Social Media Automator

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:12 AM UTC
• Version: 1.2.0

Overview

This skill is mainly a social media drafting aid, with no evidence of hidden posting, data theft, persistence, or destructive behavior, though its install metadata adds extra npm dependencies users should understand.

Before installing, note that the skill may install third-party npm packages even though the inspected artifact mainly provides drafting instructions. Review generated posts, claims, prices, links, hashtags, and tone before scheduling or publishing, especially for brand or client accounts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned and Unused Third-Party npm Dependencies Create Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 9
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"📱","requires":{"bins":["curl"]},"install":[{"kind":"npm","package":"threads-api"},{"kind":"npm","package":"@atproto/api"}]}}

Technical Analysis

The installation metadata requests the threads-api and @atproto/api npm packages without exact version constraints or package integrity values. Consequently, installation can resolve to mutable package releases that were not part of this audit.

npm dependencies may execute lifecycle scripts during installation. If either direct package, its maintainer account, or a transitive dependency is compromised, a malicious release could execute code in the installation environment. Such code would run with the privileges of the user or service installing the skill.

No project file contains executable logic that uses either npm dependency. The demonstrated functionality consists of instructions for generating text, making this additional supply-chain exposure unnecessary based on the audited contents. This finding does not establish that the named packages are currently malicious; it identifies unsafe dependency resolution and an avoidable execution channel.

Attack Path

1. An attacker compromises a package maintainer account, a transitive dependency, or the npm package distribution process.
2. The attacker publishes a malicious version containing an installation lifecycle script or compromised runtime logic.
3. A user installs the skill after that release becomes the version selected by npm.
4. Because no exact version or integrity-pinned lockfile is present, the installer retrieves the attacker-controlled release.
5. npm executes the malicious lifecycle script during installation, or the malicious code executes when the package is loaded.
6. The payload operates wit ...[truncated 697 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove threads-api and @atproto/api from the installation metadata unless the skill has reviewed implementation code that directly requires them.
2. If the dependencies are necessary, pin each package to an exact, security-reviewed version rather than resolving a mutable latest release.
3. Add and commit a lockfile containing integrity hashes, and enforce reproducible installation with npm ci.
4. Review direct and transitive dependencies using npm audit tooling, package provenance information, maintainer history, and lifecycle-script inspection.
5. Disable npm lifecycle scripts during installation where compatible, for example by using --ignore-scripts.
6. Perform installation in a least-privileged sandbox without production credentials, sensitive environment variables, or write access to unrelated projects.
7. Document the functional reason for every dependency and periodically remove packages that are no longer used.
8. Remove the unused curl requirement as an additional least-capability hardening measure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly supports scheduling and automation of social media content, but it does not place a clear, prominent safety warning near those features requiring human review before posting. In this context, users may over-trust generated content and automatically queue inaccurate, non-compliant, or brand-damaging posts, creating real operational and reputational risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

SQP-3 applies to natural-language policy issues in all file types. The main document is in English, but the support section at the end switches to Chinese with no opt-in or explanation, which can violate a language/locale policy requiring consistent language or explicit user choice.

Content

No source excerpt is available for this finding.