Security audit
Security checks for vulnerabilities and agentic risk
This is mostly a coherent Zoho Social MCP helper, but it needs review because it combines credentialed social publishing with under-scoped GitHub issue/PR/merge instructions and ships without the advertised action catalog file.
Review before installing. Use the smallest Zoho profile that fits the task, keep social-admin and deleteSocialSchedule disabled unless specifically needed, treat the MCP URL as a password, and require explicit confirmation before any publish, schedule, delete, GitHub issue, PR, or merge action. Be aware that the shipped package is missing references/actions.jsonl, so catalog lookup helpers fail until that file is restored.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
if [ -n "$ZOHO_SOCIAL_MCP_URL" ]; then echo "ZOHO_SOCIAL_MCP_URL is set"; else echo "ZOHO_SOCIAL_MCP_URL is not set"; fi
Treat `ZOHO_SOCIAL_MCP_URL` like a password. It contains Social access credentials.
## How to Get Your MCP URL
The declared description presents an end-user/agent-facing Zoho Social skill that should help perform Zoho Social tasks such as creating and scheduling posts, uploading media, and resolving entities like portals, brands, and channels. The supplied code does none of that. It is a standalone Python utility for rebuilding references/actions.jsonl from a manually copied UI dump. Its behavior is limited to parsing text, summarizing descriptions, merging with an existing catalog, marking removed actions, and writing JSONL output. While this supports maintaining an action catalog referenced by the broader skill, it does not implement the declared operational Zoho Social capabilities. Therefore the code chunk materially differs from the declared purpose.
The declared description presents this as an actionable Zoho Social skill to be used whenever a task involves real Zoho Social operations such as creating posts, scheduling/publishing, uploading media, or resolving portals/brands/channels. The supplied code does not do any of that. It is a standalone local inspection/validation CLI for reference metadata files (actions.jsonl and profiles.json). Its capabilities are limited to loading local JSON, resolving inherited profiles, validating consistency, and printing/searching action/task/profile descriptions. While this supports understanding an action catalog and least-privilege profiles, it materially differs from the declared operational purpose and lacks the advertised execution capabilities.
The declared description presents a functional Zoho Social operations skill that should help create, validate, schedule, or publish social posts and manage media/library resources. The supplied code does not implement any of those user-facing Zoho Social actions. Instead, it only resolves configuration for MCP endpoints and organization IDs, using CLI args, environment variables, and profile files. While profile handling is mentioned in the description, here it is the entire purpose of the code and it is generic across several Zoho services, not specifically a Zoho Social action skill. This is therefore a material description-behavior mismatch.
The declared description presents a full Zoho Social operational skill with helpers and workflows for posting, scheduling, publishing, media handling, and entity resolution. The supplied code chunk does none of those things. It is strictly a test file for resolving the MCP endpoint URL from command-line arguments, profiles JSON, and environment variables, plus validating error behavior. While endpoint resolution may be a supporting utility for a Zoho Social MCP integration, this chunk’s primary purpose is configuration resolution testing, not executing or exposing the described Zoho Social capabilities. Therefore the description does not accurately represent what this code chunk actually does.
The skill describes use of environment variables, file access, network calls, and shell-based helpers, but it does not declare any explicit tool restrictions such as permissions or allowed-tools. In an agent environment, that ambiguity can cause the skill to be executed with broader capabilities than necessary, increasing the blast radius if the skill is misused or if downstream content becomes adversarial.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Daily use is the discovery loop. Treat every reusable defect, missing capability, safer check, or useful simplification as a contribution.
1. Search open issues immediately with native `gh`; link a match or create one.
2. Include the need, sanitized evidence, expected behavior, and acceptance criteria. Never include MCP URLs, tokens, customer names, or live IDs.
3. If implementation is feasible now: issue → branch → code/docs/tests → PR → CI → merge.
4. If implementation is not feasible now: file the issue before finishing and return its URL.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Create ~/.config/zoho-mcp/profiles.json:
{
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Lock down local files and never commit them:
chmod 700 ~/.config/zoho-mcp
chmod 600 ~/.config/zoho-mcp/profiles.json
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
chmod 700 ~/.config/zoho-mcp
chmod 600 ~/.config/zoho-mcp/profiles.json
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
except EndpointResolutionError as exc:
print(f"Error: {exc}", file=sys.stderr); raise SystemExit(1)
command = ["mcporter", "call", f"{mcp_url}.{runtime_tool(tool)}", "--args", json.dumps(args, ensure_ascii=False)]
try: result = subprocess.run(command, capture_output=True, text=True, timeout=timeout, check=False)
except FileNotFoundError: return {"error": "mcporter executable not found"}
except subprocess.TimeoutExpired: return {"error": "mcporter call timed out"}
if result.returncode != 0: return {"error": result.stderr.strip() or "mcporter call failed"}
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
data = json.loads(PROFILES_PATH.read_text(encoding="utf-8"))
self.assertEqual(data.get("version"), 1)
self.assertEqual(data.get("service"), "social")
result = subprocess.run(
[sys.executable, str(LOOKUP_SCRIPT), "--validate"],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
self.assertIn("Validation OK", result.stdout)
def test_lookup_cli_profiles_listing(self):
result = subprocess.run(
[sys.executable, str(LOOKUP_SCRIPT), "--profiles"],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
self.assertIn("social-admin", result.stdout)
def test_lookup_cli_task_inspection(self):
result = subprocess.run(
[sys.executable, str(LOOKUP_SCRIPT), "--task", "media-asset-management"],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
self.assertIn("getSocialMediaLibrary", result.stdout)
def test_lookup_cli_search_names_only(self):
result = subprocess.run(
[sys.executable, str(LOOKUP_SCRIPT), "--search", "draft", "--names-only"],
capture_output=True,
text=True,
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
def _option(args, name):
return getattr(args, name, None) if args is not None else None
def _validate_url(value, source):
Detected: suspicious.obfuscated_code