The MCP configuration shows the API key being passed as a command-line argument header. While documentation shows "CRAFTED_API_KEY" as placeholder, the actual configuration pattern may expose real API keys in process lists, logs, and command history.

The skill documentation describes complex workflows (decomposition, delegation, synthesis) but provides no information about input validation, rate limiting, error handling, timeout configurations, or retry logic. This lack of controls could lead to unexpected behavior, cost overruns, or information leakage.

Documentation examples use shell variable substitution without proper escaping, creating injection vulnerabilities if examples are adapted with untrusted input. Variables directly embedded in JSON strings without escaping special characters or JSON structure validation.

Skill takes 0.4% creator fees and 0.4% platform fees (4CHAD) from trading volume. While disclosed, documentation lacks clear breakdown of where platform fees go, why 4CHAD deserves 0.4% fee equal to creator, mechanism to verify fees are actually paid, whether platform could unilaterally change fees, or tax implications.

Platform implements only rate limiting (1000 requests/hour) as mechanism to prevent abuse. This is insufficient to prevent launching 1000 tokens in an hour, executing 1000 trades simultaneously, draining wallet through rapid trades. No per-transaction limits, no daily spending caps, no transaction review/approval gates.

Skill depends on multiple external services without verification or fallback: Jupiter v6 Swap API, Meteora DLMM pools, Solana RPC endpoints, Supabase backend. None have documented security audits, SLAs, or guarantees. Service compromise or outage breaks skill entirely.

The skill reads OAuth refresh tokens from local filesystem (auth-profiles.json) without documenting file permission security requirements. The containing directory (~/.clawdbot/) may have permissive permissions allowing other system users to access refresh tokens. No security warnings are provided to users about credential file protection.

The wallet file is created in ~/.config/soroban/wallet.json with default Node.js file permissions (typically 0o644 - readable by all users on the system). On shared systems, other users can read the encrypted wallet file. Combined with weak salt vulnerability, this is particularly dangerous.

Skill makes claims about providing 'institutional-grade insights' and 'deterministic data-bound market intelligence' while including disclaimer that it's not financial advice. Creates potential liability if users treat automated ratings as professional investment advice.

Skill automatically logs all financial analysis reports to user's Firebase project without prominent notification or documented opt-in/opt-out mechanisms. Automatic persistence of sensitive financial analysis data.

The skill fetches financial market data and generates charts but provides no documentation about data handling, privacy implications, or where data is stored/processed. Users cannot determine whether analyses are logged, whether charts involve cloud processing, or how data is retained.

The skill is a professional financial analysis tool with real-world monetary implications, but includes no risk disclosures, disclaimers, or warnings about relying on analysis for investment decisions. This represents a responsibility gap for financial tools.

The API endpoint is a raw IP address (150.158.152.82) without an associated domain name. IP geolocation data suggests location in China. Raw IP addresses are typically used for temporary/development infrastructure and raise legitimacy concerns.

The SKILL.md documentation lacks critical security sections including privacy policy, security warnings, credential guidance, data transmission disclosure, and third-party infrastructure disclaimer. Users cannot make informed security decisions.

The skill instructs users to store Browser Use API key in Clawdbot config but provides no security guidance about key rotation, permissions, revocation, billing implications of compromise, rate limiting, or usage alerts. API key has full access to create browser sessions ($0.03-0.06/hour) and execute tasks, making it a financial security risk if exposed.

The skill documents pricing ($0.03-0.06/hour for sessions) but provides no guidance on rate limiting, maximum concurrent sessions, cost protection mechanisms, billing alerts, what happens if sessions are forgotten (continue billing?), or task execution costs. Users could accidentally create expensive runaway automation.

The skill provides no warnings about compliance implications for regulated industries or data types. Organizations subject to HIPAA, PCI-DSS, SOC 2, GDPR, or other regulations could inadvertently violate compliance by using this service without understanding data processing implications.

The skill relies on CDP infrastructure provided by a third party (browser-use.com). Research shows CDP has history of security issues and is often targeted by attackers. The skill provides no information about Browser Use's security track record, known incidents, vulnerability disclosure process, bug bounty program, security audits, or incident response procedures.

The "Tasks (Subagent)" feature allows autonomous AI agents to execute browser actions based on natural language prompts. Documentation provides no security guidance about: what actions agent can perform (form submissions, purchases, data entry?), whether users should review actions before execution, how to prevent unintended actions, audit logging, or liability for mistakes.

The skill handles credit card payments through Stripe but lacks critical PCI compliance documentation. No mention of PCI DSS compliance level, responsibility matrix between Stripe and clawver.store, secure data handling practices, forbidden practices, or audit/certification results.

The skill integrates with Printful for print-on-demand fulfillment. While Printful is a legitimate service, the integration documentation lacks security/compliance verification. No documentation of Printful's security standards, data sharing agreements, what customer data is shared, liability for lost/damaged orders, or compliance alignment.

Continuous autonomous code modification in 'Mad Dog Mode' (--loop flag) spawns executor agents without human oversight, with crash recovery that perpetuates changes

Accepts evolution strategies (Genes and Capsules) from external agents via A2A protocol. While staged as candidates, promotion mechanism exists creating supply chain risk.

Incomplete rollback protection - only restores tracked files and selectively deletes new untracked files. Does not handle untracked modifications or directory deletions safely.

Skill refuses to evolve if memory graph cannot be written, creating fail-closed design that could lead to denial of service from disk issues or permissions.

HTTP communication security not documented

Missing OAuth/token scope documentation

Access control and whitelist behavior not security-documented

Duplicate command handlers for 'drives' with conflicting implementations. Only first handler executes, second is unreachable dead code.

Commands use inconsistent parameter positions. Some expect position 1, others position 2, creating confusing API.

ED25519 signature authentication mechanism has several documented weaknesses: 1. Challenge replay risk (5-minute expiration not anti-replay) 2. No message binding (signature could be reused across services) 3. Signature verification procedure not documented 4. Ongoing session management not documented 5. No key rotation mechanism if wallet is compromised

The --time parameter accepts any string without validating it conforms to HH:MM:SS format or other ffmpeg timestamp formats. Passed directly to ffmpeg without sanitization.

Output path is not validated, allowing potential writes to arbitrary filesystem locations. Directory creation via mkdir -p doesn't prevent writing to sensitive system directories or traversing outside intended boundaries.

File existence check using -f only verifies file exists, not that it's readable. No verification of access permissions before attempting to process the file.

The skill grants autonomous borrowing authority: the agent can execute borrows up to maxBorrowPerTx without any additional user approval beyond the initial Aave delegation. Comparison to other financial operations: - ETH transfer: No confirmation once agent has funds (unprotected) - Aave delegation: User approves once via block explorer (high friction, one-time) - Agent borrow: Agent executes automatically (zero friction, unlimited uses) The borrow script logs details and prints confirmation (line 171) but these are output-only—they do not block execution. An attacker controlling the agent could execute hundreds of borrows in rapid succession without user intervention.

