ClawHub
Back to skill

Security audit

Typefully Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it can change or publish social content and has a scheduling input flaw that merits review before use.

Install only if you are comfortable giving this skill access to manage your Typefully drafts and potentially publish or delete social content. Avoid passing schedule values copied from untrusted text, be careful with 'now' and delete-draft, and prefer a fixed version that fully validates and JSON-encodes schedule values and asks for confirmation before destructive actions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/typefully.sh:52
Finding

Schedule Parameter Allows Authenticated JSON Body Injection

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
bash scripts/typefully.sh <command> [options]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
bash scripts/typefully.sh <command> [options]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
bash scripts/typefully.sh <command> [options]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
bash scripts/typefully.sh <command> [options]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
bash scripts/typefully.sh <command> [options]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
bash scripts/typefully.sh <command> [options]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md
bash scripts/typefully.sh <command> [options]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md
bash scripts/typefully.sh <command> [options]

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/typefully.sh (reported line 73)May include surrounding context.

sh
http_code=$(curl -s -w '%{http_code}' -o "$tmpfile" -X "$method" "${API_BASE}${endpoint}" \
    -H "Authorization: Bearer ${API_KEY}" \
    -H "Content-Type: application/json" \
    "$@") || { rm -f "$tmpfile"; die "curl failed (network error)"; }

  body=$(cat "$tmpfile")
  rm -f "$tmpfile"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/typefully.sh (reported line 214)May include surrounding context.

sh
cmd_delete_draft() {
  local draft_id="$1"
  validate_draft_id "$draft_id"
  api DELETE "/social-sets/${SOCIAL_SET_ID}/drafts/${draft_id}"
}

usage() {

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill invokes shell-based tooling (bash, curl, python3) and requires sensitive credentials, but it does not declare any explicit tool restrictions such as permissions or allowed-tools. Without a scoped tool policy, an agent runtime may grant broader shell access than necessary, increasing the chance of command execution abuse, unintended side effects, or secret exposure if the skill is misused or later modified.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/typefully.sh (reported line 4)May include surrounding context.

sh
#!/usr/bin/env bash
set -euo pipefail

API_BASE="https://api.typefully.com/v2"
SOCIAL_SET_ID=""
API_KEY=""

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The delete-draft command issues an API DELETE request that removes a draft, but the script provides no confirmation prompt, print/log message, or inline warning near the destructive action. Although the usage text names the command, there is no explicit user disclosure that the operation is destructive or irreversible at execution time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The create-draft command sends user-provided text to the external Typefully API via an HTTP POST, but the function does not display a notice, prompt, or comment warning that draft content will be transmitted off-system. The same script documents command usage, but it does not explicitly disclose this data-sharing behavior near execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The edit-draft command uploads user-supplied draft content to the external Typefully API with a PUT request, but there is no prompt, visible notice, or inline warning about transmitting that content. This is a data-affecting network operation that lacks explicit disclosure in the script itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.