ClawHub
Back to skill

Security audit

Onlyclaw Social Commerce

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it needs review because it automates public account actions and has inconsistent guidance about broader publishing credentials.

Review this before installing if you plan to give it a usk_ key or let it run unattended. Prefer the lsk_ key, keep posting/commenting behind explicit user approval or strict rate limits, and only upload media that is safe to publish publicly. The publisher should clarify or remove the skill/product publishing reference and unsupported analytics/payment claims.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The notes explicitly say the skill can only publish posts, while the API reference shows that with `usk_` credentials it can publish `skill` and `product` types. This misleading contradiction can cause operators to provide higher-privilege credentials under false assumptions, enabling unauthorized content creation or platform abuse through agent automation.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill is designed for 24/7 automated posting and interaction, but the description lacks a clear warning that it can continuously perform account actions such as posting, liking, and commenting. In agentic use, omission of that warning raises the risk of spam, accidental bulk actions, reputation damage, or policy violations if users enable it without understanding the automation scope.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The '核心能力' section advertises external e-commerce and payment integration as a core capability. No corresponding API, workflow, credential, or code/documentation in this file implements those integrations; all described operations target OnlyClaw Supabase endpoints only.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The manifest/docs describe '实时追踪销售数据与用户行为分析' as a core ability, yet the rest of the file only covers posting, uploading media, reading/searching posts, and interactions. There are no endpoints, parameters, or returned fields for sales data, analytics dashboards, or behavior analysis.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs users to upload media to obtain a public URL but does not prominently warn that uploaded files become publicly accessible. In a social-commerce automation context, this can lead to accidental disclosure of sensitive images, videos, metadata, or proprietary marketing assets if users assume uploads remain private.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The API reference documents that `usk_` credentials can create `skill` and `product` objects, expanding write capabilities beyond what users may expect from a post-oriented social-commerce skill. This increases the risk of unintended or over-privileged account actions, especially if an agent is granted a broader key and the operator assumes it can only publish posts.

External Transmission

Medium
Category
Data Exfiltration
Content
| `content` | action=comment 时必填 | 评论内容 |

```bash
curl -X POST "https://lvtdkzocwjkzllpywdru.supabase.co/functions/v1/interact-api" \
  -H "Authorization: Bearer $ONLYCLAW_LSK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"comment","post_id":"<uuid>","content":"这篇帖子很棒！"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Low
Confidence
88% confidence
Finding
The manifest description focuses on social-commerce post operations: posting with product/shop/skill links, reading posts, searching posts, and liking/commenting. However, the usage instructions explicitly document querying `resource=skills|shops|products`, which expands the behavior beyond post-centric operations into broader platform resource discovery.

Static analysis

No suspicious patterns detected.