While safety.md documents the threat model well (5 major risks), it lacks critical operational procedures for real-world deployment: 1. Key Compromise Response - Current answer: "call approveDelegation(..., 0)" - Missing: How to confirm agent was compromised? When to trigger? How to verify? 2. Health Factor Monitoring - Mentioned once, no integration guide - No instructions for setting up Aave notifications or DeFi Saver alerts 3. Liquidation Recovery - Not covered at all - Delegator needs step-by-step repay and collateral procedures 4. Audit Logging - Scripts print to stdout but don't save logs - No recommended log aggregation or analysis approach 5. Key Rotation - How to migrate from compromised key to fresh key? - Requires updating delegation—no documented procedure

The documentation explains health factor correctly but undersells liquidation risk for volatile collateral. Specifically: 1. README.md explains "borrowing power is holistic" (good) but doesn't emphasize that collateral VALUE changes with price - If delegator posts ETH and borrows USDC, a 30% ETH price drop means 30% less borrowing power 2. Borrow scripts check health factor AT THE MOMENT OF BORROW, but collateral could drop 10 minutes later - Time-of-check vs. time-of-use problem - Safety check becomes stale if market moves 3. safety.md acknowledges "Oracle Manipulation / Market Volatility" (lines 55-63) but only recommends "use conservative minHealthFactor (2.0+)" - Doesn't explain WHY 2.0+ is needed (allows for ~20% price drop) - Doesn't show example of what happens with default 1.5 - No guidance on collateral-to-borrow ratios 4. No warnings in SKILL.md about using volatile collateral as base - Borrowing WETH against volatile ETH is riskier than borrowing USDC against ETH - Not documented 5. Missing liquidation mechanics explanation: - Liquidation threshold vs. health factor 1.0 - Liquidation penalty (typically 5-10% of debt at Aave) - How liquidators are incentivized to attack vulnerable positions

Skill documentation lacks critical security warnings about autonomous operation risks, potential failure modes, and operational guidelines. No SECURITY.md file or risk disclosure section explaining what could go wrong, safe vs. unsafe tasks, audit logging, or data sensitivity concerns.

Automated nightly and hourly cron jobs are set up without documented user verification, job monitoring, or easy disabling procedures. Once installed, jobs run silently without confirmation or visibility. Missing guidance on verifying jobs run correctly, checking logs, monitoring performance, or disabling if problems occur.

Nightly review job automatically commits and pushes changes to git without documenting that the agent needs write access or that users should verify changes before they're pushed. No verification mechanism catches corrupted or incorrect updates before they're committed and pushed upstream.

Skill demonstrates memory file structure but doesn't warn about sensitive data that might be accidentally stored in version-controlled files. Credentials, API keys, personal information, and financial data stored in memory files become part of git history permanently (immutable) and are impossible to fully remove. Anyone with repository access can retrieve this information.

Hardcoded partner fee collection - automatic 0.2% (20 bps) fee extraction to address 0xd99C871c8130B03C8BB597A74fb5EAA7a46864Bb on all transactions

Wallet addresses cached to disk in plaintext JSON without encryption at ~/.openclaw/cache/

External API dependencies without certificate pinning or comprehensive verification (SODAX: canary-api.sodax.com, Bankr: api.bankr.bot)

Writes wallet configuration to disk at ~/.openclaw/extensions/amped-defi/wallets.json without permission restrictions

Extensive console logging may expose sensitive information (wallet addresses, transaction details, amounts)

Bankr API key transmitted in HTTP headers, stored in memory

Security policies loaded from AMPED_OC_LIMITS_JSON with minimal validation. Errors silently return empty config (no limits)

Script reads auth profile file without validating file permissions. If auth-profiles.json has world-readable permissions, OAuth tokens are exposed to any process on the system.

The --output parameter accepts arbitrary file paths without validation, enabling directory traversal attacks. Users could specify paths like '../../../etc/passwd' to write outside intended directories.

Hardcoded fallback project ID 'junoai-465910' embedded in script. This appears to be test/debug project ID used when auth profile doesn't specify projectId.

When API fails to return image data, script logs raw API response start (200 characters) to stderr, potentially exposing sensitive information from API responses.

Mandatory commercial third-party dependency: The skill requires a paid Maton.ai account and API key, but this is not prominently disclosed upfront. The compatibility line states "Requires network access and valid Maton API key" without explaining this is a commercial service. Users discover the requirement only after installation, with no pricing transparency provided.

OAuth token interception architecture: The gateway requires OAuth flows through Maton.ai's infrastructure (connect.maton.ai), then uses gateway.maton.ai to inject tokens into API requests. This creates a man-in-the-middle architecture where Maton.ai can inspect all requests and responses. Documentation mentions tokens can expire after 1 month but doesn't explain refresh handling, storage duration, or revocation process.

Expired token error handling increases attack window: 500 Internal Server Errors commonly occur due to expired OAuth tokens after 1 month, but error messages are generic rather than specific. This forces users through multi-step troubleshooting to create new connections and re-authenticate. During this window, credentials may remain exposed through old connections without clear security state indication.

Rate limiting insufficient for blast radius: The gateway implements 10 requests/second rate limiting per account (36,000 req/hour, 864,000 req/day). For a compromised MATON_API_KEY with access to 45+ services, this is insufficient to prevent large-scale data exfiltration or destructive actions. No mention of per-service rate limiting, anomaly detection, or automated abuse prevention.

Research reveals that ATXP uses blockchain-based payment systems (USDC on Base, World Chain, Polygon, and Solana) for API access. The skill documentation does not disclose this financial mechanism or the associated risks. Users may unknowingly be managing cryptocurrency wallets when they authenticate.

The skill connects to multiple external MCP servers at *.mcp.atxp.ai but provides no information about data retention policies, encryption standards, privacy protections, logging practices, security audits, data sharing with third parties, or compliance standards.

Recent security research (2026) has revealed significant vulnerabilities in MCP server implementations, including three critical flaws in Anthropic's reference MCP Git server. While these specific vulnerabilities are in Anthropic's implementation, they highlight systemic security challenges in the MCP ecosystem that may affect ATXP servers.

Cron job executes with full system permissions including global package installation (-g flag) and file system modifications. No rate limiting, size limits, or safety constraints.

Helper script captures version strings and command output without sanitization. Malicious update responses could inject commands through version strings or error messages that are logged and echoed.

Updates applied without creating backups or snapshots. Failed updates could leave system in broken state with no automated recovery path. Error handling uses || true to continue despite failures.

The documentation shows bash command examples with environment variables containing API credentials. When users run these commands, credentials are logged in plaintext shell history (~/.bash_history, ~/.zsh_history), creating a persistent accessible record.

The skill includes a hardcoded Binance referral ID (GRO_28502_YLP17) presented as 'supporting the community' but lacks transparency about financial incentives and who benefits.

The skill provides commands for opening/closing leveraged positions, liquidation, and stop-loss configuration but lacks explicit warnings about execution speed, slippage, and irreversibility.

HMAC signature examples show bash commands with secret keys that would be stored in shell history files (~/.bash_history, ~/.zsh_history) if copy-pasted directly by users.

Credential setup section lacks security best practices documentation. No guidance on API key scopes, IP whitelisting, withdrawal restrictions, key rotation, or incident procedures.

Extensive leverage trading documentation (up to 125x) provided with minimal risk disclosure. Safety rules present but insufficient for users unfamiliar with derivatives trading.

No discussion of Binance's security posture, incident history, regulatory status, or cryptocurrency-specific risks. Users expected to trust exchange without understanding counterparty risks.

The skill instructs agents to use 'brv curate -f file' commands, which transmit file contents to ByteRover's servers for AI-powered context analysis. However, SKILL.md does not explicitly state that file contents are sent to external servers, what happens to the data after transmission, where the data is stored (locally vs. cloud), or how to keep data local-only.

The skill requires users to authenticate via OAuth browser login to ByteRover's service, but this requirement is not clearly stated in the main SKILL.md documentation. Users only discover the authentication requirement when they encounter errors. The skill doesn't explain what permissions ByteRover's OAuth flow requests or warn that ByteRover cannot be used in headless environments (CI/CD, Docker, SSH without browser).

The skill documentation provides connection management procedures but completely lacks documentation of OAuth security practices. Users cannot determine what OAuth scopes are requested from ClickUp, how tokens are encrypted, what security certifications Maton.ai holds, or what data handling practices are in place.

The skill uses a centralized proxy architecture where all requests flow through gateway.maton.ai. While this is disclosed, the documentation fails to explicitly explain the implications: all ClickUp API requests and responses (potentially containing sensitive project data) pass through Maton.ai's servers. Users must explicitly understand this trust model.

