Meegle Connector

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:41 AM UTC
• Version: 1.0.9

Overview

The skill is a coherent Meegle connector, but it asks the agent to handle OAuth credential files and runs an unpinned npm tool that could change after review.

Install only if you are comfortable granting this connector access to Meegle data and work-item mutations. Prefer browser OAuth where the agent does not see credential contents, avoid sending authorized credential files through chat or attachments, verify the npm package version before use, and consider pinning @lark-project/meego-mcporter to a reviewed version with locked dependencies and restrictive permissions on ~/.mcporter/credentials.json.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned npm Package Is Downloaded and Executed at Runtime

Content

View full analysis

--config meegle-config.json ``` ### Technical Analysis The dependency is identified only by its package name. No exact version, package-lock file, integrity hash, or other immutable reference is supplied. Consequently, npm or `npx` may resolve and execute a package release that differs from the version reviewed when this Skill was published. The command is particularly sensitive because it runs as the local agent user and is responsible for OAuth authentication. It can therefore interact with `~/.mcporter/credentials.json` and other files accessible to that user. This finding does not establish that the current npm package is malicious. It identifies a supply-chain weakness under which a future compromised or malicious package release could alter the effective executable payload without any corresponding change to the audited Skill files. ### Attack Path 1. An attacker compromises the npm publisher account, registry distribution path, or a future release of `@lark-project/meego-mcporter`. 2. The attacker publishes a modified package under the same package name. 3. A user follows the Skill instructions and invokes an unversioned `npx` or global installation command. 4. npm resolves and downloads the attacker-cont ...[truncated 913 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:90

Finding

Remote OAuth Workflow Routes Authorized Credentials Through the Agent

Content

View full analysis

The following is the OAuth Client configuration. Please refer to the document https://meegle.com/b/helpcenter/product/5rifl7a7 to complete the authorization on your local computer. After the authorization is completed, please provide me with the generated credential file. **Step B - Receive authorized credentials provided by the user (user confirmation required):** After the user completes OAuth locally, they will provide the authorized credential file. After obtaining user confirmation, write it to `~/.mcporter/credentials.json`. After the write operation is completed, immediately clean up any intermediate temporary files that may have been generated during the operation. The credential content is only stored in `~/.mcporter/credentials.json` and must not be saved to any other location. ``` ### Technical Analysis Reading and displaying the pre-authorization OAuth client configuration is described as excluding tokens and is relevant to the remote authorization procedure. The higher-risk behavior occurs in Step B, where the user is instructed to provide the authorized credential file to the agent. An authorized credential file can contain access tokens, refresh tokens, or equivalent bearer credentials. Passing that file through an agent-mediated input path may expose its contents to conversation history, attachment processing, tool traces, telemetry, or other retained infrastructure before it is written to the intended credential path. This workflow conflicts with the Skill's own constraint at ...[truncated 1997 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

This skill uses `~/.mcporter/credentials.json` to store OAuth credentials (managed by mcporter).

- **Method 1 (Recommended)**: Browser OAuth - mcporter automatically completes authorization and writes credentials, and the agent does not need to access the credential content.
- **Method 2 (Remote Server)**: When the server does not have a browser, users need to complete OAuth on their local computers and then sync the credentials to the server. In this process, the agent will assist in displaying the OAuth Client configuration (excluding tokens) and writing the authorized credentials provided by the user, and all operations require users to confirm step by step.

Security Constraints:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill explicitly instructs the agent to read ~/.mcporter/credentials.json and display its contents to the user. Even if it claims the file contains only client parameters at that moment, this creates a dangerous pattern of exposing credential-related file contents through the agent, and mistakes, stale state, or file format changes could leak actual secrets.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

**Step A - Present the OAuth Client Configuration to the User (Requires User Confirmation):**

Read the contents of `~/.mcporter/credentials.json` (which at this time only contains OAuth client parameters and no tokens), display them to the user, and inform the user:

> The following is the OAuth Client configuration. Please refer to the document https://meegle.com/b/helpcenter/product/5rifl7a7 to complete the authorization on your local computer. After the authorization is completed, please provide me with the generated credential file.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill instructs the agent to accept an authorized credential file from the user and write it to ~/.mcporter/credentials.json. Writing raw credential blobs through the agent increases the chance of accidental logging, prompt retention, mishandling of secrets, or replacement of an existing credential file with attacker-controlled content.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md

**Step B - Receive authorized credentials provided by the user (user confirmation required):**

After the user completes OAuth locally, they will provide the authorized credential file. After obtaining user confirmation, write it to `~/.mcporter/credentials.json`.

After the write operation is completed, immediately clean up any intermediate temporary files that may have been generated during the operation. The credential content is only stored in `~/.mcporter/credentials.json` and must not be saved to any other location.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill metadata allows execution via npx/npm without pinning an exact package version, so the actual code fetched at runtime can change over time. This creates a supply-chain risk where a compromised publisher account, malicious new release, or dependency hijack could cause the agent to execute unreviewed code.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

### 2. Browser OAuth (Recommended)

#### 2.1. Create a Configuration File

Copy `meegle-config.json` from the skill package directory to the working directory.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The command npx @lark-project/meego-mcporter auth meegle --config meegle-config.json runs whatever package version npm resolves at execution time. Because this skill also handles OAuth setup and local credential state, a malicious upstream package update could directly intercept tokens or execute arbitrary code on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This unpinned npx auth command is especially sensitive because it is used during OAuth bootstrap and writes credential material to disk. If the npm package changes unexpectedly, the executed code could modify the OAuth flow, exfiltrate client data, or persist additional secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Subsequent operational calls also use unpinned npx, meaning normal day-to-day use repeatedly reintroduces supply-chain execution risk. Since these calls can query and modify work items, a malicious package revision could abuse authenticated access and tamper with remote data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.