auth-token-manager
Warn
Audited by Gen Agent Trust Hub on Jun 9, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill contains a hardcoded default password ('123456789MikoPBX#1') used for authentication in SKILL.md, README.md, and get-auth-token.sh. Although documented as a default for local development, hardcoded credentials represent a security risk.
- [COMMAND_EXECUTION]: The script get-auth-token.sh automatically applies the '--insecure' flag to curl commands when an HTTPS URL is detected, which disables SSL/TLS certificate verification and exposes the connection to Man-in-the-Middle (MitM) attacks.
- [COMMAND_EXECUTION]: The script uses shell execution (curl) and 'python3 -c' for data processing, including transmitting credentials and parsing JSON responses from a network endpoint.
Audit Metadata