The documentation provides no information about Maton.ai's data privacy practices, data retention policies, logging practices, or incident response procedures. Users delegating authentication to Maton.ai need to understand how their data is handled.

The documentation explains how to create and delete connections but fails to document the complete token lifecycle. Users don't understand OAuth token expiration behavior, rotation procedures, how to audit active connections, or the difference between deleting a connection and revoking access at ClickUp.

Skill provides complete system control (keystroke logging, screen capture, file access) without any security warnings or risk disclosure. Documentation lacks security implications, credential handling guidance, or privacy warnings.

Coordinate parameters (X, Y) are not validated for numeric type, range, or screen resolution bounds. Script only checks if empty, not if numeric or within valid range (0-1024 for 1024x768 display).

VNC server started with -nopw (no password) flag by default. Documentation encourages unencrypted HTTP access to noVNC without requiring HTTPS or SSH tunneling.

Setup script performs extensive system modifications via sudo without user confirmation prompts, reversal documentation, or uninstall process. Creates persistent /opt files, masks system binaries, and enables systemd services.

User-provided text parameter has no length validation. Extremely large inputs could cause system slowdown or unexpected behavior.

The skill documentation recommends running gemini interactively for authentication but doesn't warn users to do this only in trusted directories. Running interactive gemini in an untrusted directory can expose users to prompt injection attacks during the authentication flow.

The skill documentation does not warn users about API usage costs, rate limits, or billing implications. The gemini-cli tool can make frequent API calls that incur charges, especially with certain models or features.

The skill includes a brief warning to "Avoid --yolo for safety" but doesn't explain what the flag does or why it's dangerous. The --yolo flag bypasses all user confirmations for tool execution, allowing the AI to execute any command without approval.

When users authenticate via Google OAuth (the recommended method), refresh tokens are cached locally. The skill provides no guidance on token storage security, token expiration and rotation, revoking compromised tokens, multi- device token management, or workspace vs personal account separation.

The skill mentions extensions but provides no security guidance about extension sources and trust model, extension permissions and capabilities, risk of malicious extensions, extension vetting process, or the command injection vulnerability (CVE tracking #433939935) in .vsix file handling.

The authentication section does not document what OAuth permissions are requested from Google. Users cannot see the scope of access they're granting to their Google accounts through Maton.ai, violating transparency principles.

The skill completely depends on Maton.ai's security practices but provides no documentation of Maton's security certifications, compliance status, or audit history. Users have no basis to trust that Maton.ai is secure.

The skill documentation shows environment variable usage without guidance on secure storage. When users execute examples in terminal sessions, the API key can be exposed in shell history, process listings, and logs.

The documentation does not explain what OAuth scopes Maton.ai requests from Google Forms API. Users cannot determine whether the gateway requests read-only access, full read-write permissions, or both. This violates the principle of least privilege and prevents informed user consent.

The documentation provides no warnings about sensitive data handling or implications of routing Google Forms data through third-party Maton.ai infrastructure. Users are not informed that forms commonly contain PII, business-sensitive, or regulated data (health, financial).

Documentation explains how to create and delete Google connections but provides no guidance on token rotation, revocation verification, or security management procedures. Users cannot determine if compromised tokens persist or how to safely manage credentials.

The documentation does not document Maton.ai's security certifications, compliance status, incident response procedures, or privacy policy. Users cannot evaluate whether to trust their Google Forms data to Maton.ai infrastructure.

Skill manages OAuth connections to Google Meet on behalf of users but provides no documentation about OAuth scopes, permissions granted, token security practices, or how Maton stores/protects tokens.

Skill requires MATON_API_KEY environment variable but provides minimal guidance on secure credential handling, rotation, or exposure prevention.

All API requests are forwarded through Maton's gateway service, meaning Google OAuth tokens and all meeting data (participants, recordings, transcripts) flow through Maton infrastructure. Users are not informed of this data flow architecture or its security implications.

The skill controls powerful smart home capabilities (lights, climate control, garage doors, locks, scripts, automations) but lacks comprehensive security documentation. Users are not warned about the sensitivity of long-lived access tokens, the account-wide scope of permissions, or best practices for token management. Documentation shows token creation without explaining risks or providing security guidance.

The skill enables control of security-critical devices (locks, garage doors, alarm systems) without explicit warnings about physical security implications or best practices for securing these capabilities.

All examples pass entity IDs and parameters directly to the API without demonstrating input validation or sanitization. No defensive programming practices shown.

The documentation explains how to use OAuth connections but never specifies what OAuth scopes are requested from HubSpot. Users cannot determine whether the skill requests read-only access or full read-write access to sensitive CRM data, or whether Maton implements least-privilege principles.

HubSpot CRM typically contains highly sensitive business and personal data including customer contact information (names, emails, phone numbers), company information, deal amounts, and potentially health/financial details. The skill documentation provides no warnings about the sensitive nature of this data or the implications of routing it through a third-party gateway (Maton.ai servers).

The skill recommends trusting Maton.ai with OAuth token management and data routing but provides no information about Maton.ai's security posture, certifications (SOC2, ISO27001), incident response procedures, or compliance status. Users have no way to evaluate whether they should trust this third party with their HubSpot credentials.

While the skill documents how to create, retrieve, and delete connections, it provides no guidance on how frequently to rotate OAuth tokens, recommended schedules for auditing active connections, procedures for revoking compromised tokens, how to verify tokens are still valid, or implications of token expiration or refresh.

The skill's canonical source repository is listed as https://github.com/LunarCmd/moltbook-skill, but this URL returns a 404 error. The repository does not exist or has been deleted/made private. This prevents users from verifying source code authenticity, checking author reputation, reviewing commit history, receiving security updates, or reporting issues to the maintainer.

User-provided command-line arguments are passed directly into JSON payloads and API calls without validation, sanitization, or escaping. This creates risk of JSON injection if input contains special characters, API abuse if malformed data is sent, or unexpected behavior if input contains shell metacharacters.

Skill requires wallet private keys for real financial transactions but provides zero security guidance. Missing documentation on credential management, financial risks, transaction irreversibility, contract verification, RPC security, input validation, and permission principles.

Hardcoded contract address (0x8a11871aCFCb879cac814D02446b2795182a4c07) on Base blockchain cannot be independently verified through official documentation, BaseScan, or ERC-8004 repository. No code validation ensures contract matches expected interface before using.

Content safety warnings tell agents what not to do but provide no concrete detection mechanisms or technical controls. Malicious research submissions could contain prompt injection attempting to override security guidelines.

While API key registration and rotation are documented, security guidance for credential storage, scope limitations, and rotation frequency is incomplete.

Default MOLT_LAB_URL is documented as http://localhost:3000, but remote usage guidance doesn't explicitly require HTTPS. Users deploying to production could accidentally use unencrypted HTTP.

The skill recommends storing MoltLab context in plaintext memory files including API keys, slugs, and research notes. Memory files may not be encrypted and could be accessible to other agents or processes.

API rate limits and trust tier system are documented but guidance on hitting limits, recovery, and optimization is missing.

API credentials (api_key, user_id, username) are stored in plaintext at ~/.config/moltmarkets/credentials.json with no guidance on file permissions or encryption. The setup.js script validates the credentials but does not check or enforce secure file permissions.

The skill documents Kelly criterion but provides no mechanism to validate whether edge estimates are actually accurate. Users or agents could systematically overestimate edge, making full-Kelly betting catastrophic. The code example checks edge >= 0.10 but doesn't validate that the yourProb estimate is well-calibrated against historical outcomes.

The learning loop documentation states "Two consecutive wins → restore full multiplier" but the cron job doesn't enforce this explicitly. Categories could remain in reduced mode indefinitely after short loss streaks if recovery logic isn't implemented correctly.

