ClawHub
Back to skill

Security audit

LarrySkill

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed TikTok marketing automation workflow, but it asks for persistent API-driven social and revenue analytics access while storing sensitive keys and transaction data too loosely.

Review before installing. Use a separate working directory, do not commit tiktok-marketing/config.json or analytics snapshots, prefer environment variables or a secret manager for all API keys, and rotate any key that was stored in a shared file. Approve any browser research, npm install, sudo command, RevenueCat skill installation, Postiz posting, cross-posting, and daily scheduled job explicitly. If enabling RevenueCat, store only aggregate metrics or de-identified timestamps and set a retention/deletion policy for local reports and snapshots. Use a neutral Postiz signup URL if you do not want to use the author referral link.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:217
Finding

Hardcoded Affiliate Referral Steers Agent Onboarding Output

Content
View full analysis
"So here's the key piece — we need Postiz to handle posting and analytics. It's what lets me track every post's performance and tell you exactly which hooks are driving views and which to drop. Without it, we're guessing. With it, I can run a daily report that shows you what's working and automatically suggest better hooks." > > "This skill is free and open source. If you want to support its development, signing up through this link is appreciated: [postiz.pro/oliverhenry](https://postiz.pro/oliverhenry)" Walk them through connecting step by step: 1. **Sign up at [postiz.pro/oliverhenry](https://postiz.pro/oliverhenry)** — create an account ``` The same referral is also presented as a prerequisite at `SKILL.md:19`. ### Technical Analysis The Skill explicitly instructs the agent to incorporate an author-controlled referral URL into the onboarding conversation and to “frame it naturally.” The referral is not technically necessary for Postiz integration: the agent could direct the user to a neutral official service URL and still complete the declared posting and analytics workflow. This alters the agent’s otherwise neutral recommendation behavior for the commercial benefit of the Skill author. Although the text briefly says that use of the link supports development, it does not clearly identify the link as an affiliate or referral relationship, explain whether compensation is received, or give the user a neutral alternative. The behavior therefore constitutes instruction-level output steering rather than an implementation requirement. ### Attack Path 1. A user loads the Skill to configure TikTok marketing automation. 2. The agent follows the mandatory Postiz onboarding instructions in `SKILL.md`. 3. The agent presents the embedded `postiz.pro/oliverh ...[truncated 690 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/onboarding.js:43
Finding

Privileged API Credentials Are Stored in Plaintext Configuration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/daily-report.js:67
Finding

Complete RevenueCat Transaction Responses Are Persisted Without Data Minimization

Content
View full analysis
{ metricsMap[m.id] = m.value; }); } return { overview, transactions: transactions.items || [], mrr: metricsMap.mrr || 0, activeTrials: metricsMap.active_trials || 0, activeSubscribers: metricsMap.active_subscriptions || 0, activeUsers: metricsMap.active_users || 0, newCustomers: metricsMap.new_customers || 0, revenue: metricsMap.revenue || 0 }; ``` The returned object is then saved wholesale: ```javascript const rcSnapshotPath = path.join(baseDir, 'rc-snapshot.json'); if (fs.existsSync(rcSnapshotPath)) { rcPrevMetrics = JSON.parse(fs.readFileSync(rcSnapshotPath, 'utf-8')); } if (rcMetrics) { fs.writeFileSync(rcSnapshotPath, JSON.stringify({ date: dateStr, ...rcMetrics }, null, 2)); } ``` ### Technical Analysis The report fetches up to 100 transaction objects from RevenueCat and keeps the complete API response in `rcMetrics.transactions`. It also keeps the complete overview response. The entire object is serialized to `rc-snapshot.json`. However, the attribution implementation only needs aggregate metric values and transaction timestamps: ```javascript const txDate = new Date(tx.purchase_date || tx.created_at); ``` Persisting ...[truncated 1799 chars]
Remediation
View remediation
({ timestamp: tx.purchase_date || tx.created_at })); ``` 3. Prefer daily aggregate conversion counts where individual transaction records are unnecessary. 4. Remove customer identifiers, product identifiers, store metadata, and other unused fields before any disk write. 5. Write snapshots with mode `0600` and place them in a user-private data directory. 6. Define and enforce a short retention period; delete snapshots once the required comparison window expires. 7. Add a user-facing consent step that explains transaction-level processing and retention. 8. Ensure reports contain only aggregated values where possible. 9. Document the data flow and provide a command that securely deletes stored analytics snapshots. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:248
Finding

