Social Media Autopilot

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:36 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a real social-media calendar generator, but it reaches into a hard-coded personal .env file for secrets and under-scopes scheduling/account actions.

Review before installing. This should be changed to read only an explicitly provided GEMINI_API_KEY from the current environment or a user-selected config file, pin dependencies, document that Gemini receives business-planning inputs, and remove or tightly gate any real scheduling of posts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-16
Vulnerability Type: Unpinned runtime dependency and insufficient supply-chain integrity controls
Risk Level: Medium

Vulnerable Code

markdown

## Requirements
- Python 3.10+
- `google-generativeai` package (`pip install google-generativeai`)
- `GEMINI_API_KEY` in `/Users/edwin/.openclaw/workspace/dreams-arts/.env`

Technical Analysis

The documented installation command retrieves the latest available version of google-generativeai and its transitive dependencies without pinning versions or verifying package hashes. Consequently, installation is not reproducible, and the code ultimately installed can change after the skill has been audited.

The package name does not appear to be an evident typosquat, and the audit found no proof that the current package is malicious. The risk arises from trusting mutable upstream packages without version or integrity constraints. A future compromised release, compromised transitive dependency, or incompatible update could execute code during installation or when autopilot.py imports the package.

Attack Path

1. An attacker compromises an upstream package release, its publishing credentials, or one of its unpinned transitive dependencies.
2. A user follows the documented pip install google-generativeai instruction.
3. Package resolution selects the attacker-controlled or compromised version because no audited version is pinned.
4. Malicious code executes during package installation or when google.generativeai is imported.
5. That code runs with the operating-system permissions of the user running the installation or skill.

Impact Assessment

A compromised dependency could obtain the same privileges as the invoking user. Depending on that user's permissions, this could allow access to local files, environment variables, API credentials, network resources, and generated content. It c ...[truncated 254 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin google-generativeai to a specifically reviewed version rather than installing the latest release.
2. Lock every transitive dependency through a generated lock file or fully pinned requirements file.
3. Record and verify package hashes, such as with pip install --require-hashes -r requirements.txt.
4. Review dependency updates before changing the lock file, and use automated vulnerability and provenance checks.
5. Install dependencies in a dedicated virtual environment with only the permissions required by this skill.
6. Update SKILL.md so its installation instructions reference the audited, hash-verified dependency file.

T09 · Insecure Skill Coding Practices

Note

• Location: autopilot.py:15

Finding

Import-Time Loading of All Variables from a Hard-Coded Sensitive Environment File

Content

View full analysis

Vulnerability Details

File Location: autopilot.py, lines 15-27
Vulnerability Type: Excessive sensitive configuration loading and import-time side effects
Risk Level: Low

Vulnerable Code

python

from dotenv import load_dotenv

# Load env
load_dotenv(Path("/Users/edwin/.openclaw/workspace/dreams-arts/.env"))

try:
    import google.generativeai as genai
except ImportError:
    print(json.dumps({"error": "google-generativeai not installed. Run: pip install google-generativeai"}), file=sys.stderr)
    sys.exit(1)


GEMINI_API_KEY = os.getenv("GEMINI_API_KEY")

The loaded key is subsequently configured at line 32:

python

genai.configure(api_key=GEMINI_API_KEY)

Technical Analysis

Merely importing or executing this module causes it to parse a fixed, user-specific .env file. load_dotenv loads all available entries from that file into the process environment even though this skill only requires GEMINI_API_KEY.

This violates least-access principles at the configuration level and produces a surprising import-time side effect. Variables belonging to the separate dreams-arts workspace become accessible to this module and to dependencies loaded afterward. The subsequent import of google.generativeai occurs after the .env file is loaded, increasing the exposure of those variables to imported dependency code.

No code in the audited project explicitly enumerates or transmits unrelated environment variables, and no credential exfiltration was found. Exploitation therefore requires another component executing in the same process, such as a compromised dependency, malicious plugin, or injected Python module. The hard-coded absolute path also makes the skill non-portable and can cause it to use credentials from an unintended workspace.

Attack Path

1. The specified .env file contains GEMINI_API_KEY and potentially other sensitive workspace variables.
2. A user import ...[truncated 1427 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the hard-coded absolute .env path and require GEMINI_API_KEY to be provided through the existing process environment.
2. If loading an environment file is necessary, accept its path through an explicit command-line option or constructor parameter.
3. Delay credential loading until the generator is instantiated or invoked rather than performing it at module import time.
4. Parse only the required GEMINI_API_KEY value instead of exporting every file entry into os.environ.
5. Validate file ownership and restrictive permissions before reading a credential file.
6. Pass the required key directly into SocialMediaAutopilot and the Gemini client so its lifecycle and scope are explicit.
7. Avoid placing unrelated credentials in a shared .env file, and rotate any key suspected of having been exposed to untrusted same-process code.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose is limited to generating a social media calendar, but the skill also relies on an external Gemini API, references a hardcoded local .env path, and supports writing output to files. This mismatch is dangerous because it conceals data flow and side effects from users and orchestration systems, increasing the chance of unauthorized secret access, unintended exfiltration to a third party, or unsafe filesystem modification.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The hard-coded loading of /Users/edwin/.openclaw/workspace/dreams-arts/.env is consistent with credential access behavior because it targets a file conventionally used to store secrets. Even if the immediate use is to obtain GEMINI_API_KEY, the pattern grants this skill access to credentials from an unrelated workspace, which is disproportionate to its stated function.

Content

Scanner excerpt · autopilot.py (reported line 18)May include surrounding context.

python

from dotenv import load_dotenv

# Load env
load_dotenv(Path("/Users/edwin/.openclaw/workspace/dreams-arts/.env"))

try:
    import google.generativeai as genai

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises executable behavior that can access environment data and write files, but it declares no tool scope or permissions. This weakens containment and informed consent because an agent may run the skill without explicit restrictions on sensitive operations such as reading API-key-bearing environment files or writing outputs to disk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions tell the agent to schedule posts after approval, which goes beyond generating a content calendar and moves into taking actions on external platforms. Even with an approval step mentioned, expanding from content generation to account-affecting execution increases the chance of unauthorized actions, account misuse, or unintended publication workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs scheduling posts on social platforms without clearly warning that this can modify external accounts or create user-facing content. Lack of an explicit side-effect warning is dangerous in an agent context because users may not realize the step can perform real-world actions beyond drafting text.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill unconditionally loads a .env file from a hard-coded absolute local path, which is unrelated to normal content-calendar generation and causes the code to reach into a specific user's workspace for secrets. In an agent/skill environment, this creates unauthorized secret access and can exfiltrate API keys or other credentials through later code paths or downstream model usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Loading a sensitive environment file from a fixed path without disclosure or consent is a security boundary violation, because the skill silently accesses secrets outside its apparent purpose. Users invoking a social-media planning tool would not reasonably expect it to inspect a developer-specific .env file in another workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sends user-supplied brand, niche, audience, tone, and scheduling context to Gemini, which is an external third-party service. While expected for an AI generation tool, the absence of explicit disclosure means potentially sensitive business planning data is transmitted off-box without clear user awareness.

Content

No source excerpt is available for this finding.