T09 · Insecure Skill Coding Practices
Error
- Location
scripts/reader.py:110- Finding
Unused Firebase refresh token stored without guaranteed restrictive permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Pocket AI Transcripts
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says, but it handles live Pocket account credentials in a risky and under-disclosed way.
Review before installing. Use this only on a machine and account you trust, treat ~/.pocket_token.json as a password-equivalent secret, delete it when finished, and avoid running the extract command in logged or shared terminals. The skill should ideally avoid storing refresh tokens, enforce owner-only file permissions, stop printing token fragments, and add clearer privacy warnings.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/reader.py:329- Finding
Bearer token material disclosed in terminal output
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill instructs users to use shell commands, local file storage, browser session access, and a networked reverse-engineered API, yet it declares no permissions or trust boundaries. This is dangerous because it obscures the skill's real capabilities and makes users less able to assess that it will access browser-derived auth tokens and sensitive remote data.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This code extracts Firebase authentication tokens directly from a logged-in browser profile by reading IndexedDB via a browser automation helper, then uses those credentials to access Pocket data. That is a credential-harvesting pattern that exceeds a simple transcript-reading skill's expected scope and enables unauthorized reuse of a user's session token if the local environment or cache is compromised.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill stores access and refresh tokens in a plaintext file under the user's home directory, creating a durable local credential artifact not clearly implied by the skill description. Any other local process, backup system, or user with access to that file could reuse the tokens to retrieve sensitive transcripts and summaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README instructs users to extract a live Firebase bearer token from the browser and store it in a local file (
~/.pocket_token.json) but does not clearly treat that token as a sensitive credential or warn about local exposure risks. Because this skill accesses highly sensitive conversation transcripts and summaries, compromise of the stored token could allow unauthorized access to private recordings until expiry, and the documentation normalizes unsafe credential-handling practices.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The setup flow tells users to extract a Firebase bearer token from the browser and save it to ~/.pocket_token.json without a prominent warning that this is a live credential granting access to Pocket account data. A locally stored token can be reused by other local processes or users, and users may not understand the exposure created by persisting account credentials on disk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises transcript and summary retrieval but does not clearly warn that it can expose highly sensitive content such as raw conversations, action items, and possible location metadata. In this context, the omission is significant because meeting transcripts and summaries often contain confidential business, personal, or regulated information that users may not expect to surface broadly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The browser token extraction logic handles highly sensitive authentication material but provides only operational instructions, not a prominent warning that it will access browser-stored session credentials and persist them locally. Users may unknowingly grant the skill access equivalent to their Pocket account session, increasing the chance of accidental overexposure.
- Content
Static analysis
No suspicious patterns detected.