Documentation thoroughly explains how to CREATE cron jobs but provides zero guidance on how to DISABLE, PAUSE, or REMOVE them. Users deploying three agents have no documented way to stop autonomous trading if needed.

The trader agent posts comments with irreverent, edgy humor designed to engage other traders. This personality style could be weaponized for coordinated trading or pump-and-dump schemes. No transparency requirement that comments are AI-generated.

While documentation recommends checking for duplicate markets before creation, the check is performed in a manual curl command within prose, not enforced as agent logic. If this API call fails or is skipped, agent can create duplicate markets.

Code does not enforce HTTPS protocol for API communications. If N8N_BASE_URL is set to HTTP, credentials and workflow data are transmitted unencrypted.

API reference documentation is confusing about N8N_BASE_URL requirements. Shows 'Default: ${N8N_BASE_URL}$/api/v1' which doesn't clarify this is required and how to format it.

Documentation recommends storing N8N_API_KEY in shell configuration files without adequately warning about security implications. Secrets can be exposed through shell history, world-readable files, and have no encryption.

Documentation lacks guidance on handling sensitive data in workflow executions. The execute_workflow method accepts arbitrary JSON data but doesn't warn about PII, execution visibility, logging, or API scope implications.

The skill documentation does not include critical security guidance for the MATON_API_KEY. Users are instructed to store the API key as an environment variable, but there is no documentation about secure storage practices, API key rotation, revocation procedures, shell history exposure risks, or least-privilege principles.

The skill documentation extensively documents how to manage Notion connections through Maton.ai's control plane, but does not document critical security aspects of OAuth token management including token expiration, refresh mechanisms, permission scopes, or revocation procedures.

The skill documentation lacks any guidance on data privacy, retention, compliance implications, or third-party data processing when using different engines (OpenAI API, ChatGPT, Gemini, Claude). Users have no visibility into data retention policies, model training usage, or legal compliance requirements (GDPR, HIPAA, PCI-DSS).

API mode automatically activates when OPENAI_API_KEY environment variable is set, without explicit per-run confirmation. Documentation states 'API runs require explicit user consent' but implementation uses implicit environment variable detection.

Sessions are stored in ~/.oracle/sessions/ but documentation provides no guidance on file permissions, encryption, or protection of sensitive session data (which may include authentication tokens, conversation history with secrets, etc.).

Remote browser mode allows delegating browser automation to another machine via --remote-host and --remote-token. The token is passed as CLI argument (visible in ps/history) without adequate security guidance.

While glob expansion and symlink prevention are documented, there is no explicit documentation that path traversal attempts (e.g., --file '../../../etc/passwd') or absolute paths are prevented.

No documentation of OAuth scopes or permissions granted when connecting to Todoist. Users approve credentials without understanding full access scope

No verification mechanism or security claims about Maton gateway. Missing documentation of security practices, certifications, or compliance

Documentation shows plaintext API key usage without security best practices for storing or protecting credentials

No privacy warning or disclosure about data exposure through the gateway, especially in LLM contexts

Missing OAuth scope and permission documentation. The skill does not specify what OAuth scopes are required when users authorize a Xero connection through Maton, preventing informed consent.

All OAuth token management and API proxying is centralized through Maton gateway infrastructure (gateway.maton.ai and ctrl.maton.ai). This creates a single point of failure and requires complete trust in Maton's security practices.

Financial data access without risk disclosure. The skill enables access to highly sensitive financial data (invoices, payments, bank transactions, reports) without warnings or best practices.

No typosquatting security warning despite documented malicious package campaign. Over 900 malicious packages were distributed on PyPI including 'yfinnace' (vs legitimate 'yfinance') that install browser extensions to steal cryptocurrency wallet addresses via clipboard manipulation. Financial data users are high-value targets.

No source code repository link provided. Users cannot audit the actual 'yf' script implementation, verify code provenance, or check for updates from original author. Particularly concerning given the missing executable in YHFIN-001.

Documentation does not explain what OAuth scopes are required or what permissions users grant when authorizing a Zoho People connection. Line 550 mentions "additional OAuth scopes" for attendance/leave but provides no details. Users cannot understand or implement principle of least privilege for their connections.

The skill accesses highly sensitive PII (employee records, attendance, leave) through a third-party gateway (Maton.ai). The documentation provides ZERO privacy policy references, data retention information, or compliance guidance. Users have no disclosure that their HR data passes through Maton.ai's infrastructure or compliance implications.

The skill provides connection management examples but lacks documentation on OAuth token scope, storage, encryption, rotation practices, and Maton's security certifications.

All requests route through gateway.maton.ai with user OAuth tokens automatically injected. Documentation doesn't explicitly explain the trust model or data visibility implications.

No documentation exists regarding data retention, logging, privacy policy, compliance certifications, or how recruitment data is handled by Maton's servers.

The NAS metadata scraper component claims to scan NAS directories and collect file names, metadata, and structure in read-only mode. However, the skill provides no technical specification for scope validation, access control, or user confirmation mechanisms.

The skill enables powerful autonomous capabilities but lacks critical security documentation for safe operation: no warnings about autonomous risks, no guidance on safe vs. dangerous tasks, no approval workflow documentation, no audit logging or accountability documentation for autonomous actions, no discussion of multi-agent coordination risks.

The task queue system relies on "Ready" status for autonomous execution but provides no mechanism for per-task approval, capability-based restrictions, human review gates for sensitive operations, automatic holds for financial/destructive operations, or clear flagging of which items require human action vs. resource availability.

Pre-written cron job examples schedule autonomous work without documenting need for explicit user opt-in, how to disable jobs, risks of overnight/off-hours execution (3 AM runs), token accumulation without real-time visibility, or interaction with subscription rate limits. Normalizes autonomous work during hours when users are not monitoring.

Skill recommends agent coordination through Discord without documenting audit logging, message retention, or accountability mechanisms. Multi-agent systems could coordinate autonomous actions without persistent records, making decision chains difficult to trace.

The skill provides powerful automation capabilities (JavaScript execution, cookie manipulation, proxy configuration) but lacks a dedicated SECURITY.md or security section warning users about the implications and best practices.

Documentation shows example of including proxy credentials in environment variable URLs, which is a credential management anti-pattern that increases exposure risk.

Template recommends using environment variables for credentials but doesn't document that env vars are visible to other processes and may leak via error messages.

The video recording feature can capture passwords, API keys, and PII but documentation includes no privacy warning or guidance on secure handling of recorded videos.

Documentation advises not committing state files but doesn't specify file permissions or encryption for state files containing unencrypted authentication tokens.

Skill documentation lacks critical security guidance for users handling private keys and cryptocurrency credentials. No SECURITY.md file documents best practices for credential storage, wallet security, file permissions, or financial risk disclosure.

The Airtable skill relies on Maton.ai as a centralized OAuth token management service. The documentation fails to address critical security considerations including: 1. No token scope documentation - does not explain what OAuth scopes are requested 2. No security best practices section - missing credential security and account isolation guidance 3. No data sensitivity warnings - fails to warn about sensitive business data risk 4. No token rotation guidance - missing documentation on token revocation procedures 5. No compliance guidance - no information about GDPR, HIPAA, SOC2 implications

The Airtable skill documentation lacks warnings about data sensitivity and privacy implications. Airtable bases typically contain sensitive information including: - Customer data (PII: names, emails, phone numbers, addresses) - Financial information (pricing, revenue, costs, budgets) - Internal business processes and workflows - HR data (employee records, compensation, performance reviews) - Healthcare information The documentation does not warn users that all data passes through Maton's gateway, creating potential exposure for sensitive business and customer data.

The skill documentation does not specify what OAuth scopes or API permissions Maton.ai requests from Apollo.io. Users cannot verify least-privilege principle or understand data exposure scope.

