flow instructs the agent to guide the user into providing live session credentials and then save them locally. Even with explicit consent, collecting and persisting browser session cookies is inherently risky because such cookies can grant direct account access if exposed. The context lowers suspicion because the flow is transparent and tied to a legitimate service integration, but the credential-capture pattern remains sensitive.

Credential Access

High
Category
Privilege Escalation
Content
**Always delegate auth guidance to the `leetcode_authentication_guide` prompt.** Do not improvise your own auth instructions — the prompt handles browser-specific guidance, error recovery, and troubleshooting.

**Credential storage:** The MCP server stores credentials locally at `~/.leetcode-mcp/credentials.json` with file permissions `0o600` (owner-read/write only). Only `csrftoken`, `LEETCODE_SESSION`, and a `createdAt` timestamp are stored. Credentials are never transmitted to any third party — they are used exclusively for direct LeetCode API calls. Typical credential lifetime is 7-14 days.

## Submission Language Map
Confidence
80% confidence
Finding
The skill normalizes long-term local storage of LeetCode session cookies for 7-14 days. While the text claims no third-party transmission and `0o600` permissions, this still increases exposure window for bearer credentials and creates persistence risk on disk. In a coding-practice skill this is understandable, but not harmless from a security perspective.

Session Persistence

Medium
Category
Rogue Agent
Content
## Auth Flow

1. Before auth-sensitive actions → call `check_auth_status`
2. If not authenticated or expired → **ask the user if they want to authenticate.** Explain that this will store LeetCode session cookies locally at `~/.leetcode-mcp/credentials.json` (owner-read/write only). Do not proceed without consent.
3. After consent → invoke `leetcode_authentication_guide` prompt
4. Call `start_leetcode_auth` → the prompt will guide the user through providing credentials → call `save_leetcode_credentials` with the values the user provides
5. On success → retry original action
Confidence
78% confidence
Finding
This is a true persistence-related risk because the skill explicitly saves session cookies to disk and reuses them for future authenticated operations. Persistent session material broadens the attack window compared with ephemeral in-memory auth, especially on shared machines or systems with weak endpoint security. The need for persistence is understandable in this integration, but it still carries security consequences.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.