ClawHub
Back to skill

Security audit

SocialRails

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it claims, but it can use a powerful SocialRails API key to read account data and schedule public posts, and its configurable API endpoint can leak that key to an arbitrary server if misconfigured.

Review this before installing. Use the least-privileged SocialRails API key possible, keep the key secret, avoid changing baseUrl unless you fully trust the endpoint, and manually confirm any post content and schedule before allowing the skill to create or schedule posts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
index.js:26
Finding

Configurable API Base URL Can Expose the Bearer Token to an Arbitrary Server

Content
View full analysis

Vulnerability Details

File Location: index.js, lines 26–50
Vulnerability Type: Unvalidated destination for authenticated API requests
Risk Level: Medium

Vulnerable Code

js
async function apiRequest(method, endpoint, body = null) {
  const config = loadConfig();
  const apiKey = config.apiKey;
  const baseUrl = config.baseUrl || 'https://socialrails.com/api/v1';

  if (!apiKey) {
    return { error: 'SocialRails API key not configured. Run: openclaw config socialrails apiKey <your-key>' };
  }

  const options = {
    method,
    headers: {
      'Authorization': `Bearer ${apiKey}`,
      'Content-Type': 'application/json',
    },
  };

  if (body) {
    options.body = JSON.stringify(body);
  }

  const url = `${baseUrl}${endpoint}`;

  try {
    const response = await fetch(url, options);

Technical Analysis

The skill reads baseUrl from user-controlled configuration and uses it without validating its scheme, hostname, port, or origin. It then attaches the SocialRails API key to every request through the Authorization header.

Consequently, anyone able to influence skills.socialrails.baseUrl in ~/.openclaw/openclaw.json can redirect authenticated requests to a server they control. The implementation also permits an http:// URL, allowing the credential and request contents to be transmitted without transport encryption.

This is a credential-disclosure flaw rather than remote code execution. Exploitation requires the ability to alter or socially engineer a change to the skill configuration.

Attack Path

  1. An attacker persuades the user to configure a purported proxy or alternative SocialRails endpoint, or otherwise gains the ability to modify skills.socialrails.baseUrl.
  2. The attacker sets baseUrl to a server they control, such as https://attacker.example/api/v1.
  3. The user invokes any skill command that calls apiRequest.
  4. The ...[truncated 857 chars]
Remediation
View remediation

Remediation Suggestions

  1. Parse the configured value with new URL() rather than concatenating unvalidated strings.
  2. Require the https: scheme and reject plaintext HTTP.
  3. Allowlist the official socialrails.com hostname and expected API path.
  4. Reject embedded credentials, unexpected ports, malformed URLs, and unapproved subdomains.
  5. If custom endpoints are necessary, require an explicit high-risk opt-in and use separate credentials that are not valid against the production SocialRails service.
  6. Before attaching the Authorization header, verify that the final request URL remains on an approved origin.
  7. Prevent credential forwarding across redirects, or disable redirects and validate each redirect destination.
  8. Document that changing baseUrl can disclose API credentials and should only be performed for trusted endpoints.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The example invocations are generic natural-language phrases like 'Show me analytics' and 'What accounts do I have connected?', which can overlap with ordinary conversation and make unintended skill activation more likely. Because this skill can access account data and perform write actions such as scheduling posts via an authenticated API key, ambiguous triggering increases the risk of accidental data access or unintended social media actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly offers commands to list connected accounts, view analytics, schedule posts, and generate content via the SocialRails API, but it does not warn users that account metadata, post content, prompts, and analytics-related data may be transmitted to a third-party service. This can mislead users about data handling and consent, especially where business, customer, or sensitive marketing information is involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The helper sends request bodies and query parameters to a remote API using fetch, including social post content, analytics queries, and account-related data. While the file header describes API usage generally, there is no confirmation prompt, user-facing log, or explicit warning in the code around this data transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

loadConfig reads ~/.openclaw/openclaw.json and extracts socialrails credentials, which is access to sensitive local configuration. The code contains no user-facing notice, prompt, or explicit comment warning that stored credentials will be accessed for API calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This is a manifest file, so SQP-2 applies to its markdown-like skill description content. The description advertises viewing analytics and listing connected accounts, which can reveal user-linked account and performance data, but it provides no disclosure about this privacy-relevant behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The manifest requires a live API key, which is sensitive credential material. Although documenting configuration is expected, there is no accompanying note advising users to keep the key secret or explaining that the skill will use it to access their SocialRails account.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.js:13