Postiz Social Publishing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:43 AM UTC
• Version: 1.0.5

Overview

This Postiz skill is coherent, but it asks users to install and enable a persistent third-party plugin without a pinned version or integrity check.

Review the ClawLink plugin provenance before installing, prefer a pinned or verified release if available, and understand that connected Postiz actions may publish, edit, or delete social content after confirmation. Remove or disable the plugin if you no longer need the integration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:47

Finding

Unpinned Third-Party Plugin Is Installed and Enabled Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–49
Vulnerability Type: Supply-chain risk from an unpinned external plugin
Risk Level: Medium

Vulnerable code:

bash

openclaw plugins install clawhub:clawlink-plugin
openclaw config set tools.alsoAllow '["clawlink-plugin"]' --strict-json
openclaw gateway restart

Technical Analysis

The skill directs the user or agent to install clawlink-plugin from an external package registry using a mutable package identifier. It does not pin a reviewed version, require a cryptographic digest, verify a signature, or provide an integrity-validation step. It then explicitly adds the plugin to the tool allowlist and restarts the OpenClaw gateway, activating the downloaded component.

Consequently, the code reviewed in this project does not fully determine the behavior executed at runtime. If the registry entry, publisher account, distribution infrastructure, or dependency chain were compromised, an attacker could replace a later plugin release with malicious code while retaining the same installation command.

The surrounding documentation indicates that this plugin participates in account pairing, OAuth credential handling, and proxying requests to Postiz. These responsibilities increase the sensitivity of the dependency. The audited file does not itself establish that the current plugin is malicious; the confirmed issue is the absence of version and integrity controls before installing and enabling privileged third-party code.

Attack Path

1. An attacker compromises the clawlink-plugin publisher account, package registry entry, delivery infrastructure, or one of the plugin's transitive dependencies.
2. The attacker publishes a malicious release under the same mutable package name.
3. A user follows the skill instructions and runs openclaw plugins install clawhub:clawlink-plugin.
4. OpenClaw retrieves the attacker-controlled release because no tr ...[truncated 1274 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specific, reviewed version rather than installing a mutable latest release.
2. Require verification against a trusted cryptographic digest or publisher signature before enabling the plugin.
3. Document the expected publisher identity, release version, checksum, and verification procedure directly in the installation instructions.
4. Separate installation from activation. Display the resolved version and integrity information, then obtain explicit user approval before modifying tools.alsoAllow or restarting the gateway.
5. Review the plugin and its transitive dependencies, and use lockfiles or an equivalent dependency-locking mechanism.
6. Run the gateway and plugin with least privilege. Restrict filesystem, network, process-execution, and credential access to what the Postiz integration strictly requires.
7. Ensure OAuth tokens are stored in a protected credential service and are not exposed directly to plugin code unless necessary. Use narrowly scoped, revocable tokens.
8. Establish dependency monitoring and an incident-response procedure covering plugin revocation, removal, token rotation, and review of affected social-media activity.
9. Prefer a trusted internal mirror or verified package repository with immutable artifacts and provenance attestations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.