Webhook Token Security (Zero‑Exposure Edition)

• Outcome: Review
• Latest audit: Aug 7, 2026 · 6:46 AM UTC
• Version: 1.2.0

Overview

The skill is documentation-only and mostly purpose-aligned, but it gives agents a concrete path to retrieve stored webhook secrets despite presenting itself as zero-exposure.

Install only if you trust MGC Blackbox and intend agents to help send webhook notifications. Prefer the WebUI and mgc_run flow, avoid giving agents access to plaintext retrieval paths, and verify any stored scripts before sealing or running them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The statement at L033 says the skill has no executable code and is safe for automatic approval, yet the document provides concrete procedures for reading `~/.mgc/.../.mgc_token`, calling sensitive local APIs, retrieving secret content, and executing scripts via `mgc_run` later in the file. That is an intent-level contradiction in the documentation because the skill materially enables sensitive operations even if it is presented as documentation-only.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The stated purpose emphasizes that tokens never need to be exposed to AI models, but the API reference explicitly describes how to read the local MGC token file and call `/api/mgc/sensitive/get` to obtain `data.content`, i.e. stored token material. Providing a plaintext-secret retrieval path is not well-justified by the claimed zero-exposure purpose and weakens the documented security posture.

External Transmission

Medium

• Category: Data Exfiltration

Content

| DingTalk | access_token + secret | JSON | https://oapi.dingtalk.com/robot/send |
| WeCom | webhook key | Plain text | https://qyapi.weixin.qq.com/cgi-bin/webhook/send |
| Feishu | webhook_url | Plain text | Custom webhook URL |
| Telegram | bot_token | Plain text | https://api.telegram.org/bot{token}/sendMessage |
| Slack | webhook_url / bot_token | JSON | Incoming Webhook or Web API |

---

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Step 1: Prepare Token File

Create a JSON file containing your webhook token details (see Platform-Specific Storage above).

## Step 2: Store in MGC

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.