T03 · Remote Payload Retrieval and Execution
Error
- Location
tools/postiz-setup.md:32- Finding
Unverified Remote Script Is Downloaded and Executed Directly
- Content
View full analysis
- Remediation
View remediation
Security audit
Social Media Engine
Security checks for vulnerabilities and agentic risk
Overview
This skill has a legitimate social-media scheduling purpose, but it can unexpectedly publish live posts and uses risky credential and setup patterns.
Install only if you are comfortable giving the agent credentials that can access and post through your social accounts. Use test accounts or least-privilege keys, store secrets carefully, always pass --draft unless you truly want live publishing, avoid remote HTTP Postiz URLs, and do not run the Docker curl-to-sh setup command without independently reviewing Docker's official installation guidance.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/post-scheduler.js:75- Finding
Postiz API Credentials May Be Transmitted over Plaintext HTTP
- Content
View full analysis
{ const parsed = new URL(url); const transport = parsed.protocol === 'https:' ? https : http; const req = transport.request(url, { method: options.method || 'GET', headers: options.headers || {}, }, (res) => { let data = ''; res.on('data', chunk => { data += chunk; }); res.on('end', () => { try { resolve({ status: res.statusCode, body: JSON.parse(data), raw: data }); } catch { resolve({ status: res.statusCode, body: data, raw: data }); } }); }); req.on('error', reject); if (body) req.write(typeof body === 'string' ? body : JSON.stringify(body)); req.end(); }); } ``` ```js async getIntegrations(key, base) { const r = await request(`${base}/api/public/v1/integrations`, { headers: { Authorization: key }, }); ``` The same request mechanism is used by other authenticated Postiz operations, including creating and listing posts. ### Technical Analysis `POSTIZ_BASE_URL` is accepted without enforcing the HTTPS scheme. The generic request helper explicitly selects Node's plaintext `http` transport whenever the URL does not use `https:`. Postiz requests then attach the API key to the `Authorization` header. If a user configures a remote `http://` Postiz URL, t ...[truncated 1559 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/post-scheduler.js:342- Finding
Documented Draft-by-Default Protection Conflicts with Immediate Publication Behavior
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/post-scheduler.js:40- Finding
Scheduler Loads Unrelated Secrets from the Agent-Wide OpenClaw Environment File
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (32)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The skill explicitly declares filesystem access to read a local .env file for credentials, creating a path for credential exposure if the skill or its supporting scripts are compromised, overly permissive, or prompted to reveal configuration data. Combining local secret access with network permissions materially increases risk because stolen API keys could be exfiltrated or abused to control connected social accounts.
- Content
md - POSTIZ_BASE_URL # Required if using Postiz (your instance URL) permissions: - network: Calls Buffer GraphQL API or Postiz API to schedule and retrieve posts - filesystem: Reads .env for credentials, writes scheduled post logs to working directory source: url: https://github.com/Batsirai/carson-skills author: Carson Jarvis (@CarsonJarvisAI)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The security note normalizes loading API keys from a local .env file, reinforcing a design where the skill can access plaintext credentials from disk. Even though the file says no credentials are embedded and drafts require approval, local secret access remains dangerous because any prompt injection, script bug, or logging mistake could disclose or misuse the keys.
- Content
md github: https://github.com/Batsirai/carson-skills verified: true security: note: API keys are loaded from environment variables or a local .env file. No credentials are embedded in the skill or scripts. All posts are created as DRAFTS by default — human approval required before publishing. --- # Social Media Agent
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/post-scheduler.js --status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/post-scheduler.js --status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/post-scheduler.js --status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/post-scheduler.js --status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/post-scheduler.js --status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/post-scheduler.js --status
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/post-scheduler.js --status
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js function info(msg){ log('ℹ️ ' + msg); } function getEnv() { // Try loading .env from project root or parent directories const envPaths = [ path.join(__dirname, '..', '.env'), path.join(process.cwd(), '.env'),
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md function info(msg){ log('ℹ️ ' + msg); } function getEnv() { // Try loading .env from project root or parent directories const envPaths = [ path.join(__dirname, '..', '.env'), path.join(process.cwd(), '.env'),
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js function getEnv() { // Try loading .env from project root or parent directories const envPaths = [ path.join(__dirname, '..', '.env'), path.join(process.cwd(), '.env'), path.join(process.env.HOME || '', '.openclaw', '.env'), ];
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 72% confidence
- Finding
The script implicitly loads credentials and endpoint configuration from ~/.openclaw/.env, then uses those secrets to make authenticated network requests. In a skill/execution context, hidden cross-project credential discovery increases the blast radius because running this script can silently reuse unrelated user secrets and act on external accounts without explicit consent for this invocation.
