Security audit
Tamaton
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed hosted productivity MCP integration, but it gives the service sensitive account and billing authority if the user grants those scopes.
Install only if you are comfortable giving Tamaton the scopes you choose, especially mail sending, storage/calendar access, and billing write access. Use the minimum scopes needed, keep a low spend cap, store the token only in a secrets manager or environment variable, and avoid enabling paid top-ups or subscriptions unless you intend the agent to use metered features.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.