Third-Party Dependencies and Skills Are Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (44)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The code chunk implements only one narrow subtask: adding text overlays to six slideshow images. It processes local files, wraps text, positions it on images, and saves PNG outputs. It does not perform browser research, generate images, call any social/posting APIs, track analytics or conversions, or run any optimization/iteration loop. While text overlays are mentioned in the description, the declared purpose presents a broad end-to-end TikTok marketing automation system, which this code does not substantiate. Therefore the description materially overstates the actual behavior of this supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description presents a broad end-to-end TikTok marketing automation system, but the supplied code only handles a narrow analytics maintenance/reporting function. Specifically, it queries Postiz for TikTok posts, connects missing TikTok video IDs to those posts, retrieves engagement analytics, outputs summaries, and writes a local snapshot file. It does not perform competitor research, generate images, add overlays, create slideshows, publish posts, cross-post to other platforms, track conversions, or iterate content strategy. While analytics tracking is one declared sub-capability, the code chunk's actual primary purpose is much narrower than the declared skill description, so the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description promises an end-to-end TikTok marketing automation system with content generation, posting, cross-platform distribution, analytics, and feedback-loop optimization. The supplied code chunk does not implement those capabilities. Instead, it is a narrow file-management script for competitor research data: loading/saving JSON, adding a competitor entry, and printing summaries/gap analysis. While this fits a small supporting part of the declared competitor-research feature, the actual code's purpose is materially narrower than the declared purpose and lacks most of the advertised functionality. Therefore this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description describes a broad end-to-end TikTok marketing automation workflow. The supplied code chunk has a much narrower purpose: generating six raw image slides from prompts and saving them locally. While AI image generation is one subset of the declared functionality, the code does not implement the majority of the advertised capabilities, including research, posting, analytics, optimization, or conversion tracking. Therefore the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a comprehensive TikTok marketing automation system. The supplied code chunk only handles onboarding setup: creating folders/files and validating configuration completeness. While the config schema references concepts like Postiz, competitors, strategy, cross-posting, and RevenueCat, the script merely scaffolds and checks those settings; it does not execute the marketing workflow itself. This is a materially different and much narrower behavior than the declared primary purpose, so it is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a broad end-to-end TikTok marketing automation system with research, content generation, analytics, experimentation, and feedback-loop optimization. The supplied code only performs a narrow posting function: it reads six existing PNG files from a directory, uploads them to Postiz, creates a TikTok slideshow post with configurable privacy/title/caption, and writes a local meta.json file. This is a materially different and much smaller scope than declared. There are no undeclared dangerous capabilities apparent, but the description substantially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md
**Save the agreed prompt style to config as `imageGen.basePrompt`** so every future post uses it.

**Key prompt rules (explain these as they come up, don't lecture):**
- "iPhone photo" + "realistic lighting" = looks real, not AI-generated
- Lock architecture/layout in EVERY slide prompt or each slide looks like a different place
- Include everyday objects (mugs, remotes, magazines) for lived-in feel

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

md
Task: Run scripts/daily-report.js --config tiktok-marketing/config.json --days 3

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 686)May include surrounding context.

md
Task: Run scripts/daily-report.js --config tiktok-marketing/config.json --days 3

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill normalizes placing sensitive secrets such as OpenAI, Postiz, and RevenueCat API keys directly into a local JSON config file, without strong warnings about plaintext storage or leakage. If that file is committed, synced, logged, or read by other tools, attackers could hijack posting accounts, analytics, billing-linked services, and revenue data.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.

md
Use `scripts/generate-slides.js`:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 412)May include surrounding context.

md
Use `scripts/generate-slides.js`:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 628)May include surrounding context.

md
Use `scripts/check-analytics.js` to automate the connection:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 631)May include surrounding context.

md
Use `scripts/check-analytics.js` to automate the connection:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill clearly expects network-capable actions such as browsing TikTok/App Store, calling Postiz and OpenAI APIs, and pulling RevenueCat data, yet it declares no explicit tool scope or permissions. That creates an overbroad trust boundary where an agent may use whatever network tools are available, making review, sandboxing, and consent enforcement weaker.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The invocation description is broad enough to trigger on generic social media, growth, or app marketing conversations. Over-broad activation can cause the agent to initiate browser research, API setup, or credential collection in contexts where the user did not specifically request this skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the agent to research and install Node.js and native packages on the host, including build-tool dependencies. Host-level package installation expands the blast radius from a content-marketing workflow into system modification, increasing risk of supply-chain compromise, environment breakage, or unauthorized changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs installation of another skill via an external package manager, effectively chaining trust to a second package with its own permissions and code. That expands the local attack surface and creates a supply-chain risk not strictly necessary for the base skill's operation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill directs creation of a persistent daily cron job on the host. Persistence broadens impact well beyond a one-time marketing task: if misconfigured or later modified, it can repeatedly access APIs, process data, or exfiltrate information without renewed user intent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The workflow persistently stores and tracks multiple high-value API credentials as part of normal operation. Persistent local secret storage increases exposure through backups, shell history, process listings, accidental sharing, and compromise of the developer workstation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
88% confidence
Finding

The skill includes sudo apt-get install ... guidance for system-wide package installation. Even as documentation, recommending privileged host changes for a marketing workflow raises the chance that an agent or user executes broad root-level modifications, which can harm system integrity or introduce compromised packages.

Content

Scanner excerpt · SKILL.md (reported line 452)May include surrounding context.

md
>
> **Ubuntu/Debian:**
> ```bash
> sudo apt-get install build-essential libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev
> npm install canvas
> ```
>

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file instructs storing post-performance data and optionally correlating it with RevenueCat conversion events, but it does not include any explicit privacy notice, consent requirement, retention limit, or guidance on handling potentially sensitive analytics data. In a marketing automation skill, tying content performance to downstream conversions can create behavioral profiling and compliance risk if users implement it without understanding privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file explicitly instructs users to place a RevenueCat secret API key (sk_) into config.json, but provides no warning about secret management or exposure risks. Configuration files are commonly committed to source control or copied across environments, and compromise of this key would allow unauthorized access to subscriber and revenue data via the RevenueCat API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation recommends storing RevenueCat webhook event data in a local JSON file without any guidance on access controls, retention, minimization, or exclusion of customer identifiers. Even if the example shows limited fields, real webhook payloads commonly include customer and subscription metadata, so this pattern can lead to inadvertent collection and insecure storage of sensitive business and user data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/revenuecat-integration.md (reported line 27)May include surrounding context.

md
return null;
  }
  
  const RC_URL = 'https://api.revenuecat.com/v2';
  const headers = {
    'Authorization': `Bearer ${config.revenuecat.v2SecretKey}`,
    'Content-Type': 'application/json'

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/check-analytics.js:47