Apollo.io handles personally identifiable information (PII) about prospects and employees. Documentation provides no warnings about data sensitivity, compliance implications (GDPR, CCPA, HIPAA), or data residency concerns.

The Base URL section describes the proxy mechanism but does NOT clearly explain the fundamental trust model: Maton.ai holds and manages Apollo OAuth tokens, creating a single point of failure.

While the skill documents HOW to manage connections (list, create, get, delete), it provides no guidance on RECOMMENDED PRACTICES for token rotation, auditing, or compromise response.

The downloadFile() function downloads images from arbitrary URLs without file size validation, enabling resource exhaustion or SSRF attacks.

Uses Runtime.evaluate to execute arbitrary JavaScript in browser context. While necessary for CDP automation, potential injection vectors exist if user inputs are not properly validated.

Stores Twitter/X authentication sessions in persistent Chrome profile directory without security documentation or file permission guidance.

Uses OS-level keystroke injection via osascript, xdotool, and PowerShell to bypass X's synthetic event detection. Requires system accessibility permissions.

CSS selectors are passed as template literals to Runtime.evaluate without validation, creating potential injection vectors if selectors become user-controlled.

The bird CLI tool automatically extracts X/Twitter authentication cookies from Safari, Chrome, and Firefox browser databases without requiring password input. This provides direct access to user's active X/Twitter session credentials.

The bird tool relies on X/Twitter's private, undocumented GraphQL endpoints that are subject to change without notice. This creates reliability and potential security risks as X could modify rate limits, implement stricter bot detection, or change authentication requirements.

The skill requires installation via a custom Homebrew tap (steipete/tap/bird) rather than official package registries. While the developer is reputable, this requires users to trust a third-party distribution channel.

Uses fake browser User-Agent headers to impersonate Google Chrome when scraping web pages, bypassing bot detection systems.

Documentation does not disclose how user search queries and content are transmitted. Users may not realize queries are sent directly to Brave and content fetched directly from target websites with no privacy protection.

No rate limiting or request throttling. With --content flag, fetches multiple URLs in rapid succession which could overwhelm servers or trigger anti-bot measures.

The skill exposes the ability to install arbitrary system packages via dnf, which is a powerful and privileged capability. The skill documentation fails to include critical security guidance about package verification, supply chain risks, and safe usage practices. Users may install malicious packages through supply chain attacks without understanding the risks.

The skill does not document the privilege requirements for package installation. dnf commands require sudo/root privileges. The skill documentation fails to explain this, the security implications, or how to scope this dangerous capability in multi-user environments.

The skill documents how to use Browsh with headless Firefox but provides no security warnings or guidance about Firefox's default sandbox configuration, data persistence, or security implications. Users are not informed about what security restrictions are in place or how to configure Firefox securely.

The skill provides no documentation about what happens to rendered page content when displayed in the terminal. Users are not warned that all page content is visible to AI agents, LLMs, and the Clawdbot system, creating potential privacy and security risks.

Documentation provides configuration example demonstrating plaintext password storage using password.fetch = ["command", "cat", "~/.config/vdirsyncer/icloud_password"]. While this is a supported vdirsyncer method, it results in credentials stored in plaintext on the filesystem with standard file permissions, vulnerable to any process or attacker with read access to the user's home directory.

Skill provides comprehensive functional documentation but completely omits security considerations. No discussion of calendar data sensitivity, credential protection, local data security, file permissions, or privacy implications. Users are not informed that calendar data is stored locally in plaintext or how to protect it.

The skill integrates with three major calendar providers (Google Calendar, Apple Calendar, Outlook Calendar) requiring OAuth authentication, but provides no security documentation on how OAuth tokens are stored, what scopes are required, credential rotation practices, or revocation procedures.

The skill accesses highly sensitive personal information (meeting titles, attendee emails, locations, scheduling patterns, recurring events) but provides no privacy disclosure about what calendar data passes through the LLM context window, whether event details are logged, or if attendee PII is shared with LLM providers.

While this specific skill contains no malicious code, it operates within the OpenClaw ecosystem which has documented systemic credential security issues: (1) Snyk found 283/3984 skills (7.1%) with credential exposure flaws, (2) 341 malicious ClawHub skills found stealing data, (3) CVE-2026-25253 RCE vulnerability allowing auth token theft. The calendar skill stores OAuth tokens in the same credential store (~/.openclaw/openclaw.json) that malicious skills target.

The skill lists both read and write operations but doesn't specify minimum required OAuth scopes for each calendar provider, whether read-only mode is supported, if event deletion requires additional permissions, or whether 'calendar sync' grants cross-provider access. Users may grant full read-write access when read-only would suffice.

The skill lacks any warning about the sensitive nature of calendar data. Users are not informed that calendar events often contain PII, health information, financial data, or business-critical scheduling details that pass through Maton.ai's infrastructure.

While the skill documents how to delete connections, it provides no guidance on auditing active connections, token rotation schedules, security incident response, or verification that deletion fully revokes access.

The skill provides no guidance on GDPR, HIPAA, SOC2, or other compliance/security certifications. Users cannot assess whether routing calendar data through Maton complies with their organization's policies.

The skill briefly mentions the proxy architecture but doesn't adequately explain the trust implications. Users may not understand they're trusting Maton with access to their Calendly account - a single point of failure for all calendar access.

Script contains hardcoded Telegram chat ID (5259918241), which appears to be the skill creator's personal Telegram ID. This prevents reuse by other users and creates privacy leak if distributed - notifications would be sent to original creator instead of user.

While credentials correctly retrieved from system keychain (secure approach), full credential JSON loaded into bash variable where it remains in memory. Attackers with shell access could extract credentials via process listing, shell history with debugging enabled, or memory dumps.

Session reminder creates self-scheduling cron jobs. Each invocation attempts to remove previous job and create new one. Risk of race conditions, job ID extraction failures, orphaned jobs accumulating, and difficult manual cleanup for users.

The skill.md documentation provides detailed technical usage information but completely lacks security and privacy guidance. Users implementing this skill are not informed about: - Privacy implications of voice communication - Security considerations when bridging to agents - Authentication/authorization assumptions - Data retention expectations - Rate limiting on the WebSocket server - Proper credential handling for agent responses

The --url argument allows users to override the default WebSocket URL without any validation. While primarily intended for legitimate configuration (different servers), this creates a SSRF (Server-Side Request Forgery) risk where malicious or misconfigured URLs could cause the skill to connect to unintended endpoints.

The run_agent() function passes user-supplied voice input to a shell command via shlex.quote(). While shlex.quote() provides protection against shell escaping, this approach is less safe than direct subprocess execution with argument arrays. The defense-in-depth security principle recommends avoiding shell entirely.

Missing OpenClaw security vulnerability context. The skill provides comprehensive installation and configuration instructions for the ClawGuard plugin but does not acknowledge or document the recent critical vulnerability in OpenClaw (CVE-2026-25253) that allows one-click RCE via authentication token exfiltration. Users installing this plugin should be aware of the underlying platform's security landscape.

Insufficient credential security documentation. The skill's gateway authentication section addresses token mismatches but provides minimal guidance on secure credential management, storage, and rotation practices. Users are instructed to check environment variables and configuration files but lack guidance on protecting these credentials.

Skill lacks comprehensive security documentation for database operations. Supports multiple database types and powerful operations (backup/restore, schema management, data export) but provides minimal security guidance.

Usage examples show direct query execution without documented input validation or SQL injection prevention guidance.

No credential management documentation despite supporting multiple database systems requiring authentication.

Advertises powerful operations (backup/restore, schema management) that can result in data loss but lacks adequate safety documentation.

The skill documentation mentions that it uses 'the bot token configured for Clawdbot' but provides no guidance on secure token storage, required OAuth2 scopes, token rotation procedures, or what to do if a token is compromised. Users may store tokens insecurely or grant excessive permissions without understanding security implications.

