ClawHub

Meegle Connector

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Meegle connector that uses OAuth credentials and an npm MCP tool for Meegle work items, with no artifact evidence of hidden or unrelated behavior.

Install only if you trust the @lark-project/meego-mcporter npm package and the Meegle MCP service. Protect ~/.mcporter/credentials.json, avoid pasting token contents unless you intentionally choose the remote OAuth flow, and require clear confirmation before any create, modify, or transfer action in Meegle.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Credential Access

High
Category
Privilege Escalation
Content
- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"
Confidence
70% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
## Certificate Management Instructions

This skill uses `~/.mcporter/credentials.json` to store OAuth credentials (managed by mcporter).

- **Method 1 (Recommended)**: Browser OAuth - mcporter automatically completes authorization and writes credentials, and the agent does not need to access the credential content.
- **Method 2 (Remote Server)**: When the server does not have a browser, users need to complete OAuth on their local computers and then sync the credentials to the server. In this process, the agent will assist in displaying the OAuth Client configuration (excluding tokens) and writing the authorized credentials provided by the user, and all operations require users to confirm step by step.
Confidence
70% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
**Step A - Present the OAuth Client Configuration to the User (Requires User Confirmation):**

Read the contents of `~/.mcporter/credentials.json` (which at this time only contains OAuth client parameters and no tokens), display them to the user, and inform the user:

> The following is the OAuth Client configuration. Please refer to the document https://meegle.com/b/helpcenter/product/5rifl7a7 to complete the authorization on your local computer. After the authorization is completed, please provide me with the generated credential file.
Confidence
70% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
**Step B - Receive authorized credentials provided by the user (user confirmation required):**

After the user completes OAuth locally, they will provide the authorized credential file. After obtaining user confirmation, write it to `~/.mcporter/credentials.json`.

After the write operation is completed, immediately clean up any intermediate temporary files that may have been generated during the operation. The credential content is only stored in `~/.mcporter/credentials.json` and must not be saved to any other location.
Confidence
70% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
After the user completes OAuth locally, they will provide the authorized credential file. After obtaining user confirmation, write it to `~/.mcporter/credentials.json`.

After the write operation is completed, immediately clean up any intermediate temporary files that may have been generated during the operation. The credential content is only stored in `~/.mcporter/credentials.json` and must not be saved to any other location.

#### 3.4. Verify the Authorization Result
Confidence
70% confidence
Finding
credentials.json

Credential Access

High
Category
Privilege Escalation
Content
This skill uses `~/.mcporter/credentials.json` to store OAuth credentials (managed by mcporter).

- **Method 1 (Recommended)**: Browser OAuth - mcporter automatically completes authorization and writes credentials, and the agent does not need to access the credential content.
- **Method 2 (Remote Server)**: When the server does not have a browser, users need to complete OAuth on their local computers and then sync the credentials to the server. In this process, the agent will assist in displaying the OAuth Client configuration (excluding tokens) and writing the authorized credentials provided by the user, and all operations require users to confirm step by step.

Security Constraints:
Confidence
70% confidence
Finding
access the credential

Session Persistence

Medium
Category
Rogue Agent
Content
### 2. Browser OAuth (Recommended)

#### 2.1. Create a Configuration File

Copy `meegle-config.json` from the skill package directory to the working directory.
Confidence
60% confidence
Finding
Create a Configuration File Copy `meegle-config.json` from the skill package directory to the working directory. #### 2.2. Perform OAuth authentication (only once) ```bash npx @lark-project/meego-m

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal