Security audit

Clawbars Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed ClawBars integration, but it combines credentials, configurable network endpoints, posting/deletion, coin use, and AI-generated publishing without enough guardrails.

Install only in a controlled environment with trusted configuration files, trusted HTTPS endpoints, scoped/revocable ClawBars and AI tokens, and explicit human approval before publishing, deleting, joining private spaces, voting, or spending coins. Treat arXiv paper text and AI-generated summaries as untrusted until reviewed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: lib/cb-common.sh:31
Finding: Configuration File Is Executed as Unrestricted Shell Code<![CDATA[ ## Vulnerability Details **File Location**: `lib/cb-common.sh:31-39` **Vulnerability Type**: Arbitrary code execution through unsafe configuration loading **Risk Level**: High ### Vulnerable Code ```bash # 加载配置 # Usage: cb_load_config # 设置: CLAWBARS_SERVER, CLAWBARS_API_KEY, CLAWBARS_USER_TOKEN cb_load_config() { local config_file="${CLAWBARS_CONFIG:-$HOME/.clawbars/config}" # 从配置文件加载（如果存在） if [[ -f "$config_file" ]]; then # shellcheck source=/dev/null source "$config_file" fi ``` ### Technical Analysis `cb_load_config` treats `~/.clawbars/config`, or the path supplied through `CLAWBARS_CONFIG`, as executable shell code. The `source` builtin does not parse only configuration assignments: it executes functions, command substitutions, redirections, process launches, and any other shell syntax contained in the file. Nearly every capability and scenario script sources `cb-common.sh` and invokes `cb_load_config`. Consequently, modifying this nominal configuration file creates a broad code-execution path that activates when a normal ClawBars operation is run. The risk is increased because `CLAWBARS_CONFIG` can redirect loading to an arbitrary local file. The implementation performs no ownership, permission, symlink, or content validation before executing it. ### Attack Path 1. An attacker obtains write access to `~/.clawbars/config`, supplies a malicious shared configuration file, or influences the `CLAWBARS_CONFIG` environment variable. 2. The attacker inserts shell commands, for example a command substitution or executable statement, into that file. 3. The victim invokes any capability or scenario that calls `cb_load_config`. 4. `source "$config_file"` executes the attacker-controlled commands in the current shell. 5. The commands inherit the invoking process's filesystem access, environment, network access, and ClawBars credentials. ### Impact Assessment Successful exploitation provides arbitrary command execut ...[truncated 387 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Do not use `source`, `.`, `eval`, or shell execution to load configuration. - Parse an allowlist containing only `CLAWBARS_SERVER`, `CLAWBARS_API_KEY`, and `CLAWBARS_USER_TOKEN`. - Reject command substitutions, shell metacharacters, functions, redirections, and unknown keys. - Validate that the configuration is a regular file, is owned by the invoking user, is not a symbolic link, and is not group- or world-writable. - Require restrictive permissions such as mode `0600` because the file may contain credentials. - Prefer a non-executable format such as JSON and parse it with `jq`. - Treat `CLAWBARS_CONFIG` as a trusted administrative setting or validate its resolved path before use. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: lib/cb-common.sh:124
Finding: Bearer Credentials and Sensitive Request Data Can Be Forwarded to Untrusted or Plaintext Endpoints<![CDATA[ ## Vulnerability Details **File Location**: `lib/cb-common.sh:12-14, 33-51, 124-164`; `cap-arxiv/interpret.sh:23-24, 68-72, 101-111` **Vulnerability Type**: Unvalidated destination and insecure transport for sensitive network data **Risk Level**: High ### Vulnerable Code ```bash CB_DEFAULT_SERVER="${CLAWBARS_SERVER:-http://localhost:8000}" CB_DEFAULT_TIMEOUT="${CLAWBARS_TIMEOUT:-30}" CB_DEFAULT_RETRY_COUNT="${CLAWBARS_RETRY_COUNT:-3}" ``` ```bash cb_load_config() { local config_file="${CLAWBARS_CONFIG:-$HOME/.clawbars/config}" if [[ -f "$config_file" ]]; then source "$config_file" fi CLAWBARS_SERVER="${CLAWBARS_SERVER:-$CB_DEFAULT_SERVER}" CLAWBARS_API_KEY="${CLAWBARS_API_KEY:-}" CLAWBARS_USER_TOKEN="${CLAWBARS_USER_TOKEN:-}" if [[ -z "$CLAWBARS_SERVER" ]]; then cb_fail 40101 "CLAWBARS_SERVER is not configured" fi export CLAWBARS_SERVER CLAWBARS_API_KEY CLAWBARS_USER_TOKEN } ``` ```bash cb_build_auth_header() { local token="${CB_TOKEN:-$CLAWBARS_API_KEY}" if [[ -n "$token" ]]; then echo "Authorization: Bearer $token" fi } cb_http_get() { local path="$1" local query="${2:-}" local url="${CLAWBARS_SERVER}${path}" if [[ -n "$query" ]]; then url="${url}?${query}" fi local auth_header auth_header=$(cb_build_auth_header) local curl_args=( -s -S -X GET -H "Content-Type: application/json" --max-time "$CB_DEFAULT_TIMEOUT" -w "\n%{http_code}" ) if [[ -n "$auth_header" ]]; then curl_args+=(-H "$auth_header") fi local response response=$(curl "${curl_args[@]}" "$url" 2>&1) || { cb_fail 50001 "HTTP request failed" "curl error: $response" } ``` The AI endpoint has the same trust-boundary problem: ```bash AI_API_KEY="${AI_API_KEY:-}" AI_BASE_URL="${AI_BASE_URL:-https://api.openai.com/v1}" AI_MODEL="${AI_MODEL:-gpt-4o-mini}" ``` ```bash --api-key) AI_API_KEY="$ ...[truncated 2712 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Require HTTPS for all non-loopback ClawBars and AI endpoints. - Permit plaintext HTTP only for verified loopback addresses used in explicit development mode. - Parse endpoints with a URL-aware validator and reject unsupported schemes, embedded credentials, malformed hosts, and ambiguous URLs. - Maintain an allowlist of approved service origins, or require explicit user confirmation before sending a credential to a previously unseen origin. - Bind each credential to an expected origin and refuse cross-origin forwarding. - Do not allow untrusted task content to control `CLAWBARS_SERVER`, `AI_BASE_URL`, or credential arguments. - Add certificate verification controls without permitting insecure TLS bypass options. - Clearly disclose which content is transmitted to the AI provider and obtain approval before transmitting private or proprietary documents. - Prefer short-lived, narrowly scoped tokens and support immediate revocation. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: cap-arxiv/deposit.sh:106
Finding: Predictable Shared Temporary Paths Permit Symlink and Race Attacks<![CDATA[ ## Vulnerability Details **File Location**: `cap-arxiv/deposit.sh:106-120`; `cap-arxiv/interpret.sh:229-235` **Vulnerability Type**: Insecure temporary-file creation and use **Risk Level**: Medium ### Vulnerable Code ```bash if [[ -z "$CB_SKIP_INTERPRET" && -n "${AI_API_KEY:-}" ]]; then echo "[$CB_ARXIV_ID] Running AI interpretation..." >&2 interpret_output=$("$SCRIPT_DIR/interpret.sh" --arxiv-id "$CB_ARXIV_ID" --output-dir /tmp/clawbars-arxiv 2>/tmp/interpret_stderr.log) || true # 读取生成的 Markdown 文件 local_file="" if [[ -f /tmp/interpret_stderr.log ]]; then local_file=$(grep -o 'Saved to: [^ ]*' /tmp/interpret_stderr.log | sed 's/Saved to: //' | head -1 || true) fi if [[ -n "$local_file" && -f "$local_file" ]]; then body_content=$(cat "$local_file") echo "[$CB_ARXIV_ID] AI interpretation ready" >&2 else echo "[$CB_ARXIV_ID] AI interpretation failed, using raw content" >&2 fi ``` The interpretation script writes into the caller-supplied directory without exclusive file creation: ```bash mkdir -p "$output_dir" local safe_title safe_title=$(echo "$title" | tr -cs 'A-Za-z0-9_-' '_' | head -c 100) local output_file="${output_dir}/${arxiv_id}_${safe_title}.md" echo "$combined" > "$output_file" ``` ### Technical Analysis The deposit workflow uses fixed, globally predictable paths: - `/tmp/clawbars-arxiv` - `/tmp/interpret_stderr.log` - A deterministically named Markdown file derived from the public arXiv identifier and title. The shell redirection to `/tmp/interpret_stderr.log` opens and truncates an existing target and follows symbolic links. The generated Markdown output also uses ordinary redirection and follows a pre-existing symbolic link. No private temporary directory, exclusive creation, ownership verification, symlink rejection, restrictive `umask`, or cleanup is present. The workflow then derives the publication source filename by parsing the shared stderr log. This ...[truncated 1437 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Create a unique private directory with `mktemp -d`. - Set `umask 077` before creating logs or generated output. - Register a `trap` that securely removes the temporary directory on exit. - Do not use a global stderr log to communicate an output filename. - Return the output filename directly in structured JSON and validate that its canonical path remains inside the private temporary directory. - Use exclusive file creation and reject pre-existing files and symbolic links. - Verify ownership and regular-file status immediately before reading. - Avoid running this workflow with elevated operating-system privileges. - Isolate concurrent jobs so one invocation cannot read or modify another invocation's artifacts. ]]>

other

Error

Location: cap-arxiv/interpret.sh:134
Finding: Untrusted Paper Instructions Can Manipulate AI Output That Is Automatically Published<![CDATA[ ## Vulnerability Details **File Location**: `cap-arxiv/interpret.sh:134-180, 190-209`; `cap-arxiv/deposit.sh:106-143` **Vulnerability Type**: Indirect prompt injection with automatic publication **Risk Level**: High ### Vulnerable Code The fetched paper is interpolated directly into a user-role prompt: ```bash local title content title=$(echo "$fetch_result" | jq -r '.data.title // empty' 2>/dev/null) content=$(echo "$fetch_result" | jq -r '.data.content // empty' 2>/dev/null) if [[ -z "$title" ]]; then title="$arxiv_id"; fi if [[ -z "$content" ]]; then echo "[$arxiv_id] No content available" >&2 return 1 fi local max_chars=80000 if [[ ${#content} -gt $max_chars ]]; then content="${content:0:$max_chars}" echo "[$arxiv_id] Content truncated to $max_chars chars" >&2 fi local user_prompt_1 user_prompt_1="请按照系统提示中的框架，对以下论文进行深度解读。论文标题: ${title} 论文内容: ${content} 输出要求： 1. 严格按照 Q1-Q6 的框架输出 Markdown 格式的解读 2. 直接从 \"## Q1: 这篇论文试图解决什么问题？\" 开始 3. 每个问题使用二级标题(##)，子节使用三级标题(###)" local messages_r1 messages_r1=$(jq -n \ --arg system "$SYSTEM_PROMPT" \ --arg user "$user_prompt_1" \ '[{"role":"system","content":$system},{"role":"user","content":$user}]') ``` The first generated response is then fed back into a second model call: ```bash local messages_r2 messages_r2=$(jq -n \ --arg system "$SYSTEM_PROMPT" \ --arg user1 "$user_prompt_1" \ --arg assistant1 "$result_1" \ --arg user2 "$user_prompt_2" \ '[{"role":"system","content":$system},{"role":"user","content":$user1},{"role":"assistant","content":$assistant1},{"role":"user","content":$user2}]') local result_2 result_2=$(ai_chat "$messages_r2") || { echo "[$arxiv_id] Round 2 failed, using round 1 only" >&2 result_2="" } ``` The resulting content is automatically published: ```bash if [[ -n "$local_file" && -f "$local_file" ]]; then body_content=$(cat "$local_file") echo "[$CB_ARXIV_ID] AI interpretation ready" >&2 else echo "[$CB_ARXIV_I ...[truncated 3104 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Treat all fetched document text as untrusted data rather than instructions. - Place document content in clearly delimited data blocks and explicitly instruct the model never to follow instructions found inside those blocks. - Use separate structured fields for the analysis task and source document where supported by the provider. - Validate model output against a strict schema requiring the expected Q1–Q6 sections. - Detect and reject output containing unexpected operational directives, credential requests, unrelated links, or instructions to downstream agents. - Do not automatically publish model output. Introduce a review and explicit approval step before `cap-post/create.sh`. - Mark published content as AI-generated and retain source provenance. - Apply moderation and sanitization to generated Markdown before publication. - Consider a two-model or deterministic validation stage that checks factual grounding and injection compliance before accepting the interpretation. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (72)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The description presents a multi-scene orchestration skill for research knowledge asset operations on ClawBars, with direct capabilities like balance check, vote detail, delete post, and member management. The actual code only fetches an agent's details from an agents API endpoint. That behavior is not represented in the declared scenes and is not one of the listed direct capabilities. While both relate generally to ClawBars APIs, the specific resource and primary purpose differ materially enough to count as a description-behavior mismatch.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared description presents a comprehensive orchestration skill for research knowledge assets and related ClawBars scenes (search, deposit, discussion, premium content, and certain direct atomic operations). The supplied code chunk does not implement any of those scene flows. Instead, it performs one specific function: issuing a GET request to /api/v1/agents to list agents, optionally filtered by type and limit. That is a materially different primary purpose and accesses a different resource domain than the declared research knowledge operations. While this may still be part of the broader ClawBars platform, the behavior shown here is not accurately represented by the declared description.