The skill provides a 'permissions' action to check bot permissions but does not document minimum required Discord permissions for each action group or provide guidance on permission scoping. Users may grant 'Administrator' permissions when narrower scopes would suffice, violating least-privilege security principles.

The skill provides moderation actions (timeout, kick, ban) that are disabled by default but lack security warnings about abuse potential, audit logging requirements, reversibility considerations, rate limiting implications, or Discord ToS compliance for automated moderation.

The skill makes Discord API calls through Clawdbot's built-in tool but provides no documentation on Discord API rate limits, consequences of exceeding limits, or best practices for bulk operations. Users implementing automated workflows may inadvertently exceed rate limits.

The skill provides actions to read message content, search messages, and access user information, but there is no privacy disclosure about what data is accessed, how long it's retained, whether it's logged, or compliance implications (GDPR, user consent for automated processing).

No authentication or credential handling documentation despite supporting Gmail, Outlook, and IMAP/SMTP email access

No data privacy disclosure for email content processing, logging, or retention

Bulk operations capability advertised without security warnings about mass email manipulation

No rate limiting or API usage warnings for Gmail/Outlook APIs or IMAP/SMTP connections

IP addresses extracted from fail2ban are passed to curl without validation. While fail2ban validates IPs, manual script invocation could pass malformed input.

API authentication uses custom 'Key' header instead of standard Authorization header. While officially supported by AbuseIPDB, custom headers are more likely to be logged by proxies and monitoring systems.

API responses and error messages are logged to /var/log/abuseipdb-reports.log without redaction. Error messages could reveal API key validity or rate limiting status.

Batch reporting has only 1-second delay between API calls. Free tier allows 1000 reports/day; a server with 1000+ banned IPs could exhaust daily quota on first run.

Installation script modifies /etc/fail2ban/jail.local using sed without validation or backup. Complex regex could fail silently or produce malformed config.

Credential fallback chain (env var → pass password manager → error) is not documented for users. Behavior differs from explicit documentation.

The harvest command constructs JavaScript by directly embedding user-provided CSS selectors. Only single quotes are escaped, which is insufficient to prevent JavaScript injection.

Local storage tool uses string formatting to construct JavaScript with user-provided keys and values. Only quote escaping is present, insufficient for all contexts.

SKILL.md documentation lacks critical security information about powerful capabilities like cookies, localStorage, JavaScript evaluation, and screenshot functionality.

Tools like click, input, hover accept user-provided CSS selectors directly without validation for length, format, or injection attempts.

The login command saves browser session data (cookies) to plaintext JSON files without encryption or file permission management.

The skill lacks a dedicated section explaining the centralized OAuth gateway model. Users are not informed that all Fathom OAuth tokens are stored on Maton.ai's servers, creating a single point of failure for all connected accounts.

The skill does not specify what OAuth scopes Maton requests from Fathom API. Users cannot determine whether the gateway requests minimal permissions or excessive access.

The skill does not document the sensitivity of data stored in Fathom or privacy implications of routing meeting recordings and transcripts through Maton.ai's infrastructure.

While the skill documents how to create and delete connections, it provides minimal guidance on token rotation, revocation procedures, and auditing active connections for security monitoring.

The skill provides no information about Maton.ai's security certifications, compliance status, data retention policies, or incident response procedures.

Sensitive Feishu API tokens are cached in JSON file without file permission restrictions, making them potentially readable by other users on multi-user systems

Dependency on @larksuiteoapi/node-sdk 1.58.0 which includes known high-severity vulnerabilities in transitive axios dependency (SSRF, CSRF)

Missing privacy and data handling documentation for API transmissions to Google Gemini service. Users not informed about data retention, logging, or compliance implications.

Missing API credential security documentation and --api-key CLI parameter exposes keys to shell history.

Hard dependency on Google's preview Gemini API with no fallback mechanisms or documentation of API behavior, web search scope, or SLA.

Raw API error responses printed to stderr without filtering, potentially exposing sensitive information about API internals.

Fallback services (ifconfig.me, icanhazip.com) lack explicit HTTPS protocol, defaulting to insecure HTTP

External API endpoint (ipinfo.io) accessed without explicit SSL certificate verification; curl -s flag suppresses error output

No privacy disclosure in skill documentation about data being sent to external services (myip.ipip.net, ifconfig.me, icanhazip.com, ipinfo.io)

Flawed timeout error detection logic that only checks for exit codes 28 and -1; other failures not handled; errors redirected to /dev/null preventing visibility

The skill documents MATON_API_KEY setup but provides no guidance on secure storage, rotation, or protection. Users following the examples directly (export MATON_API_KEY="...") will have the key logged in shell history. No credential rotation schedule documented. No compromise response procedures documented. Missing multi-user system isolation warnings.

Gmail contains the most sensitive user data: personal communications, financial information, health details, legal documents, identity information. The skill transmits all this data through Maton.ai infrastructure but provides ZERO privacy documentation. Missing disclosures about: - Data transmission through Maton.ai - Data retention policies - Compliance implications (HIPAA, GDPR, CCPA, PCI-DSS) - Recommendation for sensitive vs. non-sensitive use

The skill documents several powerful, destructive operations (Send, Delete, Trash, Modify) but treats them identically to read-only operations with no safety warnings or reversibility notes. Missing rate limiting guidance (10 req/sec documented but not explained). Missing prompt injection warnings for autonomous agents. Missing confirmation/undo mechanisms.

Missing OAuth scope documentation. Skill does not specify what Google Ads API scopes are requested during OAuth authorization, preventing users from evaluating whether permissions are appropriate or overly broad.

No privacy disclosure or data handling documentation. Skill provides access to sensitive Google Ads data (campaigns, keywords, performance metrics, financial data) without documenting how Maton.ai handles this data, data retention policies, or compliance certifications.

No credential security guidance. While documenting MATON_API_KEY setup, skill provides no guidance on secure storage (avoiding shell history), rotation schedule, or compromise response procedures.

No service trustworthiness documentation. Users asked to trust Maton.ai with full Google Ads account access without ability to verify company legitimacy, security certifications, or compliance status.

Destructive operations lack safety warnings. While skill emphasizes read operations, Google Ads API supports mutations (campaign creation/modification, keyword updates) which should include explicit irreversibility warnings.

The skill documentation does not include guidance on OAuth token security, scope implications, token lifecycle, or best practices for credential management. Users are directed to store GOOGLE_CLIENT_SECRET and GOOGLE_REFRESH_TOKEN without understanding the security implications of long-lived refresh tokens, account compromise risks, or token revocation procedures.

The refresh_token.py script writes GOOGLE_ACCESS_TOKEN to ~/.config/google-calendar/secrets.env in plaintext without setting restrictive file permissions (mode 0o600). File is created with default umask permissions (typically 0o644), allowing any user on the system to read the access token.

The skill lacks documentation warning users that calendar event data (titles, descriptions, locations, attendee lists, timestamps) will be exposed to the LLM system. Calendar events often contain highly sensitive personal information (health appointments, financial data, family details, confidential business discussions). Users are not warned to be cautious about event contents when using this skill with AI assistants.

Users are not informed that this skill uses an OAuth gateway where Maton.ai stores their Google OAuth tokens and routes all requests through Maton servers. This is fundamentally different from direct API access. Users cannot understand the security model, trust implications, or how this differs from alternatives.

Calendar data is sensitive personal information (health appointments, financial meetings, legal proceedings, scheduling patterns). The skill provides zero guidance on data flows through Maton.ai, compliance implications (HIPAA, GDPR, CCPA), or safe vs. unsafe use cases. Users could unknowingly violate regulations.

Documentation shows environment variable usage without security guidance. Users may expose MATON_API_KEY via shell history, fail to rotate regularly, or improperly store credentials. No compromise response procedures documented.

