meegle-mcp
Fail
Audited by Snyk on Feb 16, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). The prompt includes explicit examples that inline user keys (JSON env fields and a URL with mcpKey/userKey) and instructs adding them to OpenClaw/MCP config, so an agent performing those config or mcporter steps would need to insert secret values verbatim into generated files/commands (high exfiltration risk).
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). The skill's scripts/mcp-proxy.js forwards JSON-RPC requests to the external Meegle MCP endpoint (MEEGLE_MCP_URL, e.g. https://project.larksuite.com/mcp_server/v1) and returns Meegle workspace data (tasks, comments, project details) that the agent will read and act on, which is untrusted user-generated third-party content.
Audit Metadata