ClawHub
Back to skill

Security audit

Openclaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent PostHero integration, but it gives an agent immediate public-posting and deletion authority without explicit confirmation guidance.

Review this before installing if the agent may be shared or automated. Only use a PostHero API key you can revoke, confirm exactly which social accounts it can access, and require your agent to show the post content, target accounts, scheduled time, and action type before publishing, updating, or deleting anything.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill enables immediate publishing and later describes destructive management actions without requiring any explicit confirmation, preview, or user-consent checkpoint. In a conversational agent, this creates a real risk of accidental or prompt-induced posting/deletion on public social media accounts, which can cause reputational and operational harm even if the API usage itself is legitimate.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
---

### DELETE /posts/:id

Delete a post from PostHero. Works for any status (draft, scheduled, published). Does NOT remove it from the social media platform.
Confidence
94% confidence
Finding
The skill exposes a destructive DELETE operation that works on drafts, scheduled posts, and published records, but provides no guardrails such as confirmation, ownership revalidation guidance, or safe-handling constraints in the conversational workflow. In an agent setting, this is vulnerable to accidental invocation, ambiguous user requests, or prompt-injection-driven tool abuse that can remove records and disrupt publishing workflows.

Static analysis

No suspicious patterns detected.