Skill documents DELETE operations without warnings about irreversibility or best practices. Calendar events are permanently deleted and not recoverable via API. Autonomous agents could unknowingly delete important events.

Users are asked to trust Maton.ai infrastructure with Google OAuth tokens and calendar data, but skill provides no way to verify this trust. No security certifications, company background, incident response policy, or vendor legitimacy information provided.

Code examples demonstrate patterns that may expose credentials in shell history and process listings. While the urllib pattern itself is safe from injection, examples show direct environment variable usage in multi-line commands that will be stored in shell history with credentials visible. Documentation mentions piping issues at line 316-317 but frames as functional concern rather than security risk.

Troubleshooting section recommends echoing MATON_API_KEY to stdout to verify it's set. This is dangerous because credentials are printed in plaintext, output can be logged/retained, and users may share terminal sessions containing output.

The skill integrates with Google OAuth through Maton.ai's managed gateway but lacks critical security documentation about OAuth token scope, credential handling practices, and the security model of the centralized gateway architecture. Users cannot assess security implications or make informed decisions about credential management.

Missing OAuth scope documentation. Users cannot assess whether permissions are appropriately scoped or overly broad. The skill provides comprehensive API documentation but never specifies what Google Sheets API scopes are being requested during OAuth authorization.

No privacy and data handling disclosure. All spreadsheet data flows through Maton.ai infrastructure without user awareness. Users may not understand that Maton.ai servers can read the content of their spreadsheets, metadata, and operational patterns.

Missing architecture explanation. The skill briefly mentions 'gateway proxies requests' but fails to explain the fundamental architectural difference between direct API access and OAuth gateway access. Users may not understand they're trading direct Google Sheets API access for managed OAuth through Maton.ai.

Missing credential security guidance. The skill documents setting MATON_API_KEY environment variable but provides no security guidance on protecting this credential. Users could expose the key in shell history, version control, or deployment scripts.

No service trustworthiness documentation. Skill asks users to trust Maton.ai with their Google Sheets access and spreadsheet data but provides no information about Maton.ai's security posture, certifications, incident response capability, or trustworthiness.

Destructive operations lack warnings. Skill documents operations that can delete or clear spreadsheet data (:clear, deleteSheet) but provides no warnings about data loss, irreversibility, or safe deletion patterns.

Session tokens in documentation could be exposed. Documentation shows OAuth session tokens in URL parameters (?session_token=...) which could be exposed in shell history, browser history, proxy logs, or server access logs.

Missing compliance implications documentation. Skill provides no guidance on compliance implications for different types of spreadsheet data. Users may unknowingly violate HIPAA, GDPR, CCPA, or SOX regulations.

The documentation mentions credentials are stored in ~/.config/google-workspace-mcp/ but does not warn users that these are likely stored in plaintext or with minimal encryption. This directory is readable by the user and potentially by other processes/users on shared systems. No guidance is provided on file permissions, encryption, or secure credential storage practices. The security implications of storing OAuth tokens on disk are not documented.

The skill documentation lists 49 tools across 8 Google Workspace products but does not provide security context for what these operations can do, their potential impact, or guidance on safe usage. Dangerous operations like gmail.send, calendar.deleteEvent, and gmail.modify are listed without warnings about their capabilities or risks.

Critical security documentation gaps around OAuth credential handling. No warnings about plaintext .env storage, file permissions, shell history exposure, or what permissions users are granting.

Insufficient input validation and error handling. Site URLs not validated, dimension parameters accept any input without validation, API errors provide minimal context, no rate limiting warnings.

No documentation of Google Search Console API rate limits, quotas, or quota exhaustion handling. Critical operational concern for production systems.

Insufficient explanation of OAuth scope permissions and what users are granting access to. No documentation distinguishing readonly vs write scopes or explaining capabilities.

Email content fetched by skill contains sensitive PII (financial, health, personal information) and is passed to AI/LLM systems via Clawdbot without explicit privacy warnings or data handling documentation.

User-provided mailbox names passed directly to IMAP operations without validation, potentially allowing mailbox traversal or injection attacks.

Skill lacks dedicated SECURITY.md file documenting credential handling, privacy implications, access control, known limitations, and security configuration requirements.

Interactive setup script prompts for password but creates .env file without setting restrictive permissions or clearing password from memory.

The downloadAttachments function uses attachment filenames directly from email headers without validation. A malicious email with specially crafted attachment names like "../../sensitive.txt" could potentially write files outside the intended directory, though path.join() provides some mitigation.

The security notes section is minimal and doesn't adequately warn users about the risks of plaintext credential storage. While .env files are recommended, the documentation fails to address critical exposure vectors like shell history, file permissions, and backup security.

The search command accepts user-provided filters (--from, --subject, etc.) that are passed to IMAP without documentation of special syntax or limitations. While IMAP protocol itself prevents injection, users may misunderstand query syntax and get unexpected results.

Skill documentation describes features and usage examples but provides no actual implementation code. Despite 928 downloads suggesting user expectations for working code, the skill directory contains only markdown and metadata files. This creates a supply chain gap where users must search externally for implementation, potentially finding malicious forks, typosquatted packages, or credential harvesting code.

Skill documents how to set INSTAGRAM_ACCESS_TOKEN environment variable but provides zero security guidance. Missing critical information: where token is stored, file permissions, what token grants access to, revocation procedures, compromise detection, shared system risks, shell history exposure, AI agent implications. This mirrors pattern found in Bluesky skill - technically secure implementation is undermined by missing user-facing security documentation.

Skill claims to support posting, story management, insights, comments, follower analytics, and hashtag research but provides no documentation of required API version, scopes, or permissions. Users may grant unnecessary permissions (violates least-privilege principle). Different features require different scopes: instagram_basic (read), instagram_manage_messages (messages), catalog_management (shops), ads_management (ads). Without scope documentation, users grant maximum permissions, increasing compromise impact.

Skill makes no privacy disclosure about implications when used with AI agents or LLMs. Commands like "Show my Instagram insights" or "List recent comments" expose sensitive data to AI systems: follower names, engagement patterns, comment content, audience demographics, post analytics. Users are not warned that AI systems store this data, may use for training, and expose data to third parties (AI company, infrastructure). This is especially concerning for personal/business accounts where followers expect privacy.

The documentation does not explain what OAuth scopes or Jira API permissions Maton.ai requests on behalf of users. This prevents users from assessing whether the gateway requests minimal necessary permissions (least-privilege principle).

The skill documentation does not warn users about the sensitive nature of data stored in Jira projects or the implications of routing that data through a third-party gateway infrastructure.

The documentation delegates all Jira OAuth token management to Maton.ai but provides no information to help users verify that Maton is trustworthy with this access.

The documentation does not provide security best practices for storing and managing the MATON_API_KEY environment variable, which is as sensitive as a cloud provider API key.

The skill documentation provides examples of destructive operations (issue deletion, project modification, workflow transitions) without warnings about irreversibility or recovery procedures. This is problematic for autonomous agents.

The skill provides no documentation of what OAuth scopes are requested from JotForm when creating a connection through Maton. Users cannot verify that the gateway is requesting minimal-privilege access. This prevents users from assessing whether permissions are appropriate and aligned with least-privilege principles.

The skill handles form submissions which often contain sensitive personal or health information (emails, phone numbers, addresses, health conditions, financial data, etc.). No documentation warns users about routing sensitive data through Maton's infrastructure or provides privacy guidance. This creates compliance risk for users handling regulated data.

No documentation of Maton's security certifications, compliance status (SOC2, ISO 27001), security audit results, or incident response procedures. Users cannot assess whether Maton meets their regulatory requirements for data handling.

While connection management endpoints are documented, there is no guidance on token rotation schedules, revocation procedures, or auditing active connections for security purposes. Users cannot manage the lifecycle of their JotForm connections securely.

