Security audit

Social Ops

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for social-media automation, but it enables unattended public posting and broad local-file use with insufficient safeguards.

Install only if you are comfortable with scheduled agents reading configured local references, modifying a social workspace, and posting or replying on your behalf. Before enabling cron jobs, use dry-run, restrict Local-File-References.md to non-sensitive approved files, keep credentials least-privilege, review queued posts before Poster runs, and check for duplicate cron jobs after installation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/roles/Writer.md:48
Finding: Unrestricted Local File References Can Expose Sensitive Host Data<![CDATA[ ## Vulnerability Details **File Location**: `references/roles/Content-Specialist.md:45-49`, `references/roles/Content-Specialist.md:112-116`, `references/roles/Writer.md:48-52`, `references/roles/Writer.md:106-108`, `references/ROLE-IO-MAP.md:64-65`, `references/ROLE-IO-MAP.md:87-88`, `references/ROLE-IO-MAP.md:148`, and `references/LOCAL-FILE-REFERENCES-TEMPLATE.md:9-14` **Vulnerability Type**: Unrestricted local-file access through configurable references **Risk Level**: High ### Vulnerable Code Snippets From `references/roles/Content-Specialist.md:45-49`: ```markdown Optional local content references (human-configurable): - If present, read `$SOCIAL_OPS_DATA_DIR/Guidance/Local-File-References.md`. - Treat it as a curated list of local files/directories that may inform lane strategy. - Only read items that exist and are accessible in the current environment. - Skip missing paths without failing the run; note skips in the Content log. ``` From `references/roles/Content-Specialist.md:112-116`: ```markdown - If `$SOCIAL_OPS_DATA_DIR/Guidance/Local-File-References.md` exists: - Read listed local references (files/directories) that exist. - Use them as optional context inputs for lane strategy decisions. - Record any missing/unreadable configured references in the run log. ``` From `references/roles/Writer.md:48-52`: ```markdown Optional local content references (human-configurable): - If present, read `$SOCIAL_OPS_DATA_DIR/Guidance/Local-File-References.md`. - Treat it as a curated list of local files/directories that may inform post drafting. - Only read items that exist and are accessible in the current environment. - Skip missing paths without failing the run; note skips in the Writer log. ``` From `references/roles/Writer.md:106-108`: ```markdown - Read `$SOCIAL_OPS_DATA_DIR/Guidance/Local-File-References.md` if present - Read listed local references relevant to the chosen lane - Scan recent Research logs for topical inspiration ``` ...[truncated 3790 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Define a dedicated, least-privilege content root, such as: ```text $SOCIAL_OPS_DATA_DIR/Approved-References/ ``` 2. Resolve every configured path to its canonical path before reading it and verify that the result remains beneath the approved root. 3. Reject: - Absolute paths - Paths containing `..` - Symlinks that resolve outside the approved root - Device files, sockets, and other non-regular files - Hidden credential files - Broad directory references unless explicitly approved 4. Maintain a denylist for sensitive filenames and directories, including: - `.env` - `.ssh` - `.aws` - `.config/gcloud` - Credential stores - Browser profiles - Private-key formats 5. Make `Local-File-References.md` human-owned. Remove Researcher write authority or require explicit operator approval for every change. 6. Add file-count and byte-size limits to prevent recursive or excessively broad reads. 7. Treat all referenced content as untrusted data. Explicitly instruct agents not to follow commands or operational instructions found inside referenced files. 8. Add a mandatory human approval step before referenced local content can be moved into the publishable Todo queue. 9. Add automated tests covering absolute paths, traversal, symlink escapes, sensitive filenames, and oversized directories. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: packaged-scripts/install-cron-jobs.sh:58
