Security audit

Labradoc Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real Labradoc CLI helper, but it handles account tokens and sensitive document/email data with several under-scoped security protections users should review before installing.

Install only if you trust the Labradoc CLI publisher and need agent-driven access to your Labradoc account. Prefer API tokens with narrow scope, avoid passing secrets on command lines, do not ask the agent to print raw tokens, keep API/auth URLs on HTTPS defaults, and review state-changing commands such as archive, revoke, upload, webhook, checkout, and API-key operations before running them.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: cmd/auth/login.go:62
Finding: OAuth Callback Accepts an Authorization Response Without State Validation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: internal/cli/http.go:20
Finding: Credential-Bearing Requests Permit Plaintext HTTP Endpoints
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: internal/cli/http.go:28
Finding: Cross-Origin Redirects May Forward the Custom API-Key Header
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description centers on Labradoc CLI/API operations such as authentication and interacting with Labradoc resources. The actual code chunk does not perform any Labradoc API calls, CLI command execution, authentication, or document/task management. Instead, it is infrastructure code for config and logging initialization. While such code could support a larger Labradoc tool, this chunk’s behavior is materially different from the declared primary purpose, so this is a mismatch.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · cmd/auth/refresh.go (reported line 19)May include surrounding context.
go
var tokenCmd = &cobra.Command{ Use: "token", Short: "Print the stored access token", RunE: func(cmd *cobra.Command, _ []string) error { tok, err := cli.LoadToken() if err != nil {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · cmd/auth/token.go (reported line 17)May include surrounding context.
go
var tokenCmd = &cobra.Command{ Use: "token", Short: "Print the stored access token", RunE: func(cmd *cobra.Command, _ []string) error { tok, err := cli.LoadToken() if err != nil {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/labradoc-cli.md (reported line 40)May include surrounding context.
md
var tokenCmd = &cobra.Command{ Use: "token", Short: "Print the stored access token", RunE: func(cmd *cobra.Command, _ []string) error { tok, err := cli.LoadToken() if err != nil {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/integrations.md (reported line 17)May include surrounding context.
md
# Exchange OAuth code for token labradoc-cli api google drive code --code <oauth-code> # Refresh access token labradoc-cli api google drive refresh # Revoke access

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The documented auth token command prints the stored access token to stdout, which can expose credentials to agent logs, transcripts, shell history capture, or downstream tools. In an AI skill setting, commands that reveal raw tokens are especially dangerous because the agent may surface the secret back to the user or inadvertently leak it through observability pipelines.
Content: Scanner excerpt · references/labradoc-cli.md (reported line 79)May include surrounding context.
md
- Optional: `--code-verifier`, `--redirect-uri`, `--state` (uses saved `pkce.json` if missing). - Flag: `--json`. - `labradoc auth token` - Prints the stored access token. Flag: `--json`. - `labradoc auth refresh` - Refreshes the stored token. Flag: `--json`. - `labradoc auth status`

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The markdown describes that tokens and PKCE state are stored under the user's config directory, which affects credential privacy and account security. It does not include any caution about file sensitivity, access control, or avoiding sharing/backing up these files insecurely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documentation lists state-changing operations such as closing tasks, archiving files, reprocessing files, revoking API keys, and checkout/integration actions. The skill description does not warn that these commands modify remote account data or may be irreversible, which is relevant for user data and system integrity.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill exposes capabilities that can access environment variables and write files, but it does not declare any tool scope or permission boundaries. In a skill that handles API tokens and downloads/uploads documents, this increases the chance of unintended secret exposure or writing sensitive data to disk without clear user or platform constraints.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger text is broad enough to activate on generic document-management requests, which could cause the agent to invoke this skill in situations the user did not intend. Because the skill can authenticate, call raw API endpoints, and interact with files, over-triggering increases the risk of unintended actions on sensitive data or external services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs users to pass API tokens via CLI flags, environment variables, and config files, but it does not warn about the exposure risks of each method. Tokens in command-line arguments can appear in process listings and shell history, and tokens stored in config files may be left with weak permissions or accidentally committed, which is especially dangerous given access to files, email, users, API keys, and billing endpoints.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The body command fetches email content from the API and supports --out to write the response to a file, but this file provides no confirmation prompt, warning comment, or other user-facing disclosure about that file-write behavior. Because email bodies may contain sensitive content, silently redirecting them to disk increases privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The upload command reads a local file and sends its contents to a remote API endpoint, but the code provides no confirmation prompt, warning print, or disclosure beyond the terse command description. Because this operation transmits potentially sensitive user data off-system, the lack of explicit warning is a semantic safety gap.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The question command constructs a request body from user-provided text or a local JSON file and posts it to the API, and the search command does the same for agent-based search. Although network transmission is part of the feature, there is no visible warning that request body contents may include sensitive data and will be sent to the remote service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The Google Drive callback handler accepts an OAuth code and sends it over a network request via simpleGet, but there is no confirmation prompt, warning, or user-facing disclosure around handling this sensitive credential. The same pattern appears in the Gmail callback command, which can affect user privacy and account access because authorization codes are sensitive authentication material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This command takes a --code value and includes it in a network request to the backend, but the file provides no warning, confirmation, or disclosure that sensitive OAuth material will be transmitted. Because OAuth codes can grant access to user accounts when exchanged, this operation should be made more explicit to the user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code takes a sensitive OAuth code from the --code flag, places it into a request query string, and sends it via simpleGet. The file contains no confirmation prompt, logging/print disclosure, or explanatory comment/docstring warning the user that credential-like data will be transmitted to an endpoint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest describes a CLI for Labradoc API operations such as tasks, files, users, API keys, email, integrations, and billing. This file adds direct Stripe-oriented commands and a webhook endpoint, which expose payment-provider-specific operations rather than just Labradoc resource management, expanding the described behavior into external billing infrastructure handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code provides a command that directly sets the user's language preference from a supplied flag and sends it to the API, but the file contains no natural-language indication that the user is being offered a language choice or that any locale constraint is justified. Under the policy, forcing or changing language/locale settings without explicit opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This command explicitly prints the stored OAuth access token to stdout, which can expose credentials through terminal history, shell logging, CI job logs, process capture, or accidental copy/paste. In a CLI skill context, this is more dangerous because agent-driven execution may surface stdout back to users, logs, or other tools, increasing the chance of unintended token disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation instructs users through OAuth flows for Google Drive, Gmail, and Microsoft Outlook but provides no warning that the generated URLs, authorization codes, and resulting tokens grant access to external accounts and should be treated as secrets. In an agent-driven CLI context, users may paste codes or share command output into logs or chats, which can expose linked email or file data and expand compromise beyond Labradoc itself.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly documents persistent storage locations for OAuth and PKCE state files but does not warn that these artifacts contain sensitive authentication material. In an agent context, this increases the chance that tokens are stored, reused, or exposed via logs, workspace access, or later tool calls without adequate user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: When --out is provided, the code calls os.Create, which truncates or creates the destination file, but there is no confirmation prompt or user-facing warning about overwriting existing files. This is a file write with potentially destructive effects if the target path already exists.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This code saves the OAuth token to disk via cli.SaveToken(*token) but provides no prior disclosure that credentials will be persisted locally. Although the command's purpose is login, the only user-facing messages mention opening the auth URL and later that the token was saved, not that sensitive authentication material would be stored as part of the flow.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.