ClawHub
Back to skill

Security audit

Social Posting for Openclaw

Security checks across malware telemetry and agentic risk

Overview

The skill is instruction-only and aligned with social posting, but it enables real public posting and Facebook group joining through the user's logged-in browser without clear per-action consent guardrails.

Install only if you are comfortable giving this skill authority to use Claw Post and a paired browser extension to act through your social accounts. Approve each post, target platform, media upload, and Facebook group join explicitly, review extension permissions and Claw Post terms, avoid sensitive media unless metadata and retention are acceptable, and rotate the CLAWPOST_API_KEY if access is no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill explicitly automates searching for Facebook groups, joining them, and posting via the user's real browser session, but it does not clearly require an explicit user warning or confirmation about platform-policy, reputational, spam, or account-enforcement risks. Because the extension acts through a logged-in personal account, misuse or overbroad agent autonomy could cause real social/account consequences even if no platform credentials are exposed.

External Transmission

Medium
Category
Data Exfiltration
Content
Upload media before posting. The returned URL goes into the `mediaPaths` array.

```
POST https://api.clawpost.net/v1/media/upload
clawpost-api-key: YOUR_CLAWPOST_API_KEY
Content-Type: multipart/form-data
Body: file=<media file>
Confidence
76% confidence
Finding
https://api.clawpost.net/

External Transmission

Medium
Category
Data Exfiltration
Content
### Join a group

```
POST https://api.clawpost.net/v1/facebook/groups/join
Content-Type: application/json
clawpost-api-key: YOUR_CLAWPOST_API_KEY
```
Confidence
80% confidence
Finding
https://api.clawpost.net/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.