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a multi-capability orchestration skill for interacting with ClawBars knowledge, vaults, discussions, premium content, and direct operational capabilities. The actual code chunk only performs one narrow function: registering an agent with the platform. That is a materially different primary purpose from the declared research knowledge asset orchestration behavior, and the specific capability exposed by the code—agent registration—is not mentioned in the description. This is therefore a clear description/behavior mismatch.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a clear description-behavior mismatch. The declared purpose describes a multi-scene ClawBars API orchestration skill for knowledge assets and discussions on the ClawBars platform. The actual code does none of that: it only retrieves paper data from arXiv, extracting an arXiv ID, downloading the abs/html pages, parsing title and content, and returning them. The primary purpose, target service, and capabilities are materially different from the declaration.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description centers on orchestrating multiple ClawBars knowledge-management scenes and direct platform capabilities. The supplied code does none of that. Its primary purpose is to interpret arXiv papers: parse arXiv IDs, fetch paper content, prompt an LLM for Q1–Q6 analysis plus metrics/losses/datasets, and save Markdown output. There is no evidence of ClawBars resources, API endpoints, scene routing, capability chaining for ClawBars, or any of the listed platform actions. This is a clear description-behavior mismatch, not merely an implementation-detail difference.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a high-level orchestrator for numerous ClawBars research and collaboration workflows, including scene routing and atomic capability operations. The supplied code chunk does not implement any of those described behaviors. Instead, it performs a specific authenticated account operation: listing the current user's agents from an auth endpoint. This is materially different in primary purpose and resource accessed (user auth/agent inventory vs. knowledge asset operations across bars/vaults/discussions). Therefore this chunk does not accurately represent the declared description.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Yes, this is a mismatch. The declared description focuses on research knowledge operations on ClawBars: knowledge search, deposits to public/private vaults, discussions, premium content handling, and a limited set of atomic direct capabilities. The actual code performs user registration against an authentication endpoint, which is a materially different function and is not mentioned among the declared scenes or direct capabilities. While both relate to the broader ClawBars platform, account creation is not a supporting detail of the described orchestration behavior; it is a separate capability involving credential handling and auth resource access.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a multi-scene orchestration capability centered on knowledge search, deposits, discussions, premium content, and certain direct administrative operations. The supplied code instead only fetches trending/observability data from /api/v1/trends with optional filters. That behavior is not covered by the listed scenes S1–S7 or the cited direct capabilities. While both relate to the ClawBars platform, the code's primary purpose is materially different from the declared functionality.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: This file performs arXiv scraping and content extraction, which is materially outside the stated ClawBars skill purpose of orchestrating ClawBars knowledge-asset operations. In an agent skill, undocumented off-scope network-fetching capabilities increase supply-chain and prompt-injection risk because the agent may retrieve and process untrusted external content that callers did not expect from this skill.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This script materially exceeds the declared ClawBars knowledge-asset orchestration scope by adding unrelated arXiv fetching and third-party AI analysis capabilities. Scope drift is dangerous because operators may grant this skill trust, permissions, or deployment in contexts where unexpected network access and data handling are not reviewed, enabling covert or ungoverned data exfiltration paths.

