Security audit

cc-connect-manager

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it handles bot credentials and live agent access in ways that need careful review before use.

Install only if you are comfortable with the skill editing your live cc-connect config, storing bot credentials there, and restarting the connector. Before using it, avoid pasting secrets into logged commands, redact config output, back up ~/.cc-connect/config.toml, review any generated project block before restart, and do not use QQ wildcard access unless you intentionally want any sender allowed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/add_project.py:59
Finding: Unescaped User Input Allows TOML Configuration Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:35
Finding: Bot Credentials Are Exposed Through Command-Line Arguments and Confirmation Output
Content: View full analysis
--work-dir --platform --token \ [--agent ] [--mode ] [--guild-id ] ``` Platform-specific token mapping: - **telegram**: `--token` = bot token from @BotFather - **discord**: `--token` = bot token, optionally `--guild-id` for instant slash commands - **feishu**: `--app-id` + `--app-secret` - **dingtalk**: `--app-id` + `--app-secret` - **slack**: `--bot-token` (xoxb-) + `--app-token` (xapp-) After adding, read back `~/.cc-connect/config.toml` and show the user the new project block for confirmation. ``` `scripts/add_project.py`, lines 39-48: ```python p.add_argument("--token", required=True, help="Platform bot token") p.add_argument("--agent", default="claudecode", choices=[ "claudecode", "codex", "cursor", "gemini", "qoder", "opencode", "iflow" ], help="Agent type (default: claudecode)") p.add_argument("--mode", default="default", help="Agent permission mode (default: default)") p.add_argument("--guild-id", default="", help="Discord guild ID for instant slash commands") p.add_argument("--app-id", default="", help="Feishu/DingTalk app ID") p.add_argument("--app-secret", default="", help="Feishu/DingTalk app secret") p.add_argument("--bot-token", default="", help="Slack bot token (xoxb-...)") p.add_argument("--app-token", default="", help="Slack app token (xapp-...)") ``` ### Technical Analysis The documented workflow passes bot tokens and application secrets as command-line arguments. On many operating systems, command-line arguments can be observed temporarily through process inspection facilities by othe ...[truncated 1579 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/add_project.py:88
Finding: QQ Projects Are Configured with an Unrestricted Sender Allowlist
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill promises broad lifecycle management, including removal, restart, and multi-agent binding guidance, but the described actionable implementation centers mainly on adding a project. This mismatch can mislead operators into assuming safety checks, restart handling, or deletion logic exist when they do not, causing unsafe manual actions or partial configuration changes.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to read and modify ~/.cc-connect/config.toml but does not declare any explicit tool scope or permissions boundary. That creates an authorization ambiguity where a caller may trigger file access beyond what is transparently advertised, increasing the risk of unintended or overbroad local file modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The removal instructions direct deletion of an entire [[projects]] block from a user configuration file without requiring confirmation, preview, or backup. A mistaken match or malformed edit could permanently remove the wrong project configuration and break service behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The restart procedure sends Ctrl-C to the tmux session and relaunches cc-connect without warning that it will interrupt a running service. This can terminate active bot sessions, lose in-flight work, or create operator confusion if invoked unexpectedly during production use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.