ClawHub
Back to skill

Security audit

Agent Social Reader

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for reading and archiving public links, but its credential-storage guidance, optional installs, and bundled save scripts have enough security risk to require review before use.

Install only if you are comfortable reviewing each credential and archive action. Prefer platform secret storage or environment variables over chat, memory, shell profiles, Custom Instructions, or plaintext config files; avoid the optional zip helper unless you can verify it; and treat the included save scripts as examples that should be hardened before use with important files or knowledge bases.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T08 · Insecure Dependencies

Warning
Location
references/tool-details.md:647
Finding

Unpinned and Unverified Third-Party Dependencies

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/save-scripts.md:261
Finding

Predictable Temporary File Allows Symlink-Based File Overwrite

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/save-scripts.md:488
Finding

Obsidian Vault Containment Check Can Be Bypassed by Path-Prefix Confusion

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/tool-details.md:620
Finding

API Credentials May Be Stored in Insecure Plaintext Locations

Content
View full analysis
~/.config/ima/client_id echo "your_api_key" > ~/.config/ima/api_key ``` ### Technical Analysis The Skill appropriately prefers secret stores and requires approval before local plaintext persistence, but its fallback instructions do not enforce restrictive filesystem permissions. Files created through ordinary shell redirection inherit the active `umask`; in permissive environments, they may be readable by other local users or processes. Storing credentials in `.zshrc`, `.bashrc`, or `.env` files increases exposure to subprocesses, debugging output, shell configuration synchronization, and backups. Recommending Custom Instructions as a possible credential location is especially unsafe because instructions may become part of model context or be processed by platform integrations rather than functioning as a dedicated secret store. These locations exceed the minimum exposure necessary to authenticate individual API calls. ### Attack Path 1. A user follows the setup instructions and stores an ima API key in a shell startup file, Custom Instructions, `.env`, or a plaintext configuration file. 2. The storage location is readable by another local process, plugin, backup se ...[truncated 795 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (18)

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The skill recommends storing sensitive API keys in .env, shell startup files, and skill config locations. Those locations are commonly readable by other local processes, accidentally committed, surfaced in debugging, or harvested by later prompts/tools, making credential compromise much more likely.

Content

Scanner excerpt · references/tool-details.md (reported line 620)May include surrounding context.

export IMA_API_KEY="your_api_key"

text
Persistence varies by platform:
- **Hermes Agent**: consider persisting to a .env file in the Hermes config directory (path may vary by version — check your Hermes installation for the correct location)
- **Claude Code**: write to `~/.zshrc` or `~/.bashrc`
- **OpenClaw**: write to skill config via `~/.agent-social-reader/config.json` only if the user approved local plaintext config storage
- **ChatGPT/Codex**: add to Custom Instructions or environment config

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 147)May include surrounding context.

bash
pip install faster-whisper
# macOS: brew install ffmpeg | Ubuntu: sudo apt install ffmpeg

Once installed, tell your agent:

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The README explicitly tells users to paste a raw OpenAI API key into the chat and suggests the agent may remember it for future use. Putting secrets into conversational context exposes them to prompt logs, memory stores, transcripts, plugins, and downstream models or tools, which violates secret-handling best practices and can lead to credential leakage or unauthorized API use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to match ordinary requests like 'read this link' or 'summarize this URL', which can cause the skill to activate outside the user's intended context. Over-broad activation increases the chance of unintended network access, content fetching, and follow-on actions such as prompting for credentials or saving content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill explicitly permits persistent local storage in ~/.agent-social-reader/config.json for API keys and paths once the user agrees, creating a durable secrets footprint on disk. Plaintext persistence of credentials materially increases exposure to later compromise by other local processes, accidental backup/sync leakage, or unintended reuse beyond the original task.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
## ⚠️ Workspace Rules

**CRITICAL: Never create or modify files directly inside the agent's default workspace unless the user explicitly asks for a workspace artifact.**
- Use `/tmp/` for all temporary outputs and transient cache.
- Prefer platform secret storage, existing authenticated connectors, or environment variables for secrets.
- Use `~/.agent-social-reader/config.json` only after the user explicitly agrees to local plaintext configuration.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instruction at this line forces a Chinese prompt to the user for runtime-scene detection, but the skill does not state that it is limited to Chinese-speaking users or offer an alternate language. This creates a locale/language policy issue because the skill may respond in a specific language without user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/save-scripts.md (reported line 374)May include surrounding context.

