ClawHub
Back to skill

Security audit

Social Publisher

Security checks for vulnerabilities and agentic risk

Overview

This social-media automation skill is coherent, but it asks users to connect powerful account credentials and automate public actions without enough safety or secret-handling guidance.

Review this carefully before installing. Use test accounts or draft/preview mode first, avoid fully automated engagement until approval controls and rate limits are configured, and do not store real social-media credentials in plaintext project files or commit them to source control.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:69
Finding

Plaintext Storage of Social-Media API Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69–86
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: High

yaml
accounts:
  twitter:
    api_key: "..."
    api_secret: "..."
    access_token: "..."
    access_secret: "..."

  linkedin:
    client_id: "..."
    client_secret: "..."
    access_token: "..."

  instagram:
    access_token: "..."
    user_id: "..."

# Add as many as needed

Technical Analysis

The documented quick-start procedure instructs users to place API keys, API secrets, client secrets, and access tokens directly in a local social-config.yaml file. Although the displayed values are placeholders rather than active credentials, users following these instructions would create a plaintext credential store.

The documentation does not prescribe environment-variable substitution, an operating-system or cloud secret manager, encryption, restrictive file permissions, repository exclusions, or token-rotation procedures. Consequently, credentials may be exposed through accidental source-control commits, permissive local file access, workstation backups, archive sharing, or diagnostic collection.

The affected tokens may authorize social-media publishing, engagement, analytics access, and other account operations supported by their granted scopes.

Attack Path

  1. A user follows the quick-start instructions and inserts real platform credentials into social-config.yaml.
  2. The plaintext configuration is accidentally committed to source control, copied into a shared archive, included in a backup, or read by another local user or process.
  3. An attacker extracts the API keys, client secrets, or access tokens.
  4. The attacker submits authenticated requests to the affected social-media APIs.
  5. Subject to each token's scopes and platform controls, the attacker impersonates the account, publishes or modifies content, performs engagement actions, or accesses account information and analytics.

...[truncated 627 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace literal credential fields with environment-variable references or secret-manager identifiers, for example ${TWITTER_ACCESS_TOKEN}.
  • Recommend an operating-system keychain, CI/CD secret store, or managed cloud vault for production credentials.
  • If a local configuration file is unavoidable, separate secrets from non-sensitive configuration and enforce owner-only permissions such as chmod 600.
  • Add social-config.yaml and equivalent secret-bearing files to .gitignore.
  • Provide a sanitized social-config.example.yaml containing placeholders only.
  • Validate configuration at runtime and reject credential files with unsafe permissions where the operating system supports that check.
  • Request only the minimum API scopes required for each selected feature.
  • Use short-lived credentials where supported and document revocation and rotation procedures.
  • Add explicit warnings against committing, logging, sharing, or backing up plaintext credentials.
  • Introduce secret scanning in development and release workflows to detect accidental credential exposure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation promotes broad automated posting, engagement, and analytics across many social accounts but does not clearly warn that these actions can trigger real public activity, account sanctions, reputational harm, or accidental spam if misconfigured. In a skill specifically designed to control multiple social platforms, lack of guardrails or human-review warnings materially increases the chance of impactful misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The quick start instructs users to place API keys, client secrets, and access tokens directly in a YAML file without any warning about secret handling, file permissions, or safer storage mechanisms. If copied into repos, shared workspaces, logs, or backups, these credentials could let an attacker take over social accounts, exfiltrate data, or publish malicious content at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The auto-engagement section describes automatic likes, retweets, replies, follows, and list additions based on triggers and filters, but does not warn that these are externally visible actions that can be abused or misfire without human review. In social automation context, this can cause brand impersonation, amplification of harmful content, policy violations, spam behavior, and reputational damage across multiple platforms.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.