Security audit

Claude Connect

Security checks for vulnerabilities and agentic risk

Overview

This skill is not proven malicious, but it installs a persistent credential refresher for a deprecated use case and has serious token-handling weaknesses.

Do not install this unless you are intentionally maintaining a legacy Clawdbot setup and accept a persistent process that can read and update Claude OAuth credentials. Prefer Clawdbot's native onboarding path. If already installed, use uninstall.sh and verify launchctl no longer lists com.clawdbot.claude-oauth-refresher; also review claude-oauth-refresh-config.json, especially token_url, and treat the skill directory and config as credential-sensitive.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

Location: install.sh:201
Finding: <![CDATA[Deprecated Skill Installs a Persistent Credential-Handling LaunchAgent]]>
Content: View full analysis
StartInterval 7200 RunAtLoad StandardOutPath $HOME/clawd/logs/claude-oauth-refresher-stdout.log StandardErrorPath $HOME/clawd/logs/claude-oauth-refresher-stderr.log WorkingDirectory $SCRIPT_DIR EnvironmentVariables PATH /usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:$HOME/.local/bin EOF echo -e "${GREEN}✓${NC} Created $PLIST_FILE" echo "" # Step 5: Install launchd plist echo -e "${BLUE}[5/6]${NC} Installing launchd service..." mkdir -p "$LAUNCHAGENTS_DIR" # Unload if already loaded if launchctl list | grep -q "com.clawdbot.claude-oauth-refresher"; then launchctl unload "$LAUNCHAGENTS_DIR/$PLIST_FILE" 2>/dev/null || true echo " → Unloaded existing service" fi cp "$SCRIPT_DIR/$PLIST_FILE" "$LAUNCHAGENTS_DIR/$PLIST_FILE" launchctl load "$LAUNCHAGENTS_DIR/$PLIST_FILE" ``` ### Technical Analysis The installer creates and loads a per-user macOS LaunchAgent with `RunAtLoad` enabled and a 7,200-second execution interval. This causes `refresh-token.sh` to survive the installation session and execute at login/load and every two hours. Automatic scheduling was historically related to the Skill's declared token-refresh purpose, and the persistence behavior is disclosed in `SKILL.md` and `QUICKSTART.md`. However, `README.md:1-10` explicitly states that the Skill is deprecated because Clawdbot now provides native token refresh. Installing an additional persistent process that repeatedly accesses OAuth credentials therefore exceeds the minimum privileges and ...[truncated 1896 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: refresh-token.sh:272
Finding: <![CDATA[Configurable OAuth Endpoint Can Receive the Keychain Refresh Token]]>
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: refresh-token.sh:305
Finding: <![CDATA[Untrusted Values Are Interpolated into Executable Python Source]]>
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (166)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 28)May include surrounding context.
md
You can safely: 1. Remove the launchd job: `launchctl unload ~/Library/LaunchAgents/com.clawdbot.claude-oauth-refresh.plist` 2. Delete the skill folder: `rm -rf ~/clawd/skills/claude-connect` 3. Remove any related cron jobs Your tokens will continue to work via Clawdbot's native support.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.
md
You can safely: 1. Remove the launchd job: `launchctl unload ~/Library/LaunchAgents/com.clawdbot.claude-oauth-refresh.plist` 2. Delete the skill folder: `rm -rf ~/clawd/skills/claude-connect` 3. Remove any related cron jobs Your tokens will continue to work via Clawdbot's native support.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 28)May include surrounding context.
md
You can safely: 1. Remove the launchd job: `launchctl unload ~/Library/LaunchAgents/com.clawdbot.claude-oauth-refresh.plist` 2. Delete the skill folder: `rm -rf ~/clawd/skills/claude-connect` 3. Remove any related cron jobs Your tokens will continue to work via Clawdbot's native support.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 28)May include surrounding context.
md
You can safely: 1. Remove the launchd job: `launchctl unload ~/Library/LaunchAgents/com.clawdbot.claude-oauth-refresh.plist` 2. Delete the skill folder: `rm -rf ~/clawd/skills/claude-connect` 3. Remove any related cron jobs Your tokens will continue to work via Clawdbot's native support.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 263)May include surrounding context.
md
You can safely: 1. Remove the launchd job: `launchctl unload ~/Library/LaunchAgents/com.clawdbot.claude-oauth-refresh.plist` 2. Delete the skill folder: `rm -rf ~/clawd/skills/claude-connect` 3. Remove any related cron jobs Your tokens will continue to work via Clawdbot's native support.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose understates sensitive behaviors such as Keychain access, OAuth calls, credential store modification, gateway restart, and outbound notifications. Users may consent to a simple connector without realizing it handles secrets and persistence, increasing the chance of unsafe installation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared purpose understates sensitive behaviors such as Keychain access, OAuth calls, credential store modification, gateway restart, and outbound notifications. Users may consent to a simple connector without realizing it handles secrets and persistence, increasing the chance of unsafe installation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose understates sensitive behaviors such as Keychain access, OAuth calls, credential store modification, gateway restart, and outbound notifications. Users may consent to a simple connector without realizing it handles secrets and persistence, increasing the chance of unsafe installation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose understates sensitive behaviors such as Keychain access, OAuth calls, credential store modification, gateway restart, and outbound notifications. Users may consent to a simple connector without realizing it handles secrets and persistence, increasing the chance of unsafe installation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose understates sensitive behaviors such as Keychain access, OAuth calls, credential store modification, gateway restart, and outbound notifications. Users may consent to a simple connector without realizing it handles secrets and persistence, increasing the chance of unsafe installation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose understates sensitive behaviors such as Keychain access, OAuth calls, credential store modification, gateway restart, and outbound notifications. Users may consent to a simple connector without realizing it handles secrets and persistence, increasing the chance of unsafe installation.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The skill is designed to read OAuth credentials from macOS Keychain, which is highly sensitive secret material. Any automation that extracts and repurposes those tokens broadens the trust boundary and can enable account compromise if logs, files, or downstream components are exposed.
Content: Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.
md
### Refresh Process 1. **Read from Keychain:** Gets OAuth tokens from `Claude Code-credentials` 2. **Check Expiry:** Only refreshes if < 30 minutes left (or `--force`) 3. **Call OAuth API:** Gets new access + refresh tokens 4. **Update auth-profiles.json:** Writes proper OAuth format

