Security audit

Social Autopilot

Security checks for vulnerabilities and agentic risk

Overview

This skill openly automates social posting, but it needs careful review because it can publish to multiple public accounts from a short command and handles account credentials unsafely.

Install only if you are comfortable giving the skill real posting rights on the connected accounts. Use test accounts first, limit API scopes, review generated content before publishing, avoid the generic all-platform trigger, pin installer and dependency versions, store YouTube tokens outside the project with restrictive permissions, and run video rendering in an isolated environment without production credentials.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/yt_auth.py:52
Finding: Unsafe Pickle Deserialization Enables Arbitrary Local Code Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/yt_auth.py:89
Finding: YouTube OAuth Credentials Are Persisted Without Restrictive File Protections
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/html_video_generator.py:887
Finding: Chromium Security Sandbox Is Unconditionally Disabled During HTML Rendering
Content: View full analysis
Html2Image: """Create one Html2Image instance (launches Chrome once).""" import os, shutil is_ci = os.getenv("CI") == "true" or os.getenv("GITHUB_ACTIONS") == "true" flags = [ "--no-sandbox", "--disable-dev-shm-usage", "--disable-gpu", "--headless=new", "--disable-software-rasterizer", ] # Find chromium/chrome binary browser_path = None for candidate in ["chromium-browser", "chromium", "google-chrome", "google-chrome-stable"]: found = shutil.which(candidate) if found: browser_path = found break ``` ### Technical Analysis The renderer launches Chromium with `--no-sandbox` in every environment. Chromium's sandbox is a major defense-in-depth boundary intended to constrain a compromised rendering process. Disabling it means a successful browser-engine exploit can operate directly with the privileges of the Skill process. The code calculates `is_ci`, but that value is not used to restrict the unsafe flag to a specially isolated CI environment. Consequently, the sandbox is disabled during ordinary local execution as well. Most question fields are HTML-escaped before rendering, which reduces direct HTML or JavaScript injection opportunities. Therefore, practical exploitation would generally require another route to attacker-controlled browser content or a vulnerability in Chromium, `html2image`, fonts, images, or other rendered resources. The disabled sandbox materially increases the impact if such a rendering compromise occurs. ### Attack Path 1. An attacker supplies malformed content or a crafted rendering resource capable of triggering a vulnerability in the installed Chromium build or related rendering ...[truncated 969 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:27
Finding: Installation Instructions Execute an Unpinned Remote NPM Package
Content: View full analysis
Remediation: View remediation
install social-autopilot@ ``` 2. Commit and enforce a lockfile for NPM dependencies. 3. Verify package provenance, publisher identity, and registry integrity metadata before execution. 4. Prefer a locally installed, locked dependency invoked through package scripts rather than allowing `npx` to retrieve the latest release dynamically. 5. Pin all Python dependencies to reviewed versions and use a hash-locked requirements file, such as one generated with `pip-compile --generate-hashes`. 6. Run installation in a disposable, least-privileged environment without production credentials. 7. Establish a controlled update process that reviews release diffs before changing pinned versions. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Tainted flow: 'url' from os.environ (line 40, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/meta_poster.py (reported line 21)May include surrounding context.
python
"""Make a POST request with retry logic. Returns the post/comment ID.""" for attempt in range(1, MAX_RETRIES + 2): try: resp = requests.post(url, params=params, timeout=30) resp.raise_for_status() data = resp.json() post_id = str(data["id"])

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
text
X_API_KEY=<your X/Twitter API key> X_API_SECRET=<your X/Twitter API secret> X_ACCESS_TOKEN=<your X/Twitter access token> X_ACCESS_TOKEN_SECRET=<your X/Twitter access token secret>

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
text
X_API_KEY=<your X/Twitter API key> X_API_SECRET=<your X/Twitter API secret> X_ACCESS_TOKEN=<your X/Twitter access token> X_ACCESS_TOKEN_SECRET=<your X/Twitter access token secret>

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
text
X_API_KEY=<your X/Twitter API key> X_API_SECRET=<your X/Twitter API secret> X_ACCESS_TOKEN=<your X/Twitter access token> X_ACCESS_TOKEN_SECRET=<your X/Twitter access token secret>

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
text
X_API_KEY=<your X/Twitter API key> X_API_SECRET=<your X/Twitter API secret> X_ACCESS_TOKEN=<your X/Twitter access token> X_ACCESS_TOKEN_SECRET=<your X/Twitter access token secret>

