Tootbot

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:30 AM UTC
• Version: 0.5.0

Overview

The skill mostly does what it says, but it can publish public Mastodon content with an access token and its README recommends unpinned remote package execution.

Install only if you intend to let the agent post to Mastodon using your account token. Review every status, media attachment, visibility setting, and scheduled time before execution, and avoid the README's unpinned `bunx` commands unless you trust and pin the package version. Use a Mastodon token with the minimum posting permissions needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: README.md:11

Finding

Unpinned Remote Package Download and Execution

Content

View full analysis

Vulnerability Details

File Location: README.md:11 and README.md:28,63,70
Vulnerability Type: Unpinned third-party package execution
Risk Level: High

Vulnerable Code

bash

bunx clawdhub@latest install tootbot

bash

bunx @nutthead/tootbot '{"status": "Hello, Mastodon!"}' '{"status": "Goodby, Mastodon!"}'

The second command pattern is repeated in the usage examples at lines 63 and 70.

Technical Analysis

The documentation directs users to execute packages retrieved dynamically from a package registry through bunx. The installation command explicitly selects the mutable latest release, while the usage commands execute @nutthead/tootbot without an exact version or integrity constraint.

Consequently, the code executed by users is not necessarily the bundled and audited scripts/tootbot.js. A compromised maintainer account, malicious package update, registry compromise, or dependency takeover could replace the effective payload after this Skill has been reviewed. The downloaded package executes with the privileges of the invoking user and inherits the process environment, including the documented MASTODON_ACCESS_TOKEN.

Attack Path

1. An attacker compromises the registry package, its publisher account, or a transitive dependency.
2. The attacker publishes a malicious release and causes it to resolve as latest or as the default version selected by bunx.
3. A user follows the documented installation or usage command.
4. bunx downloads and executes the mutable remote package rather than relying exclusively on the locally reviewed script.
5. The malicious package inherits the user's environment and local execution privileges.
6. It can read the Mastodon access token, access files readable by the user, submit unauthorized Mastodon operations, or execute other arbitrary actions before or instead of the expected publishing operation.

Impact Assessment

Successfu ...[truncated 863 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest and unversioned package references with exact, reviewed versions.

2. Pin package integrity hashes or use a lockfile that records verified package artifacts and all transitive dependencies.

3. Prefer invoking the bundled implementation directly:

   bash

   bun {baseDir}/scripts/tootbot.js '{"status":"Hello, Mastodon!"}'
   

4. Ensure the published package is reproducibly built from the reviewed source and publish provenance or signed release attestations.

5. Add automated dependency and registry-package monitoring, including publisher-account protection and release verification.

6. Avoid exposing unrelated secrets to the process. Run the command with only the required Mastodon variables and, where practical, in a sandbox with restricted filesystem and network access.

7. Pin the ClawdHub installer to a reviewed version and verify the downloaded Skill artifact before execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

md

Set these environment variables:

- `MASTODON_URL` - Your Mastodon instance URL (e.g., `https://mastodon.social`)
- `MASTODON_ACCESS_TOKEN` - Your Mastodon access token

## Usage

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

md

Set these environment variables:

- `MASTODON_URL` - Your Mastodon instance URL (e.g., `https://mastodon.social`)
- `MASTODON_ACCESS_TOKEN` - Your Mastodon access token

## Usage

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

Set these environment variables:

- `MASTODON_URL` - Your Mastodon instance URL (e.g., `https://mastodon.social`)
- `MASTODON_ACCESS_TOKEN` - Your Mastodon access token

## Usage

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill publishes content to Mastodon. However, the provided code chunk contains bundled helper libraries and parsing utilities, not code that clearly authenticates to Mastodon, constructs a status, or sends a network request to a Mastodon endpoint. Even allowing for build artifacts, the actual visible behavior is materially different from the declared purpose and includes many unrelated capabilities. Therefore the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a mismatch because the declared description is narrowly 'Publish content to Mastodon' with triggers for posting a status, but the supplied code chunk is much broader in scope. While part of the code does implement Mastodon posting via $.v1.statuses.create(...) and media upload via $.v2.media.create(...), the chunk mostly consists of extensive unrelated bundled utilities and framework code for package.json fixing, CLI parsing, caching, schema/validation, serialization, and generic API dispatch. That means the actual code behavior is not accurately represented as a simple status-posting skill. Additionally, it supports posting with media attachments, which is a materially expanded capability beyond the minimal declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared purpose says this skill publishes content to Mastodon. However, the supplied code chunk contains generic schema/type validation code from a validation library, with classes/functions for strings, numbers, objects, arrays, URLs, emails, UUIDs, IPs, JWTs, and related parsing/checking behavior. There is no visible Mastodon API interaction, no network calls to a Mastodon server, no status construction/submission, and no trigger-specific posting logic. This is a material mismatch in primary purpose: the code shown supports validation infrastructure rather than publishing content to Mastodon.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README instructs the agent to publish user-provided content to Mastodon, including public, scheduled, direct, and media-backed posts, but does not warn that this sends data to an external third-party service and may be public, irreversible, or difficult to retract. In an agent-skill context, this omission is dangerous because an autonomous tool may post sensitive, mistaken, or user-unapproved content without an explicit confirmation boundary.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes a shell command, relies on environment variables, and is intended to make outbound network requests, but it does not declare any tool or permission scope. That omission weakens containment and review because an agent may grant broader execution than users expect, especially for a skill that can publish external content using credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill facilitates posting content to a public social platform but does not prominently warn that posts, media, visibility settings, and associated metadata may be exposed externally. In an agent setting, this increases the risk of accidental data leakage, unintended public posting, or misunderstanding of default visibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This script retrieves MASTODON_ACCESS_TOKEN via process.env and uses it to authenticate outbound API requests, but the visible user-facing section only shows usage examples and does not warn that credentials will be consumed from the environment. There are no comments, prompts, or logs disclosing this sensitive credential access before execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script sends user-provided status text and optional media to a remote Mastodon server, but the visible help text only describes input format and examples. There is no explicit disclosure that execution performs live network requests and publishes content to an external service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The request schema sets language to default to "en", which imposes a specific language/locale when the user does not provide one. This is a natural-language locale policy issue because the script silently chooses English rather than preserving user choice or leaving the field unset.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/tootbot.js:24

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/tootbot.js:3