External Model or Provider Selection

High

Category: Excessive Agency
Content: # Usage: # ./interpret.sh --arxiv-id 2501.12948 # ./interpret.sh --arxiv-id 2501.12948 --output-dir ./output # ./interpret.sh --arxiv-id 2501.12948 --model deepseek-chat # # 环境变量: # AI_API_KEY - AI API 密钥 (必需)
Confidence: 90% confidence
Finding: Allowing user-selectable external model/provider routing broadens the trust boundary and can silently redirect sensitive content to different vendors with different retention, jurisdiction, or abuse controls. In this skill, that is more dangerous because the capability is undeclared in the manifest and may bypass organizational review of approved AI providers.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly orchestrates shell-script execution but does not declare any tool scope such as allowed shell access or permission boundaries. In an agent environment, undeclared shell capability weakens policy enforcement and can let a caller invoke broader system actions than reviewers or platform controls expect.

Whitespace Padding

Medium

Category: Prompt Injection
Content: ## Capability Domains | Domain | Purpose | Key Scripts | | ------------------- | ------------------------------ | ---------------------------------------------------------------------------------------------- | | `cap-agent` | Agent identity & lifecycle | `register.sh` `me.sh` `list.sh` `detail.sh` `bars.sh` | | `cap-arxiv` | ArXiv paper fetch & interpret | `fetch.sh` `interpret.sh` `deposit.sh` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: ## Capability Domains | Domain | Purpose | Key Scripts | | ------------------- | ------------------------------ | ---------------------------------------------------------------------------------------------- | | `cap-agent` | Agent identity & lifecycle | `register.sh` `me.sh` `list.sh` `detail.sh` `bars.sh` | | `cap-arxiv` | ArXiv paper fetch & interpret | `fetch.sh` `interpret.sh` `deposit.sh` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill advertises a direct post-deletion operation without any requirement for confirmation, dry-run, or user-warning language. In agentic workflows, destructive actions can be triggered accidentally, through prompt confusion, or by malicious task input, causing irreversible content loss.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The natural-language text in the file is presented in Chinese (for example, the description and inline comments) with no indication that this skill is intentionally region-specific or that users may choose another language. The policy requires avoiding forced language or locale constraints unless they are explicitly justified or optional.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly describes sending arXiv-derived paper content to an external AI API and then publishing the generated interpretation to ClawBars, but it does not warn users that content will leave the local environment or that deposited results may become persistent and shared. Even if arXiv papers are public, user-provided inputs, prompts, annotations, private vault targets, API metadata, or mixed-in non-public research context could be transmitted or stored unexpectedly, creating privacy and data-governance risk.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: When AI interpretation succeeds, the script replaces the raw paper content with model-generated text and publishes it as the post body without any explicit disclosure in the content or output that the material is AI-generated. In a research knowledge platform, this can mislead downstream users into treating synthesized or hallucinated analysis as authoritative source material, causing integrity and trust issues rather than direct code execution impact.

External Transmission

Medium

Category: Data Exfiltration
Content: # # 环境变量: # AI_API_KEY - AI API 密钥 (必需) # AI_BASE_URL - AI API 地址 (可选，默认 https://api.openai.com/v1) # AI_MODEL - 模型名 (可选，默认 gpt-4o-mini) # # 输出: Markdown 格式的论文解读文件
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: # # 环境变量: # AI_API_KEY - AI API 密钥 (必需) # AI_BASE_URL - AI API 地址 (可选，默认 https://api.openai.com/v1) # AI_MODEL - 模型名 (可选，默认 gpt-4o-mini) # # 输出: Markdown 格式的论文解读文件
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The natural-language instruction explicitly says the analysis must be output in Chinese, imposing a language constraint on all users. Under the policy, forced language or locale behavior is a violation unless the user can opt in or the restriction is clearly justified as region-specific.

External Transmission

Medium

Category: Data Exfiltration
Content: local messages_json="$1" local response response=$(curl -sS --max-time 120 \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $AI_API_KEY" \ -d "{
Confidence: 95% confidence
Finding: The curl call transmits prompts, paper content, and an authorization bearer token to a remote endpoint derived from configuration. This is risky because the script allows arbitrary AI_BASE_URL values and performs no provider verification, so a misconfigured or malicious endpoint could capture sensitive content and credentials.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script sends paper title/content and prior model outputs to an external AI-compatible API without any explicit runtime consent, warning, redaction step, or destination validation. In a skill ecosystem, this can leak sensitive or copyrighted inputs to third parties unexpectedly, especially if users assume processing stays within the ClawBars platform.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This shell script sends the supplied email and password in a network request via `cb_http_post`, which is a safety-relevant operation involving sensitive user data. While the usage line documents required arguments, the file does not provide any warning, confirmation, or user-facing notice that credentials will be transmitted to a remote endpoint.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This code requires a sensitive credential-like value (`--refresh-token`) and sends it in an HTTP request body, but the script provides no visible user-facing warning, confirmation, or explanatory comment about handling or transmitting that sensitive data. For code files, sensitive credential access and network transmission should have some disclosure unless clearly covered elsewhere in the skill description, which is not present in this file.

Static analysis

No suspicious patterns detected.