The Agent Skills Directory

[DATA_EXFILTRATION]: Authentication tokens are passed via URL query parameters in the implementation templates.
Evidence: The skill instructs developers to implement a "Cookie bootstrap middleware" in src/index.ts that reads a token from req.query.myapp_cookie and recommends agents navigate to https://your-domain.com?myapp_cookie=<cookie_value>.
Impact: While the code attempts to redirect to a clean URL to prevent the token from remaining in the browser's address bar, the token will still be recorded in plain text in server access logs, load balancer logs, and proxy logs. It may also be leaked via Referer headers if external resources are requested by the browser during the authentication flow.

clawdirect-dev