Meegle Connector

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:04 PM UTC
• Version: 1.0.9

Overview

The skill is a coherent Meegle connector, but it asks the agent to handle OAuth credential material and runs an unpinned npm tool that can change after review.

Review this skill carefully before installing. Prefer the browser OAuth flow where the agent does not see credential contents, avoid pasting credential files into an agent conversation, pin and verify the npm package version before use, and grant Meegle permissions no broader than needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:65

Finding

Unpinned npm Package Is Downloaded and Executed

Content

View full analysis

--config meegle-config.json ``` ### Technical Analysis The documented installation and execution commands do not pin `@lark-project/meego-mcporter` to an exact, reviewed version. When the package is unavailable locally, `npx` can retrieve it from the npm registry and immediately execute its lifecycle or application code. Consequently, the code executed by the Skill can change after this package has been audited. The package runs with the permissions of the user invoking the Skill. It also implements the OAuth process and accesses `~/.mcporter/credentials.json`, making dependency compromise particularly sensitive. The repository contains neither a lockfile nor an integrity hash that would constrain the downloaded artifact to an audited release. This does not establish that the current npm package is malicious. It establishes an unsafe, mutable supply-chain execution path through which a future compromised or unexpectedly changed release could execute arbitrary code. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or the package publication process. 2. The attacker publishes a malicious version under the legitimate package name. 3. A user follows the Skill instructions and invokes an unversioned `npx` or global installation command. 4. npm resolves and downloads the attacker-contro ...[truncated 899 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:86

Finding

Authorized OAuth Credentials Are Routed Through the Agent Conversation

Content

View full analysis

The following is the OAuth Client configuration. Please refer to the document https://meegle.com/b/helpcenter/product/5rifl7a7 to complete the authorization on your local computer. After the authorization is completed, please provide me with the generated credential file. **Step B - Receive authorized credentials provided by the user (user confirmation required):** After the user completes OAuth locally, they will provide the authorized credential file. After obtaining user confirmation, write it to `~/.mcporter/credentials.json`. After the write operation is completed, immediately clean up any intermediate temporary files that may have been generated during the operation. The credential content is only stored in `~/.mcporter/credentials.json` and must not be saved to any other location. ``` ### Technical Analysis The remote OAuth procedure explicitly asks the user to provide the authorized credential file to the Agent. This routes token-bearing content through the Agent's input channel before writing it to `~/.mcporter/credentials.json`. The surrounding instructions prohibit logging and require confirmation, but those controls do not guarantee that credential content will be absent from conversation history, model context, platform telemetry, API request records, tool traces, or client-side logs. Cleanup of local temporary files also cannot remove copies retained by those external layers. Displaying the initial OAuth client configuration is lower risk only if the file has been reliably verified ...[truncated 1766 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

- node
        - npx
      config:
        - ~/.mcporter/credentials.json
    install:
      - kind: node
        package: "@lark-project/meego-mcporter"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The skill explicitly describes a mode where the agent assists in displaying OAuth client configuration and writing user-provided authorized credentials, meaning the agent is involved in handling credential material. Even with stated confirmations, this expands secret exposure paths and increases the chance of leakage through prompts, logs, or mishandled files in an agentic environment.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

## Certificate Management Instructions

This skill uses `~/.mcporter/credentials.json` to store OAuth credentials (managed by mcporter).

- **Method 1 (Recommended)**: Browser OAuth - mcporter automatically completes authorization and writes credentials, and the agent does not need to access the credential content.
- **Method 2 (Remote Server)**: When the server does not have a browser, users need to complete OAuth on their local computers and then sync the credentials to the server. In this process, the agent will assist in displaying the OAuth Client configuration (excluding tokens) and writing the authorized credentials provided by the user, and all operations require users to confirm step by step.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

This skill uses `~/.mcporter/credentials.json` to store OAuth credentials (managed by mcporter).

- **Method 1 (Recommended)**: Browser OAuth - mcporter automatically completes authorization and writes credentials, and the agent does not need to access the credential content.
- **Method 2 (Remote Server)**: When the server does not have a browser, users need to complete OAuth on their local computers and then sync the credentials to the server. In this process, the agent will assist in displaying the OAuth Client configuration (excluding tokens) and writing the authorized credentials provided by the user, and all operations require users to confirm step by step.

Security Constraints:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill instructs the agent to read ~/.mcporter/credentials.json and display its contents to the user. Even though it claims the file contains only client parameters at that stage, requiring an agent to read and reveal data from a credentials path is dangerous because state can drift, the file may already contain tokens, and the agent cannot safely guarantee non-secret contents.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

**Step A - Present the OAuth Client Configuration to the User (Requires User Confirmation):**

Read the contents of `~/.mcporter/credentials.json` (which at this time only contains OAuth client parameters and no tokens), display them to the user, and inform the user:

> The following is the OAuth Client configuration. Please refer to the document https://meegle.com/b/helpcenter/product/5rifl7a7 to complete the authorization on your local computer. After the authorization is completed, please provide me with the generated credential file.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill tells the agent to write an authorized credential file provided by the user into ~/.mcporter/credentials.json. Allowing the agent to directly ingest and write credential material increases the risk of secret exposure in conversation history, logs, temporary buffers, and unsafe file handling, and it also creates a path for file-content spoofing or overwrite abuse.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md

**Step B - Receive authorized credentials provided by the user (user confirmation required):**

After the user completes OAuth locally, they will provide the authorized credential file. After obtaining user confirmation, write it to `~/.mcporter/credentials.json`.

After the write operation is completed, immediately clean up any intermediate temporary files that may have been generated during the operation. The credential content is only stored in `~/.mcporter/credentials.json` and must not be saved to any other location.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

Although the text says credential content must not be saved elsewhere, it still contemplates intermediate temporary files during secret-handling operations. In an agent workflow, any temporary-file use around credentials adds leakage risk, and the instruction cannot guarantee that tools, shells, or model interactions will avoid residual copies.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md

After the user completes OAuth locally, they will provide the authorized credential file. After obtaining user confirmation, write it to `~/.mcporter/credentials.json`.

After the write operation is completed, immediately clean up any intermediate temporary files that may have been generated during the operation. The credential content is only stored in `~/.mcporter/credentials.json` and must not be saved to any other location.

#### 3.4. Verify the Authorization Result

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill metadata declares execution via npx without pinning an exact package version, which allows the fetched code to change over time and exposes users to supply-chain compromise if the upstream package is updated maliciously or the account is hijacked. Because this skill is specifically designed to install and run a Node package as an MCP-related tool, the unpinned reference directly affects code execution trust.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

### 2. Browser OAuth (Recommended)

#### 2.1. Create a Configuration File

Copy `meegle-config.json` from the skill package directory to the working directory.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The command runs npx @lark-project/meego-mcporter auth meegle without an exact version pin, so each invocation may download and execute whatever package version is current at that time. In an authentication flow touching OAuth credentials, arbitrary upstream code execution is especially risky because a compromised package could steal tokens or alter authorization behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This remote OAuth bootstrap command also uses npx without pinning a version, creating a supply-chain risk at the moment the tool prepares OAuth client configuration. A malicious package version could generate altered config, exfiltrate secrets, or persist malware on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The subsequent operational command executes an unpinned npm package during normal use, so even after initial setup the skill remains exposed to package drift and compromise. Since the tool can query and modify work items, malicious updates could tamper with data or misuse authenticated sessions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.