Security audit

WorkOS

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only WorkOS connector is purpose-aligned and not deceptive, but authorization can let an agent change, delete, upload, or share workspace content.

Install this only if you trust the WorkOS service and want agents to operate on your workspace. Prefer read-only authorization for read/search use cases; grant write only when you need edits. Confirm deletions, bulk updates, external sharing, transcript uploads, and image uploads, and use short expirations or passwords for share links where possible.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: docs/connect.md:3
Finding: Write-Capable OAuth Scope Requested by Default for Read-Only Operations
Content: View full analysis
` and a JSON-RPC 2.0 payload. ``` ### Technical Analysis The documented connection procedure requests both `read` and `write` OAuth scopes unconditionally. This is broader than necessary for declared read-only operations such as searching pages, retrieving documents, listing meetings, or inspecting tasks. The `write` scope grants access to tools that can create or modify pages, update database records, upload transcripts and images, create external share links, ...[truncated 2493 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docs/connect.md (reported line 118)May include surrounding context.
md
**`405 Method Not Allowed` on GET** — the client is trying SSE. Switch to Streamable HTTP. For Cline: set `"type": "streamableHttp"`. **`401 Unauthorized` after an hour** — the access token expired. The client should refresh automatically. If not, remove the server and re-add it. **Discovery fails** — the `.well-known` URLs are served by Next.js

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The documentation advertises permanently destructive operations like delete_page alongside sharing capabilities like external share links without any user-facing caution about irreversible deletion, access implications, or confirmation expectations. In an agent-integrated tool catalog, this increases the chance an LLM or downstream user invokes high-risk actions without understanding that data loss or external exposure may occur.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The meeting tools support transcript ingestion and AI-generated summaries but provide no warning that these inputs may contain sensitive business, personal, or regulated information. In an AI agent context, missing privacy guidance can lead to inadvertent processing, retention, or summarization of confidential meeting content without appropriate user awareness or policy checks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The meeting flow instructs agents to upload transcript chunks and generate summaries without any user-facing warning that potentially sensitive audio/transcript data will be transmitted to the remote service and stored/processed there. In a workspace platform handling meetings, transcripts may contain confidential business, personal, or regulated information, so lack of explicit notice and consent increases the risk of unintended disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The external sharing workflow shows how to create a share link and return the URL/token, but it does not prominently warn that this exposes page content outside the workspace boundary. Because the skill is specifically for connecting agents to a collaborative workspace, omission of an exposure warning makes accidental public or semi-public sharing more likely, especially if links are created without passwords or with long expiry windows.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · examples/prompts.md (reported line 24)May include surrounding context.
md
> "Create a new page in the Notes group called 'Research ideas 2026'." > "Add a task to the Tasks database: 'Order webinar equipment', due next Friday." > "Write a summary of the meeting I uploaded yesterday."

Static analysis

No suspicious patterns detected.