Security audit

Tamaton

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Tamaton MCP setup guide, but its default setup grants broad mail, storage, calendar, billing, and paid-spend authority and includes an unsafe credential-in-URL install command.

Review before installing. Use the narrowest scopes needed, avoid billing:write unless you deliberately want billing changes, set a much smaller or zero spend cap where possible, and do not use the install?key=... URL workflow; pass the token only through an Authorization header or a local MCP secret reference.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:72
Finding: Bearer Credential Transmitted in a URL Query Parameter
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 72–77
Vulnerability Type: Credential exposure through a URL query parameter
Risk Level: High

Vulnerable Code:

bash
3. **Connect MCP** — keep the credential in an env var (`export TAMATON_KEY="<key_id>:<secret>"`) and reference it from config. To fetch a pre-filled snippet, pass the key from the env var rather than typing it inline so the secret stays out of your shell history: curl "https://tamaton.com/api/bots/install?key=$TAMATON_KEY"

Technical Analysis

The installation command expands TAMATON_KEY, which contains the complete <key_id>:<secret> bearer credential, directly into a URL query parameter. Keeping the credential in an environment variable prevents the literal secret from being entered into the shell command, but it does not make its transmission in a URL safe.

URLs can be retained by server access logs, reverse proxies, gateways, security monitoring systems, telemetry, debugging output, and process inspection. Any component that records the request target may therefore retain a reusable credential. This example also conflicts with the explicit warning elsewhere in the same file that credentials should not be placed in URLs.

Sending authentication data to the declared service is necessary for the integration, but transmitting it as a query parameter is not the minimum-risk method. An authorization header provides equivalent functionality with substantially lower incidental exposure.

Attack Path

A user follows the documented setup instructions and stores the complete credential in TAMATON_KEY.

The shell expands $TAMATON_KEY into the request URL.

Tamaton infrastructure, a reverse proxy, monitoring service, debugging facility, or another system records the full request URL.

An attacker or unauthorized operator obtains access to the retained URL.

The attacker e ...[truncated 891 chars]
Remediation: View remediation
Remediation Suggestions

Remove the install?key=... workflow from the documentation.

Change the installation endpoint to accept authentication only through an HTTP authorization header, for example:

bash
curl \ -H "Authorization: Bearer $TAMATON_KEY" \ "https://tamaton.com/api/bots/install"

If the response is merely a configuration template, construct that configuration locally instead of transmitting the credential to a separate installation endpoint.

Configure the server to reject credentials supplied through query parameters.

Redact query strings and authorization data from application, proxy, gateway, monitoring, and telemetry logs.

Review existing logs for retained credentials and rotate any key that may have been recorded.

Keep the existing guidance to use an environment variable or secret manager, but clarify that environment-variable expansion does not make URL-based secret transmission safe.

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:34
Finding: Default Registration Example Requests Excessive Account Privileges
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 34–42
Vulnerability Type: Excessive default scopes and spending authority
Risk Level: Medium

Vulnerable Code:

bash
1. **Register** (no human, no captcha — usable right away, no pre-funding): curl -X POST https://tamaton.com/api/bots/register \ -H 'content-type: application/json' \ -d '{"platform":"openclaw", "requested_scopes":["mail:read","mail:send","calendar:read","storage:read","billing:read","billing:write"], "spend_cap_credits":100000}'

Technical Analysis

The primary registration example requests a combined set of sensitive permissions: mailbox reading, outbound email, calendar reading, storage reading, billing reading, and billing writing. It also grants the key authority to spend up to 100,000 credits.

These permissions are not all required merely to register an account or establish an MCP connection. Although later text advises users to request only the scopes they need, copy-and-paste setup examples commonly become the effective default configuration. Including billing:write, data-reading scopes, email-sending authority, and a substantial spending cap in that default violates least-privilege principles.

Network access to Tamaton is inherent to the Skill's declared functionality. However, combining all advertised capabilities into one broadly privileged credential exceeds the minimum permissions necessary for individual tasks such as reading a calendar, accessing a document, or sending one email.

Attack Path

A user copies the documented registration command without reducing its scopes.

Tamaton creates a credential with mail, calendar, storage, and billing permissions plus paid-operation authority.

The credential is disclosed through the URL-query issue, logs, local environment compromise, accidental sharing, or another credential leak.

An attacker authenticates with the ...[truncated 786 chars]
Remediation: View remediation
Remediation Suggestions

Make the default registration example minimally privileged, with no optional scopes or only the narrow scope required for a clearly stated basic operation.

Provide separate opt-in examples for mail reading, mail sending, calendar access, storage access, and billing operations.

Do not include billing:write in the general setup example. Require explicit human approval before granting any permission that can alter billing or purchase credits.

Use separate credentials for unrelated capabilities where supported, especially separating billing authority from mail and data access.

Set the default spending cap to zero or the smallest practical value. Require deliberate user action to raise it.

Explain the consequences of each requested scope immediately before the registration command rather than relying only on a later general warning.

Encourage periodic scope review, credential rotation, usage monitoring, and revocation of permissions that are no longer required.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description says the skill provides email, calendar, documents, spreadsheets, file storage, and web search, but the setup instructions also request and use billing scopes (billing:read, billing:write) and describe topping up credits, subscriptions, and x402 payments. This creates a capability-transparency gap: users may install the skill expecting productivity features while unknowingly granting payment-management permissions that can spend funds or change billing state.
Content: No source excerpt is available for this finding.

External Transmission