- Content
js // Try loading .env from project root or parent directories const envPaths = [ path.join(__dirname, '..', '.env'), path.join(process.cwd(), '.env'), path.join(process.env.HOME || '', '.openclaw', '.env'), ]; for (const p of envPaths) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The loop accepts the first discovered .env file from several locations and trusts its contents, including POSTIZ_BASE_URL. In a hostile or untrusted workspace, an attacker-controlled .env can redirect authenticated requests to an arbitrary HTTP/HTTPS server, causing API keys to be sent in Authorization headers to attacker infrastructure.
- Content
js const envPaths = [ path.join(__dirname, '..', '.env'), path.join(process.cwd(), '.env'), path.join(process.env.HOME || '', '.openclaw', '.env'), ]; for (const p of envPaths) { if (fs.existsSync(p)) {
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The
| shchaining pattern removes any opportunity for inspection between download and execution, making compromise of the fetched script immediately exploitable. In a setup guide for server deployment, this is especially dangerous because users may run it as root on internet-exposed infrastructure.- Content
If not installed:
bash # Ubuntu/Debian curl -fsSL https://get.docker.com | sh
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
cd postiz-app
Copy the example env file
cp .env.example .env
text Edit `.env` with your values:
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 86% confidence
- Finding
Documenting a parameterized DELETE operation without guardrails can enable misuse in agentic or scripted contexts, especially when an ID is selected dynamically. The danger is accidental or unauthorized deletion of content if the parameter source is wrong, stale, or attacker-influenced.
- Content
Delete a Post
text DELETE /posts/:idbash
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README encourages users to configure live social-media publishing credentials and use a script that can schedule or draft posts, but it does not prominently warn that this grants an agent the ability to publish to real accounts or expose account-linked data and analytics. In an agent-skill context, this is dangerous because users may treat the setup as low risk and enable unattended actions against public brand accounts without approval gates, dry-run defaults, or credential-scope guidance.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger includes generic phrases like "what should I post this week" and "wants a calendar," which could match ordinary brainstorming requests rather than explicit invocation of this scheduling/planning skill. The file does not provide exclusion conditions or narrower activation constraints to distinguish when the skill should activate versus when the user is just asking for advice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The phrase "write a post about X" is common everyday language and can easily overlap with unrelated writing assistance requests. Because no negative examples or contextual boundaries are provided, the activation condition is ambiguous and may cause unintended invocation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions tell users to export or store a Buffer API key but do not state that it is a sensitive secret that must not be committed, logged, or shared. This omission can lead to credential exposure, allowing unauthorized posting, channel enumeration, or account abuse through the connected Buffer workspace.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide includes a 'post immediately' example that can cause an agent or user to publish live content to connected public social accounts without any explicit warning or confirmation step. In the context of an agent skill, this increases the risk of unintended public posting, reputational harm, or abuse if the command is invoked with unreviewed content.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text ```bash curl -s -X POST 'https://api.buffer.com' \ -H 'Content-Type: application/json' \ -H 'Authorization: Bearer YOUR_API_KEY' \ -d '{"query": "{ account { organizations { id channels { id name service } } } }"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
|
shareNext| Post next in queue | |customScheduled| Schedule for specific time (requiresdueAt) |Full curl example:
bash curl -s -X POST 'https://api.buffer.com' \ -H 'Content-Type: application/json' \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guide tells users to 'check the database for the verification link' if SMTP is not configured, which normalizes direct database inspection of authentication data without any safety guidance. That can expose sensitive tokens, user records, or lead operators to use over-privileged access paths outside normal app workflows.
- Content
Static analysis
No suspicious patterns detected.