Social Trend Report

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:36 PM UTC
• Version: 0.1.0

Overview

This skill does useful trend-reporting work, but its helper script and automation instructions create review-worthy risks around local code execution, persistent scheduled activity, and Twitter/X session-cookie handling.

Install only if you are comfortable reviewing and controlling the script and automation yourself. Avoid running collect.sh with untrusted config files or unchecked social-media content, pin and isolate any Twitter/X CLI dependency, use least-privilege credentials, and do not enable cron, HEARTBEAT.md monitoring, or Discord notifications until schedule, destination, lifetime, and removal steps are explicit.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T06 · System Persistence

Warning

• Location: SKILL.md:108
• Finding: Recurring OpenClaw Task Creates Cross-Session System Persistence## Vulnerability Details **File Location**: `SKILL.md`, lines 108-119 **Vulnerability Type**: Scheduled agent task persistence **Risk Level**: Medium **Vulnerable Code**: ```bash openclaw cron add \ --name "Weekly Trend Report" \ --schedule "0 10 * * 1" \ --timezone "America/New_York" \ --task "Read skills/social-trend-report/SKILL.md and generate this week's trend report using config.json. Save to reports/ and announce in Discord." \ --model sonnet ``` ### Technical Analysis The documented setup installs a recurring OpenClaw task that survives the original skill session. Every week, the task loads the skill, reads workspace configuration, accesses external services, writes reports, and potentially publishes information to Discord. Although the behavior is documented and requires the user to execute the command, it establishes persistent automated execution without specifying a lifetime, restricted execution permissions, an approved Discord destination, or a removal procedure. This is a persistence risk because the scheduled agent continues operating after the initiating interaction has ended. ### Attack Path 1. A user follows the automation instructions and runs the supplied `openclaw cron add` command. 2. OpenClaw creates a recurring task that remains active across sessions. 3. On each schedule, the task reads `SKILL.md` and `config.json`. 4. The task performs network collection and writes generated reports. 5. If Discord announcement capabilities are configured, report information is transmitted to the configured channel. 6. Execution continues until the user independently discovers and removes the scheduled task. ### Impact Assessment The task executes with the privileges and tool access assigned to the OpenClaw environment. It may repeatedly consume API quotas, access workspace configuration, create files, make network requests, and publish report contents externally. The finding does not dem ...[truncated 115 chars]
• Remediation: ## Remediation Suggestions - Do not install recurring tasks as part of default setup. - Require explicit, informed confirmation before creating the schedule. - Display the exact schedule, tools, files, network destinations, and Discord channel before installation. - Apply least-privilege restrictions to the scheduled agent and limit it to approved files and domains. - Require confirmation before publishing report contents to Discord. - Add an expiration date or maximum execution count. - Document a precise command for listing, disabling, and deleting the task. - Prefer a one-shot report-generation command unless persistent automation is explicitly requested.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/collect.sh:17
• Finding: Python Source Injection Through Configuration-Derived Shell Interpolation## Vulnerability Details **File Location**: `scripts/collect.sh`, lines 17-18 and 68-73 **Vulnerability Type**: Code injection through unsafe generation of Python source **Risk Level**: High **Vulnerable Code**: ```bash NICHE=$(python3 -c "import json; print(json.load(open('$CONFIG'))['niche'])") OUTPUT_DIR=$(python3 -c "import json; print(json.load(open('$CONFIG')).get('output',{}).get('dir','reports'))") ``` ```bash python3 -c " import json data = { 'date': '$DATE', 'niche': '$NICHE', 'reddit': json.loads('''$REDDIT_DATA''') if '''$REDDIT_DATA''' != '[]' else [], 'twitter_keywords': '$KEYWORDS'.split() } with open('$OUTFILE', 'w') as f: json.dump(data, f, indent=2) " ``` ### Technical Analysis The script constructs Python source code inside shell-quoted `python3 -c` arguments and directly embeds values derived from the command-line configuration path and the parsed configuration file. The first two commands interpolate `$CONFIG` into a single-quoted Python string. A crafted configuration filename containing a single quote and additional Python syntax can