md
)

    if target_type == "database":
        url = "https://api.notion.com/v1/pages"
        payload = {
            "parent": {"database_id": target_id},
            "properties": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/save-scripts.md (reported line 385)May include surrounding context.

md
)

    if target_type == "database":
        url = "https://api.notion.com/v1/pages"
        payload = {
            "parent": {"database_id": target_id},
            "properties": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tool-details.md (reported line 50)May include surrounding context.

md
if not match:
        return {"error": f"Cannot parse tweet URL: {url}"}
    username, tweet_id = match.group(1), match.group(2)
    api_url = f"https://api.fxtwitter.com/{username}/status/{tweet_id}"
    req = urllib.request.Request(api_url, headers={"User-Agent": "Mozilla/5.0"})
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tool-details.md (reported line 181)May include surrounding context.

md
**Purpose**: Mandatory handling channel for all platforms not covered by free tools above.
**Primary endpoint**: `POST https://agentlensapi.io/api/v1/fetch`
**Avoid by default**: `https://api.agentlensapi.io/v1/fetch` because some local proxy/fake-IP environments can fail TLS for the API subdomain while the main host works.
**Auth**: `Authorization: Bearer {AGENT_LENS_API_KEY}`

**Boundary**: Send only the URL for the current read request. Do not include unrelated user files, saved archives, or credentials in the request body.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The video summarization section expands the skill from URL reading into local package installation and shell execution (curl, yt-dlp, ffmpeg, pip install). That increases the attack surface substantially: untrusted media URLs can trigger downloads and processing of complex file formats and external binaries, which is beyond the minimal scope implied by a reader/summarizer skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tool-details.md (reported line 357)May include surrounding context.

md
f"Content-Type: audio/wav\r\n\r\n"
    ).encode('utf-8') + audio_data + f"\r\n--{boundary}--\r\n".encode('utf-8')
    req = urllib.request.Request(
        "https://api.openai.com/v1/audio/transcriptions",
        data=body,
        headers={
            "Authorization": f"Bearer {api_key}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tool-details.md (reported line 459)May include surrounding context.

Directly import URLs into ima knowledge base; ima parses the content itself. Use when user only wants to archive links.

bash
curl -X POST "https://ima.qq.com/openapi/wiki/v1/import_urls" \
 -H "ima-openapi-clientid: {IMA_CLIENT_ID}" \
 -H "ima-openapi-apikey: {IMA_API_KEY}" \
 -H "Content-Type: application/json" \

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/tool-details.md (reported line 585)May include surrounding context.

md
## §10. ima Setup — Scene 2 (WorkBuddy) & Scene 3 (External Agent)

These sections document the one-time setup for the two OpenAPI-based ima write paths.

### 10.1 Scene 2 — WorkBuddy Setup (One-time)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document instructs the user to say specific Chinese phrases to configure and verify the ima integration. This is a natural-language locale constraint presented as required behavior, and no alternative wording or user choice is offered for other languages.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

These setup instructions tell the agent to persist API credentials into shell profiles, .env files, plaintext config files, or even custom-instruction stores. Credential persistence outside dedicated secret storage creates durable exposure: secrets may be read by other tools, leaked via backups/logs, or later exfiltrated by unrelated prompts or skills.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/tool-details.md (reported line 637)May include surrounding context.

bash
IMA_CLIENT_ID="${IMA_CLIENT_ID:-$(cat ~/.config/ima/client_id 2>/dev/null)}"
IMA_API_KEY="${IMA_API_KEY:-$(cat ~/.config/ima/api_key 2>/dev/null)}"
curl -s -X POST "https://ima.qq.com/openapi/wiki/v1/get_addable_knowledge_base_list" \
 -H "ima-openapi-clientid: $IMA_CLIENT_ID" \
 -H "ima-openapi-apikey: $IMA_API_KEY" \
 -H "Content-Type: application/json" \

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The installation example tells the user to paste a Chinese sentence to their AI agent, but the skill does not offer an English alternative or indicate that the instruction is region-specific. This is a natural-language policy concern because it imposes a language choice without user selection.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/save-scripts.md:311