Finding: Broken Cron Job Lookup Causes Duplicate Persistent Scheduled Jobs<![CDATA[ ## Vulnerability Details **File Location**: `packaged-scripts/install-cron-jobs.sh:58-94` and `packaged-scripts/install-cron-jobs.sh:96-123` **Vulnerability Type**: Non-idempotent persistent job installation caused by conflicting standard-input redirections **Risk Level**: Medium ### Vulnerable Code Snippet From `packaged-scripts/install-cron-jobs.sh:58-94`: ```bash get_existing_job_id() { local job_name="$1" openclaw cron list --all --json 2>/dev/null | python3 - "$job_name" <<'PY' import json import sys needle = sys.argv[1] raw = sys.stdin.read().strip() if not raw: print("") raise SystemExit(0) try: data = json.loads(raw) except Exception: print("") raise SystemExit(0) jobs = [] if isinstance(data, list): jobs = data elif isinstance(data, dict): if isinstance(data.get("jobs"), list): jobs = data["jobs"] elif isinstance(data.get("items"), list): jobs = data["items"] for j in jobs: if isinstance(j, dict) and j.get("name") == needle: print(j.get("id", "")) raise SystemExit(0) print("") PY } ``` The lookup controls the add-or-edit decision in `packaged-scripts/install-cron-jobs.sh:96-123`: ```bash upsert_job() { local name="$1" local cron_expr="$2" local description="$3" local message="$4" local existing_id existing_id="$(get_existing_job_id "$name")" if [[ -n "${existing_id}" ]]; then echo "Updating existing job: ${name} (${existing_id})" run_cmd openclaw cron edit "${existing_id}" \ --name "${name}" \ --description "${description}" \ --cron "${cron_expr}" \ --tz "${TZ_NAME}" \ --session isolated \ --message "${message}" \ --enable else echo "Creating new job: ${name}" run_cmd openclaw cron add \ --name "${name}" \ --description "${description}" \ --cron "${cron_expr}" \ --tz "${TZ_NAME}" \ --session isolated \ --message "${message}" fi } ``` ### Technical ...[truncated 2546 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Preserve standard input for the JSON and provide the Python program through `-c` or a separate script file. For example: ```bash openclaw cron list --all --json 2>/dev/null | python3 -c ' import json import sys needle = sys.argv[1] data = json.load(sys.stdin) jobs = data if isinstance(data, list) else data.get("jobs", data.get("items", [])) matches = [ job for job in jobs if isinstance(job, dict) and job.get("name") == needle ] if len(matches) > 1: raise SystemExit("duplicate jobs found for: " + needle) print(matches[0].get("id", "") if matches else "") ' "$job_name" ``` 2. Fail closed when: - `openclaw cron list` fails - Output is empty - JSON parsing fails - Multiple jobs have the same expected name - A matching entry lacks an ID 3. Check and propagate the exit status of both pipeline commands, using `set -o pipefail`, which the script already enables. 4. Before adding a job, perform a second explicit uniqueness check. 5. Provide a cleanup or migration routine that detects existing duplicates and asks the operator which entries to remove. 6. Add integration tests proving that: - The first run creates each job once - The second run edits rather than adds - Invalid JSON aborts installation - Duplicate existing names are reported rather than silently multiplied 7. Display a final summary containing the IDs and action taken for every job so the operator can verify persistence changes. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Anti-Refusal Statement

