DoctorClaw Social Drafter

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:43 PM UTC
• Version:
  1.0.0

Overview

This is a social media drafting skill with optional approved scheduling, and its behavior is disclosed and aligned with that purpose.

Install if you want help drafting social posts. Before connecting Buffer, Hootsuite, direct platform APIs, or a shared content calendar, make sure your agent must ask for final approval before posting or scheduling and only has access to the intended accounts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill states that if a posting tool is connected, it can schedule approved posts and log posted content to a content calendar, but it does not prominently warn that this affects external accounts and stored data. In an agent setting, this can normalize state-changing actions and increase the chance of accidental posting, unwanted scheduling, or persistence of sensitive business content without clear confirmation boundaries.

VirusTotal

63/63 vendors flagged this skill as clean.