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
# ── Paths ───────────────────────────────────────────────────────────────────── BASE_DIR = Path(__file__).resolve().parent.parent CLIENT_SECRETS_FILE = BASE_DIR / "client_secrets.json" TOKEN_FILE = BASE_DIR / "youtube_token.json" OUTPUT_DIR = BASE_DIR / "output" LOGS_DIR = BASE_DIR / "logs"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/yt_auth.py (reported line 41)May include surrounding context.
python
# ── Paths ───────────────────────────────────────────────────────────────────── BASE_DIR = Path(__file__).resolve().parent.parent CLIENT_SECRETS_FILE = BASE_DIR / "client_secrets.json" TOKEN_FILE = BASE_DIR / "youtube_token.json" OUTPUT_DIR = BASE_DIR / "output" LOGS_DIR = BASE_DIR / "logs"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/yt_config.py (reported line 6)May include surrounding context.
python
# ── Paths ───────────────────────────────────────────────────────────────────── BASE_DIR = Path(__file__).resolve().parent.parent CLIENT_SECRETS_FILE = BASE_DIR / "client_secrets.json" TOKEN_FILE = BASE_DIR / "youtube_token.json" OUTPUT_DIR = BASE_DIR / "output" LOGS_DIR = BASE_DIR / "logs"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README prominently advertises fully automatic posting, scheduling, and multi-platform publishing but does not clearly warn users that the skill can take actions on external accounts using stored credentials. In this context, missing safety disclosure is especially dangerous because users may enable automation without understanding that posts, comments, and scheduled actions can be sent autonomously to public-facing accounts.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: Using npx clawhub install social-autopilot without a pinned version or integrity control allows whatever package is current at install time to be executed on the user's system. In a skill that automates posting and likely handles API keys for external accounts, a compromised or swapped package could steal credentials, alter behavior, or perform unauthorized actions during installation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrase Post now is short, generic, and likely to occur in normal conversation, increasing the chance of accidental invocation. Because this skill performs external side effects by publishing content to social platforms, unintended activation could cause unauthorized or embarrassing posts across linked accounts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation description allows a single ambiguous command to perform a high-impact action across X, Instagram, YouTube, and Meta without any documented confirmation or scoping. In context, this is more dangerous because the skill is fully autonomous and connected to multiple posting backends, so one mistaken invocation can create widespread public actions immediately.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The invocation description allows a single ambiguous command to perform a high-impact action across X, Instagram, YouTube, and Meta without any documented confirmation or scoping. In context, this is more dangerous because the skill is fully autonomous and connected to multiple posting backends, so one mistaken invocation can create widespread public actions immediately.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation claims the content database 'stays local' and is 'never uploaded anywhere,' but the skill explicitly uses CSV-derived content to generate posts, threads, captions, and videos that are then sent to X, Instagram, YouTube, Meta, and Cloudflare R2. This is a misleading data-handling statement that can cause operators to underestimate what information leaves the local environment and accidentally publish sensitive or proprietary dataset contents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest states that the skill automatically posts to X, Instagram, YouTube, and Facebook, but it does not present a user-facing warning that it can take real actions on connected third-party accounts or process account-linked data. This omission is dangerous because users may enable the skill without understanding that it can publish content externally, potentially causing account abuse, policy violations, data leakage, or reputational harm.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest advertises 'full autopilot' social media behavior and 'Complete social media automation' across multiple external platforms without defining trigger boundaries, approval requirements, or operational limits. In an agent ecosystem, this creates a real risk of unintended autonomous posting, spammy behavior, reputational damage, or misuse of linked accounts because users are not clearly warned about when and how actions will occur.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level description states the formatter is "English only," which is a natural-language locale restriction. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This Python file embeds multiple user-facing strings such as "UPSC ka sabse bada pattern", "Practice karo", and similar Hindi/English mixed phrases that determine the generated video output. Because the skill does not offer any user opt-in or language selection, it effectively forces a specific language/locale style, which matches the natural-language locale policy violation criteria.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The docstring states the function builds a 3-phase timer challenge with a 5-second countdown and a 5-second answer reveal totaling about 12 seconds. In code, the function appends only a 7-second hook screen and a 3-second CTA screen, with no countdown frames and no answer reveal, so the documented intent materially contradicts the actual behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code performs external POST requests that create media containers, publish reels, and post comments to Instagram, which can affect the user's public account and transmit content and access tokens over the network. While the code logs status internally, there is no confirmation prompt, docstring, or comment warning the user that these account-modifying actions will be performed.
Content: No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

Category: Data Exfiltration
Confidence: 55% confidence
Finding: Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
Content: Scanner excerpt · scripts/r2_uploader.py (reported line 28)May include surrounding context.
python
for attempt in range(1, max_retries + 1): try: logger.info("Uploading %s to R2 (attempt %d/%d)", key, attempt, max_retries) client.upload_file( str(file_path), R2_BUCKET, key,

Insecure deserialization: pickle.load()

Medium

Category: Dangerous Code Execution
Confidence: 97% confidence
Finding: The code deserializes TOKEN_FILE with pickle.load(), which can execute arbitrary code during unpickling if the token file is attacker-controlled or has been tampered with. In this context the file stores OAuth credentials, so compromise of the token path, CI workspace, or local filesystem could turn a simple credential load into code execution inside the agent environment.
Content: Scanner excerpt · scripts/yt_auth.py (reported line 58)May include surrounding context.
python
try: # Try pickle format first (local development) with open(TOKEN_FILE, "rb") as token: credentials = pickle.load(token) except (pickle.UnpicklingError, EOFError): # Fall back to JSON format (GitHub Actions) logger.info("Pickle failed, trying JSON format")

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The top-level documentation describes this file as an uploader for YouTube Shorts, which implies upload-only behavior. However, the module also defines comment_on_video and post_short logic that posts a top-level comment containing the answer/explanation, which is a materially different action affecting video interactions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The docstring for format_question_post states 'Zero hashtags' for formatted X/Twitter posts, but the function unconditionally calls _add_x_hashtags for non-quiz days, which appends '#UPSC' and sometimes a second hashtag. This is an active contradiction between the documented intent and runtime behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The docstring says the description includes a 'site link,' but the templates interpolate BRAND_URL, which is not defined anywhere in this file. As written, the function does not reliably implement the documented behavior of producing a real link-containing description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.