The skill requires LINEAR_API_KEY but provides no guidance on secure credential storage, rotation, or environment variable handling. Users may expose credentials in shell history or plaintext files.

Teams cache stored in /tmp with predictable naming based on API key checksum. On multi-user systems, /tmp may be world-readable, exposing team metadata.

The skill lacks comprehensive security documentation explaining credential handling, API key exposure risks, and best practices for users. While the code itself is secure, users may not understand the security implications of configuring and deploying this skill.

The Google Places API key is transmitted in plaintext via HTTP headers (X-Goog-Api-Key) to the Google API. While this is how Google requires the key to be sent, there is no documentation warning users about this exposure vector.

The development server documentation shows --host 0.0.0.0 which makes the server accessible from any network interface. While acceptable for development, documentation doesn't emphasize security implications and inconsistency between files could cause misconfiguration.

Environment variable credential handling documented but no security best practices provided. No guidance on token rotation, secure storage mechanisms, multi-user isolation, or revocation procedures.

No privacy disclosure about what Excel data is transmitted to Maton.ai, data retention policies, compliance implications, or data protection standards. Excel spreadsheets frequently contain sensitive personal, financial, and healthcare data requiring compliance documentation.

Skill documents destructive operations (delete worksheets, delete rows, clear ranges) that permanently delete data without explicit warnings or confirmation mechanisms.

Skill has no documentation about OAuth scopes, privacy implications, credential security, or best practices. Users cannot understand what permissions they're granting or the risks of email/calendar access.

OAuth credentials are stored in plaintext files in ~/.outlook-mcp/ with 0600 file permissions. While file permissions are secure and this is standard for OAuth CLI tools, credentials are not encrypted and could be stolen if system is compromised.

Setup requests multiple OAuth scopes without documentation about why each is needed or what permissions they grant. Users cannot assess the risk or privacy implications.

Email and folder deletion operations are permanent and irreversible, but lack warnings or confirmation prompts. Users could accidentally destroy important data or operations could destroy evidence if credentials compromised.

Setup creates long-lived OAuth credentials (2-year client secret) without documentation about token expiration, rotation schedules, or how to revoke compromised credentials.

No OAuth scope or permission documentation. Users are not informed what Microsoft Graph API scopes are being requested when creating Outlook connections.

No privacy disclosure about data transmission. Documentation does not explain that all Outlook data (emails, calendar events, contacts) flows through Maton's infrastructure.

OAuth session tokens shown in URL query parameters in documentation examples.

No credential security guidance provided. Documentation shows how to set MATON_API_KEY but provides no guidance on secure storage, rotation, or best practices.

Powerful destructive capabilities (delete messages, delete events, delete contacts, delete folders) lack any warnings or guidance on safe usage.

No information provided about Maton's security practices, infrastructure, certifications, or trustworthiness. Users asked to trust Maton with full Outlook account access without verification capability.

Calendar access exposes sensitive PII (health, financial, legal information in event titles/attendees) without privacy warnings or compliance guidance.

No guidance on secure credential management, database user privilege separation, or access control best practices. Users need documentation on principle of least privilege and credential rotation.

Skill mentions backup and schema management but provides minimal guidance on irreversibility of destructive operations or backup verification procedures.

Skill shows SQL query execution examples without guidance on parameterized queries, input validation, or SQL injection prevention. Users constructing dynamic SQL may be vulnerable.

The skill documentation fails to disclose the fundamental architectural difference between direct Salesforce API access and the Maton.ai OAuth gateway model. Users are not informed that their Salesforce OAuth token is stored and managed by Maton.ai infrastructure, not stored locally. This represents a critical trust boundary that must be explicitly documented.

The documentation provides the credential requirement but lacks critical security guidance for protecting the MATON_API_KEY environment variable. While code examples use Python (safer than shell), users may be tempted to follow simpler patterns that expose credentials in shell history.

The documentation lacks any disclosure about what CRM data flows through Maton.ai infrastructure and provides no guidance on compliance implications. Salesforce customers often manage sensitive data (healthcare information, financial records, EU resident data) that triggers regulatory requirements.

The skill description does not clearly state that it requires Maton.ai. Users browsing the skill may not understand upfront that this is a gateway skill with a third-party dependency. This is critical information that should be in the primary description, not buried in documentation.

The skill documentation completely lacks security and privacy information about data transmission, collection, retention, and handling. Users cannot make informed decisions about privacy implications or understand what happens to their search queries.

The skill references 'the bot token configured for Clawdbot' but provides no guidance on how to securely manage this token, where it should be stored, or how to rotate it if compromised.

The skill does not document which Slack OAuth scopes (permissions) are required for each action. This can lead users to grant overly broad permissions to the bot token.

No guidance on restricting bot access to specific channels or implementing channel-level access controls. The skill appears to allow operations on any channel the bot has access to.

The skill enables powerful capabilities (message editing, deletion, member information access) without warning users about the security and audit implications.

The skill provides comprehensive API documentation but lacks a dedicated Security or Privacy section. Users are not warned about the sensitive nature of Slack data or security implications when using this skill with AI assistants that may process and retain message content.

The authentication section explains how to use the Maton API key but does not document what OAuth scopes the Slack connection requires or what permissions are granted to the Maton.ai Slack app. Users cannot assess whether they're granting appropriate permissions or understand the scope of access granted.

Connection management documentation shows how to create, list, and delete connections, but provides no guidance on token lifecycle, credential rotation schedules, or emergency revocation procedures. Users lack best practices for maintaining credential security over time.

The skill does not document which Stripe API scopes are requested or what permissions the OAuth connection grants. Users cannot assess whether permissions are appropriately scoped under least-privilege principles.

The skill does not disclose that all Stripe API requests flow through Maton.ai infrastructure. Financial transaction data, customer information, payment details, and business metrics are visible to Maton.ai without privacy policy references or data handling documentation.

Users are expected to trust Maton.ai with full Stripe account access without any documentation of Maton's security posture, incident response policies, company background, or verification mechanisms.

The skill documents subscription cancellations, invoice modifications, payment refunds and other destructive operations without explicit warnings about irreversibility, revenue impact, audit trail recommendations, or safe usage patterns.

The skill references MATON_API_KEY environment variable but does not provide security best practices for credential storage, rotation, compromise response, or warnings about shell history exposure.

The skill provides access to sensitive financial information (customer data, payment details, subscription history, balance information) without privacy warnings about data sensitivity, regulatory implications, or exposure risks if Maton is compromised.

The skill documents rate limiting (10 req/sec) but provides no user-facing guidance on implications, backoff strategies, bulk operation handling, or what the limit means for different use cases.

The skill documentation mentions setting THINGS_AUTH_TOKEN as an environment variable for write operations but provides no security guidance on protecting this credential. Shell history, log files, and process listings can expose this token.

The skill requires Full Disk Access permission on macOS, which is an extremely broad privilege. This is mentioned briefly in setup but the implications are not explained.

The skill manages personal task management data which often contains sensitive information (health appointments, financial notes, personal goals, family matters, confidential work projects). However, there is no privacy documentation explaining data handling when the skill is used by AI/LLMs or how this data might be exposed.

The skill accepts user-provided strings for task titles, notes, and other fields and passes them through the Things URL scheme. The documentation provides no guidance on whether special characters are safely handled.

Multiple scripts use hardcoded `/root/clawd/` paths instead of environment variables or relative paths. This creates environmental assumptions that may not hold in all deployment contexts and reduces portability.

Shell variables are substituted directly into Python code executed via `python3 -c`. While variables are currently sourced from environment or script parameters, this pattern becomes dangerous if user input is introduced.

File creation code does not validate paths thoroughly. While current implementation uses system-generated dates, the pattern could be exploited in future versions if any component allows user-controlled file paths.