ClawHub
Back to skill

Security audit

Social Media Automation

Security checks across malware telemetry and agentic risk

Overview

This skill is openly about social media automation, but it can post publicly and send account reports on a schedule without clear approval, scoping, or stop controls.

Install only if you are comfortable letting an agent operate social media accounts. Before use, require human approval before each post, prefer official least-privilege API tokens over browser cookies, encrypt and limit credential/session storage, verify Feishu recipients, and make scheduled posting and reporting explicitly opt-in and easy to disable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The skill sends generated daily reports to Feishu even though the primary scope is social-media publishing. That creates an additional outbound data flow for account analytics and operational metadata to a third-party destination without any documented consent, minimization, or access-control model, which increases privacy and data-leakage risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The browser-automation path relies on persistent cookies and automated publishing but does not provide a clear warning about account takeover risk, platform policy violations, or local-system exposure from storing and replaying authenticated sessions. In this context, the omission is security-relevant because the skill encourages use of high-value social-media credentials for unattended actions.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill describes automated collection of platform analytics and generation/delivery of reports without an explicit warning that account performance data may be transmitted outside the platform. This is dangerous because analytics, growth metrics, and operational anomalies can be sensitive business information, and silent export broadens the attack surface.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.