ClawHub
Back to skill

Security audit

PostNitro

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed PostNitro automation guide for creating and scheduling social posts, with real posting and credential risks that users should control carefully.

Install only if you want an agent to use PostNitro with your connected social accounts. Prefer POSTNITRO_API_KEY or --api-key on shared machines, confirm account, platform, content, and scheduled time before any SCHEDULED action, and use DRAFT when unsure.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The skill description is broad enough to be invoked for many generic content-creation requests, increasing the chance an agent will select it when the user did not explicitly ask to create or schedule posts through PostNitro. Because this skill can trigger downstream actions against connected social accounts, over-selection can lead to unintended content generation or posting in a higher-risk context than a normal drafting tool.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The primary description emphasizes one-command creation and scheduling but does not prominently foreground that actions may publish live to connected social accounts. This can cause an agent or user to underestimate the real-world effect of invocation, leading to accidental publication, reputational harm, or posting to the wrong account/platform.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: postnitro
description: Create on-brand social media carousels, single-image posts, and short videos, and schedule them to LinkedIn, Instagram, TikTok, and Threads from a single command. Turn a topic, article, or X thread into a finished multi-slide post, image, or video (with an optional audio track) — or import your own content — then publish or draft it automatically. Fully scriptable (JSON in, JSON out), so an AI agent can run the entire create-to-schedule workflow. Use this skill whenever the user wants to create a carousel, image post, video, reel, slide post, or multi-slide content, repurpose an article, blog post, or X thread into slides or a video, or automate and schedule social media posts. Use it to create and schedule content through PostNitro, not as a general social-media strategy advisor. Requires a PostNitro API key.
homepage: https://postnitro.ai
metadata: {"openclaw":{"emoji":"🎠","primaryEnv":"POSTNITRO_API_KEY","requires":{"bins":[],"env":["POSTNITRO_API_KEY"]}}}
---
Confidence
90% confidence
Finding
Create on-brand social media carousels, single-image posts, and short videos, and schedule them to LinkedIn, Instagram, TikTok, and Threads from a single command. Turn a topic, article, or X thread in

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.