ClawHub
Back to skill

Security audit

Social0

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Social0 posting helper, but it should be reviewed because it runs unpinned npm tools and can place a live API key in persistent MCP configuration.

Review before installing. Prefer hosted MCP OAuth or a preinstalled, reviewed Social0 CLI/MCP version; avoid unpinned `npx` in sensitive workspaces. Do not commit or share MCP config containing `SOCIAL0_API_KEY`, restrict its permissions, and revoke/rotate the key if exposed. Confirm accounts and content carefully before publishing or deleting posts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:61
Finding

Unpinned npm Packages Are Downloaded and Executed

Content
View full analysis
Remediation
View remediation
npx --yes @social0/mcp@ ``` 2. Replace placeholders with an exact version only after verifying the release; do not use version ranges or tags such as `latest`. 3. For managed deployments, use a lockfile and `npm ci` to obtain deterministic dependency resolution. 4. Verify package provenance, publisher identity, release signatures where available, and registry integrity metadata before execution. 5. Disable or review npm lifecycle scripts when they are not required. 6. Avoid global installation where possible. Execute the dependency in a constrained environment with only the minimum required filesystem, network, and credential access. 7. Establish an update process in which new versions are audited before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:100
Finding

Persistent MCP Configuration Encourages Plaintext API-Key Storage

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users/agents to execute npx social0 without pinning a specific package version or integrity hash. This creates a supply-chain risk: a newly published malicious or compromised package version could be fetched and executed at runtime with the agent's privileges, potentially exposing local files, environment variables, or credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This reference again tells the agent to rely on npx social0 without version pinning. Unpinned runtime installation allows upstream package changes to alter behavior unexpectedly or introduce malicious code execution during install/startup.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

Authorization: Bearer <SOCIAL0_API_KEY>

text

Base URL: `https://api.social0.app/v1`  
Interactive docs: [api.social0.app/docs](https://api.social0.app/docs)

## CLI commands (preferred)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

Authorization: Bearer <SOCIAL0_API_KEY>

text

Base URL: `https://api.social0.app/v1`  
Interactive docs: [api.social0.app/docs](https://api.social0.app/docs)

## CLI commands (preferred)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.

Authorization: Bearer <SOCIAL0_API_KEY>

text

Base URL: `https://api.social0.app/v1`  
Interactive docs: [api.social0.app/docs](https://api.social0.app/docs)

## CLI commands (preferred)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

Authorization: Bearer <SOCIAL0_API_KEY>

text

Base URL: `https://api.social0.app/v1`  
Interactive docs: [api.social0.app/docs](https://api.social0.app/docs)

## CLI commands (preferred)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The workflow guidance prefers npx social0 as a fallback, but does not constrain the version. In an agent setting, this increases the blast radius because the fetched code may run automatically in a shell-enabled environment and can access the user's workspace and secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The skill recommends npx -y @social0/mcp for a local MCP server without pinning the package version. Because MCP servers can process sensitive user requests and may receive secrets via environment variables, fetching the latest package at runtime is a significant supply-chain risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.