ClawHub
Back to skill

Security audit

Openclaw

Security checks for vulnerabilities and agentic risk

Overview

PostHero is a coherent social media API skill, but it enables live publishing and deletion of post records without documented confirmation steps.

Install only if you intend to let an agent manage connected PostHero social accounts. Before publishing or deleting, ask the agent to summarize the exact post text, target platforms/accounts, schedule, and affected post ID, then require a clear confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The skill exposes a destructive action (DELETE /posts/:id) that can remove drafts, scheduled posts, and published-post records from PostHero without any documented confirmation, guardrails, or ownership-verification workflow at the agent layer. In a natural-language interface, this raises the risk of unintended or manipulated deletion requests, especially because deletion applies across all statuses and may disrupt publishing workflows or auditability.

Content

Scanner excerpt · SKILL.md (reported line 366)May include surrounding context.

md
---

### DELETE /posts/:id

Delete a post from PostHero. Works for any status (draft, scheduled, published). Does NOT remove it from the social media platform.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

List all connected social media accounts. Always call this first before creating posts.

bash
curl -H "Authorization: Bearer $POSTHERO_API_KEY" \
  https://server.posthero.ai/api/v1/accounts

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill supports immediate live posting via publishNow: true and /posts/:id/publish but does not require an explicit confirmation or warning before taking an irreversible external action on behalf of the user. In a conversational setting, ambiguity, prompt injection, or misunderstood intent could cause unintended public posts across connected social accounts.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md
**Request body:**

| Field             | Type    | Required | Description                                                                                                                                                 |
| ----------------- | ------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `text`            | string  | Yes      | The post content                                                                                                                                            |
| `platforms`       | array   | Yes      | Array of `{ platform, accountId }` objects                                                                                                                  |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
| Field             | Type    | Required | Description                                                                                                                                                 |
| ----------------- | ------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `text`            | string  | Yes      | The post content                                                                                                                                            |
| `platforms`       | array   | Yes      | Array of `{ platform, accountId }` objects                                                                                                                  |
| `schedule`        | string  | No       | ISO 8601 UTC datetime. Omit for draft                                                                                                                       |
| `publishNow`      | boolean | No       | Set `true` to publish immediately                                                                                                                           |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md
| Field             | Type    | Required | Description                                                                                                                                                 |
| ----------------- | ------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `text`            | string  | Yes      | The post content                                                                                                                                            |
| `platforms`       | array   | Yes      | Array of `{ platform, accountId }` objects                                                                                                                  |
| `schedule`        | string  | No       | ISO 8601 UTC datetime. Omit for draft                                                                                                                       |
| `publishNow`      | boolean | No       | Set `true` to publish immediately                                                                                                                           |
| `isThread`        | boolean | No       | Informational only. Threading is auto-detected per platform from `\n\n\n` (triple newline) separators in each platform's text — you don't need to set this. |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md
| ----------------- | ------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `text`            | string  | Yes      | The post content                                                                                                                                            |
| `platforms`       | array   | Yes      | Array of `{ platform, accountId }` objects                                                                                                                  |
| `schedule`        | string  | No       | ISO 8601 UTC datetime. Omit for draft                                                                                                                       |
| `publishNow`      | boolean | No       | Set `true` to publish immediately                                                                                                                           |
| `isThread`        | boolean | No       | Informational only. Threading is auto-detected per platform from `\n\n\n` (triple newline) separators in each platform's text — you don't need to set this. |
| `platformContent` | object  | No       | Per-platform text overrides (see below)                                                                                                                     |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
| `text`            | string  | Yes      | The post content                                                                                                                                            |
| `platforms`       | array   | Yes      | Array of `{ platform, accountId }` objects                                                                                                                  |
| `schedule`        | string  | No       | ISO 8601 UTC datetime. Omit for draft                                                                                                                       |
| `publishNow`      | boolean | No       | Set `true` to publish immediately                                                                                                                           |
| `isThread`        | boolean | No       | Informational only. Threading is auto-detected per platform from `\n\n\n` (triple newline) separators in each platform's text — you don't need to set this. |
| `platformContent` | object  | No       | Per-platform text overrides (see below)                                                                                                                     |
| `media`           | object  | No       | Media attachments (see below)                                                                                                                               |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md
| `schedule`        | string  | No       | ISO 8601 UTC datetime. Omit for draft                                                                                                                       |
| `publishNow`      | boolean | No       | Set `true` to publish immediately                                                                                                                           |
| `isThread`        | boolean | No       | Informational only. Threading is auto-detected per platform from `\n\n\n` (triple newline) separators in each platform's text — you don't need to set this. |
| `platformContent` | object  | No       | Per-platform text overrides (see below)                                                                                                                     |
| `media`           | object  | No       | Media attachments (see below)                                                                                                                               |
| `isAutoPlug`      | boolean | No       | LinkedIn-only. Schedule a chain of comments on the user's own LinkedIn post after publish (see Auto-plug below)                                             |
| `autoPlug`        | array   | No       | Comments to schedule when `isAutoPlug` is `true`. Each entry: `{ comment, delay, image? }`                                                                  |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md
| `publishNow`      | boolean | No       | Set `true` to publish immediately                                                                                                                           |
| `isThread`        | boolean | No       | Informational only. Threading is auto-detected per platform from `\n\n\n` (triple newline) separators in each platform's text — you don't need to set this. |
| `platformContent` | object  | No       | Per-platform text overrides (see below)                                                                                                                     |
| `media`           | object  | No       | Media attachments (see below)                                                                                                                               |
| `isAutoPlug`      | boolean | No       | LinkedIn-only. Schedule a chain of comments on the user's own LinkedIn post after publish (see Auto-plug below)                                             |
| `autoPlug`        | array   | No       | Comments to schedule when `isAutoPlug` is `true`. Each entry: `{ comment, delay, image? }`                                                                  |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

md
**Query parameters:**

| Param      | Description                                                                                       |
| ---------- | ------------------------------------------------------------------------------------------------- |
| `status`   | Filter: `draft`, `scheduled`, `published`, `failed`                                               |
| `platform` | Filter: `linkedin`, `twitter`, `instagram`, `facebook`, `youtube`, `tiktok`, `threads`, `bluesky` |

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

Get full details of a single post including per-platform publishing status, post IDs, and URLs.

bash
curl -H "Authorization: Bearer $POSTHERO_API_KEY" \
  https://server.posthero.ai/api/v1/posts/post_abc123

Static analysis

No suspicious patterns detected.