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: Updating Keychain with refreshed tokens means the skill both reads and writes live credentials, increasing the chance of credential corruption, interception, or unintended persistence. Combined with auth-profile writing and notifications, this creates a concentrated secret-management component with substantial blast radius.
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
md
2. **Check Expiry:** Only refreshes if < 30 minutes left (or `--force`) 3. **Call OAuth API:** Gets new access + refresh tokens 4. **Update auth-profiles.json:** Writes proper OAuth format 5. **Update Keychain:** Syncs new tokens back 6. **Restart Gateway:** Picks up new tokens 7. **Notify:** Sends success/failure message (optional)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.
bash
# Stop auto-refresh launchctl unload ~/Library/LaunchAgents/com.clawdbot.claude-oauth-refresher.plist rm ~/Library/LaunchAgents/com.clawdbot.claude-oauth-refresher.plist # Remove skill rm -rf ~/clawd/skills/claude-connect

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The skill is explicitly designed to access, use, and rotate OAuth refresh tokens from macOS Keychain, then update local auth state and contact an external OAuth endpoint. In this context, credential access is intentional, but it is still security-sensitive because a compromised or modified script would have persistent access to long-lived tokens and could silently abuse them.
Content: Scanner excerpt · SUMMARY.md (reported line 84)May include surrounding context.
md
- Calculates expiry with buffer (default: 30 min) - Makes OAuth request to `auth.anthropic.com` - Updates `auth-profiles.json` atomically - Updates Keychain if refresh token rotates - Sends notifications via Clawdbot - Comprehensive error handling with actionable messages

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · SUMMARY.md (reported line 144)May include surrounding context.
We show:

✗ No refresh token found → No refresh token in Keychain → Run: claude auth

text

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CHANGES.md (reported line 133)May include surrounding context.
md
"refresh_buffer_minutes": 30, "log_file": "~/clawd/logs/claude-oauth-refresh.log", "_keychain_comment": "Keychain settings - where tokens are stored (account auto-discovered)", "keychain_service": "Claude Code-credentials", "keychain_field": "claudeAiOauth",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CHANGES.md (reported line 136)May include surrounding context.
md
"refresh_buffer_minutes": 30, "log_file": "~/clawd/logs/claude-oauth-refresh.log", "_keychain_comment": "Keychain settings - where tokens are stored (account auto-discovered)", "keychain_service": "Claude Code-credentials", "keychain_field": "claudeAiOauth",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CHANGES.md (reported line 139)May include surrounding context.
md
"refresh_buffer_minutes": 30, "log_file": "~/clawd/logs/claude-oauth-refresh.log", "_keychain_comment": "Keychain settings - where tokens are stored (account auto-discovered)", "keychain_service": "Claude Code-credentials", "keychain_field": "claudeAiOauth",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · COMPLETION-REPORT.md (reported line 47)May include surrounding context.
md
"refresh_buffer_minutes": 30, "log_file": "~/clawd/logs/claude-oauth-refresh.log", "_keychain_comment": "Keychain settings - where tokens are stored (account auto-discovered)", "keychain_service": "Claude Code-credentials", "keychain_field": "claudeAiOauth",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · COMPLETION-REPORT.md (reported line 272)May include surrounding context.
md
"refresh_buffer_minutes": 30, "log_file": "~/clawd/logs/claude-oauth-refresh.log", "_keychain_comment": "Keychain settings - where tokens are stored (account auto-discovered)", "keychain_service": "Claude Code-credentials", "keychain_field": "claudeAiOauth",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 10)May include surrounding context.
md
"refresh_buffer_minutes": 30, "log_file": "~/clawd/logs/claude-oauth-refresh.log", "_keychain_comment": "Keychain settings - where tokens are stored (account auto-discovered)", "keychain_service": "Claude Code-credentials", "keychain_field": "claudeAiOauth",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SUMMARY.md (reported line 140)May include surrounding context.
md
"refresh_buffer_minutes": 30, "log_file": "~/clawd/logs/claude-oauth-refresh.log", "_keychain_comment": "Keychain settings - where tokens are stored (account auto-discovered)", "keychain_service": "Claude Code-credentials", "keychain_field": "claudeAiOauth",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SUMMARY.md (reported line 144)May include surrounding context.
md
"refresh_buffer_minutes": 30, "log_file": "~/clawd/logs/claude-oauth-refresh.log", "_keychain_comment": "Keychain settings - where tokens are stored (account auto-discovered)", "keychain_service": "Claude Code-credentials", "keychain_field": "claudeAiOauth",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · claude-oauth-refresh-config.example.json (reported line 8)May include surrounding context.
json
"refresh_buffer_minutes": 30, "log_file": "~/clawd/logs/claude-oauth-refresh.log", "_keychain_comment": "Keychain settings - where tokens are stored (account auto-discovered)", "keychain_service": "Claude Code-credentials", "keychain_field": "claudeAiOauth",

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T06 · System Persistence

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Credential Access

Credential Access

Tool Parameter Abuse

Credential Access

Env Variable Harvesting

We show:

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Static analysis