ClawHub
Back to skill

Security audit

PostKing · Social

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent PostKing social-media workflow skill with disclosed account, posting, scheduling, asset, and template actions, but users should confirm destructive changes carefully.

Install only if you intend to let your agent manage PostKing social publishing and brand assets. Before disconnecting accounts, deleting assets, deleting templates, changing social rules, or enabling recurring schedules, require the agent to restate the exact target and get explicit confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to call disconnect_social_account directly after identifying an account ID, but it does not require an explicit user confirmation or warning about the consequence of severing a live social integration. In an agentic workflow, ambiguous user phrasing or prompt injection could cause unintended disconnects that disrupt publishing operations, even if past posts are preserved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Although delete_asset requires confirm: true, the skill only documents the API parameter and soft-delete behavior, not a mandatory user-facing warning or confirmation workflow before removal. This makes it easier for an agent to delete assets based on mistaken interpretation, malicious prompt content, or user ambiguity, causing loss of brand resources and downstream broken references.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill notes that template_delete is irreversible, but it still lacks a procedural requirement to obtain an explicit user confirmation immediately before executing deletion. In practice, reusable templates are operational assets, so accidental or injected deletion requests could permanently remove workflow-critical content patterns with no recovery path.

Content

No source excerpt is available for this finding.