High

Category: Anti-Refusal
Content: 5. Stop No infinite exploration. No deep dives without constraint. Research must compound, not sprawl.
Confidence: 80% confidence
Finding: Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The README includes a very broad natural-language trigger example asking the agent to 'figure out how to install the crons for me,' which could encourage unintended activation or overbroad autonomy in environments where skills are invoked from chat text. In the context of a skill that sets up scheduled automation, accidental invocation can lead to unauthorized persistence or automation changes without sufficient user review.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README directs users to install cron jobs for automated social-media operations and even provides a one-command quick start, but it does not prominently warn about the security, compliance, and operational risks of unattended posting or engagement. In this skill context, scheduled execution is central to the workflow, so the absence of warnings increases the chance of users enabling persistent automation without understanding account, platform-policy, or approval safeguards.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The activation guidance is broad enough to trigger the skill for general social-media tasks, which can cause the agent to enter a workflow that includes content creation, replies, posting, and automation-related setup without a tightly scoped user request. In an agent environment, over-broad activation increases the chance of unintended high-impact actions being proposed or initiated in the wrong context.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly includes a Poster role that publishes content and also points users to cron-job installation for automated execution, but it does not prominently require a confirmation or safety checkpoint before these impactful actions. That creates a real risk of unauthorized posting, reputational harm, or persistent automated behavior if the skill is activated inappropriately or used with incomplete oversight.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The role map explicitly documents access to privacy-sensitive data sources, including replies/DMs/mentions and arbitrary local files referenced through a human-curated file list, but it provides no accompanying constraints, consent requirements, minimization rules, or warning about sensitive-data handling. In a multi-role agent skill, normalizing these data flows without guardrails increases the chance that personal or confidential information is collected, propagated into logs, or reused across roles beyond the operator's intent.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The file states that the Content Specialist only shapes strategy and does not perform direct operational work, but later gives it sole authority over submolt promotion and retirement. This contradiction is dangerous because downstream agents or reviewers may rely on the earlier boundary language and underestimate the role's actual write capabilities and decision authority.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The role explicitly instructs the agent to append logs and elsewhere to create, update, move, and remove multiple files under the workspace without any requirement for prior user confirmation. In an agent skill, silent file mutation is risky because routine execution can cause persistent changes, overwrite user-maintained state, or be chained with adversarial context from referenced files.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This role is defined as a strategic content-planning function, but it is later granted authority to change submolt subscriptions and move entries across Primary, Candidates, and Retired state files. That is a privilege/scope expansion that lets a content-planning role make durable operational changes, increasing the chance of unauthorized state mutation or misuse if the role is activated inappropriately.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This role explicitly instructs the agent to publish content to an external platform and then modify local state by annotating and moving files, but it does not require an explicit user-facing confirmation at execution time for those side effects. In an agent setting, that creates a real risk of unintended public posting and filesystem changes if the skill is triggered in the wrong context or with unreviewed inputs.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The role is introduced as purely reactive—limited to comments, DMs, and explicit mentions—but later broadens to opportunistic thread engagement based on Scout signals. In a multi-role agent system, this kind of scope drift weakens least-privilege boundaries and increases the chance that untrusted contextual inputs steer the agent into actions it was not originally meant to perform.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The document first constrains Responder to reactive engagement and explicitly says it must not enter unrelated threads, but later authorizes Scout-sourced 'insertion' into threads outside direct mentions. That contradiction can be exploited by upstream routing or prompt injection in Scout logs to expand the agent’s authority, causing policy bypass, unintended outreach, or reputationally risky engagement.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to write persistent data into workspace files, but it provides no warning, confirmation step, or disclosure that running the role will modify local state. In an agent setting, silent file writes are risky because they can cause unintended persistence, contaminate later runs, and alter operator-managed content without informed consent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The role directs automatic updates to Candidates.md as part of normal execution, again without warning that this is a persistent modification to shared workspace content. Because the file appears to be part of an ongoing operational knowledge base, unreviewed writes can introduce noise, duplication, or attacker-influenced entries that affect downstream decisions and future agent behavior.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This role explicitly instructs the agent to create and update multiple files in the workspace, including Todo items, logs, and memory files, but provides no user-facing confirmation, approval boundary, or write-scope restriction. In an agent setting, silent file modification can cause unintended content changes, overwrite trusted workspace state, or be abused through poisoned inputs in referenced guidance or lane files to persist unwanted data.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: This markdown file instructs the Analyst to write output to `$SOCIAL_OPS_DATA_DIR/Content/Logs/Analysis-YYYY-WW.md`, which is a file-modifying action. The document presents the write location and format, but does not include a user-facing warning that the skill will create or update files in the workspace.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The role explicitly instructs the agent to create and modify persistent files such as task queues, guidance documents, and logs, but it does not require notifying the user or obtaining confirmation before those writes. In an agent environment with filesystem access, this can lead to silent state changes, unexpected persistence, or accidental overwriting of user-managed project artifacts.

Static analysis

No suspicious patterns detected.