terminate that string and inject Python statements. The final command embeds `$NICHE`, `$REDDIT_DATA`, `$KEYWORDS`, and `$OUTFILE` directly into Python literals. In particular, a malicious `niche` or output directory value can break out of its surrounding Python string. Because the resulting text is interpreted as Python source rather than data, injected statements execute with the privileges of the user running `collect.sh`. Reddit and Twitter response data are also assembled manually into JSON and then embedded in a triple-quoted Python literal. Quotes, backslashes, control characters, or triple-quote sequences in external content can corrupt parsing or potentially alter the generated source. Escaping only double quotes with `sed` is not sufficient for safe JSON or Python serialization. ### Attack Path One direct exploitatio ...[truncated 1166 chars]
• Remediation: ## Remediation Suggestions - Never construct Python source by interpolating shell variables. - Replace the multiple `python3 -c` fragments with a standalone Python script that accepts the configuration path through `sys.argv`. - Open and parse the configuration file entirely within Python. - Pass runtime values as command-line arguments or environment variables, treating them strictly as data. - Generate the complete output structure with Python objects and serialize it using `json.dump`. - Do not manually concatenate JSON strings in shell. - Parse network responses as JSON and reject malformed responses before including them in output. - Validate `niche`, subreddit names, timeframes, limits, keywords, and output paths against explicit schemas. - Restrict output to an approved base directory by resolving the path and verifying that it remains beneath that directory. - Add tests containing single quotes, triple quotes, backslashes, newlines, shell metacharacters, and malformed remote data.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20
• Finding: Unpinned Globally Installed Dependency Receives Twitter Authentication Cookies## Vulnerability Details **File Location**: `SKILL.md`, lines 20-21 **Vulnerability Type**: Unpinned third-party dependency with access to sensitive credentials **Risk Level**: Medium **Vulnerable Code**: ```markdown - `bird` CLI for Twitter/X data (install: `npm i -g @anthropic/bird`) - Requires Twitter auth cookies: `AUTH_TOKEN` and `CT0` env vars ``` ### Technical Analysis The instructions install a mutable npm package globally without an exact version or integrity constraint. The subsequently executed CLI receives Twitter authentication cookies through the `AUTH_TOKEN` and `CT0` environment variables. A global npm installation may execute package lifecycle scripts and places executable code into a shared environment. Because no version is pinned, future installations may resolve to code different from the version originally reviewed. If the package, maintainer account, release pipeline, or registry distribution is compromised, malicious package code could access the authentication-cookie environment variables when the CLI is invoked. This finding does not establish that the named package is currently malicious. It identifies an avoidable supply-chain exposure caused by mutable resolution, global installation, and credential-bearing execution. ### Attack Path 1. A user follows the prerequisite instructions and runs the unpinned global npm installation. 2. npm resolves the package version available at installation time. 3. A compromised or unexpectedly changed release executes installation code or installs a malicious CLI. 4. The user configures `AUTH_TOKEN` and `CT0` and runs `bird search`. 5. Malicious dependency code reads the environment variables and transmits or abuses the Twitter session credentials. ### Impact Assessment A compromised dependency could execute code with the installing or invoking user's privileges. It could access environment variables, local files available to that user, and reusable T ...[truncated 272 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to a reviewed exact version. - Use a lockfile and verify package integrity hashes. - Avoid global installation; install the dependency in an isolated project environment or container. - Disable package lifecycle scripts during installation where operationally possible. - Document the expected package publisher, version, checksum, and verification procedure. - Run the CLI with a minimal environment containing only required variables. - Prefer narrowly scoped API credentials over reusable browser-session cookies where the platform supports them. - Regularly rotate credentials and revoke them immediately if dependency compromise is suspected. - Review dependency updates before deployment rather than automatically resolving the latest release.

T02 · Agent Memory Poisoning

Note

• Location: SKILL.md:123
• Finding: Heartbeat Instructions Introduce Persistent Agent Behavior## Vulnerability Details **File Location**: `SKILL.md`, lines 123-128 **Vulnerability Type**: Persistent modification of agent heartbeat state **Risk Level**: Low **Vulnerable Code**: ```markdown ### Hotspot Alert Mode For time-sensitive trend detection, add to your HEARTBEAT.md: ```markdown - Check if any monitored subreddit has a post with 500+ upvotes in last 24h - If yes, generate a hotspot alert card and notify ``` ``` ### Technical Analysis The skill directs the user to add durable behavioral instructions to `HEARTBEAT.md`. Once added, these instructions can affect future agent activity beyond the session in which the skill was initially used. They cause recurring external checks and may trigger notifications. The behavior is disclosed and aligned with the skill's trend-monitoring purpose, so there is no evidence of covert poisoning or unrelated malicious instructions. Nevertheless, it modifies persistent agent state without specifying scope, duration, approved notification destinations, resource limits, or removal instructions. ### Attack Path 1. A user copies the supplied instructions into `HEARTBEAT.md`. 2. Future heartbeat cycles load and follow the persistent instructions. 3. The agent repeatedly checks monitored subreddits. 4. When the threshold is met, the agent creates an alert and invokes a notification mechanism. 5. The behavior continues across sessions until the persistent instructions are removed. ### Impact Assessment The persistent rule can cause repeated network access, ongoing API or compute consumption, and unsolicited notifications. Its effective privileges are limited to the tools and destinations available to the heartbeat agent. The reviewed instruction does not request credential access, privilege escalation, or unrelated data collection.
• Remediation: ## Remediation Suggestions - Require explicit confirmation before modifying `HEARTBEAT.md`. - Clearly identify the change as persistent and explain that it affects future sessions. - Scope the rule to this specific skill and to an explicit list of subreddits. - Require an approved notification destination and confirmation before sending external messages. - Add frequency limits, execution budgets, and an expiration date. - Provide exact instructions for disabling and removing the heartbeat rule. - Prefer a dedicated, revocable monitoring job rather than modifying general-purpose agent memory.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents an end-to-end trend monitoring and report generation skill spanning Reddit, Twitter/X, and YouTube, with AI-produced structured reports and actionable insights. The supplied code is much narrower: it is explicitly a 'Data Collection Helper' that reads niche settings, fetches Reddit JSON and Twitter/X search output, and writes a raw data file. There is no YouTube integration at all, no report generation logic, no AI analysis, no competitor analysis, and no weekly scheduling behavior. While collecting Reddit and Twitter/X data is consistent with part of the description, the primary delivered behavior of this code chunk is only partial raw-data collection, making the description materially broader than the actual implementation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs use of shell commands, cron scheduling, file creation, and Discord announcement, but it does not declare explicit tool scope or permissions. That makes the operational boundary unclear and increases the chance an agent invokes file-write or shell capabilities more broadly than the user expected.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill advertises very broad trigger phrases like 'weekly report', 'monitor trends', and 'competitive analysis', which can cause it to activate in many common contexts without strong user intent. Over-broad routing is risky here because the skill can lead to external data access, file creation, automation setup, and possible outbound posting.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

--name "Weekly Trend Report" \
  --schedule "0 10 * * 1" \
  --timezone "America/New_York" \
  --task "Read skills/social-trend-report/SKILL.md and generate this week's trend report using config.json. Save to reports/ and announce in Discord." \
  --model sonnet
```

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The cron example directs the agent to save reports and announce in Discord without an explicit warning or confirmation step. Silent file writes and especially external posting can leak sensitive business research, publish inaccurate content, or create unintended recurring actions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script fetches data from Reddit via curl and queries Twitter/X via the bird CLI, then saves combined results to a local JSON file. Although progress is printed, there is no explicit user-facing warning that data will be transmitted to third-party services and persisted on disk, which is a safety-relevant behavior for a collection helper.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The sample configuration hard-codes `"lang": "en"`, which imposes a specific language setting without indicating that it is optional or user-selectable. This can violate language/locale policy expectations when the skill is presented as working for any niche or industry.