LinkedIn Post Generator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:05 AM UTC
• Version: 1.0.7

Overview

The skill is a disclosed paid LinkedIn post generator, but it ships an embedded payment merchant key and has supply-chain and scoping issues that need Review before installation.

Install only if you are comfortable with a paid, networked skill that contacts SkillPay and a local OpenClaw/Sloan agent. The publisher should remove and rotate the embedded merchant key, add explicit billing confirmation or clearer first-run consent, pin reviewed install/dependency versions, regenerate the lockfile from HTTPS sources, and fix the current JavaScript syntax error before users rely on it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:11

Finding

Hardcoded Payment Merchant Credential Distributed in Source Code

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: index.js:45

Finding

Agent Prompt Injection Through Untrusted Topic and Option Values

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: package-lock.json:23

Finding

Dependencies Locked to a Plaintext Third-Party Registry Mirror

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose is benign LinkedIn post generation, but the skill metadata indicates additional behaviors: payment processing via skillpay.me, fallback use of an embedded merchant key, and external/local agent execution through a gateway token. This mismatch is dangerous because users and reviewers may not realize the skill can make billable or authenticated external calls, increasing the risk of unauthorized charges, secret misuse, and hidden network interactions.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · index.js (reported line 82)May include surrounding context.

js

prompt += `\nReturn ONLY the post content, no explanations.`;
  
  return prompt;
}

/**

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile pins axios to 1.13.6, and the static analysis indicates multiple known advisories affecting that version, including SSRF-related proxy bypass and prototype-pollution-adjacent request/response manipulation risks. In a skill that generates LinkedIn posts and likely makes outbound API requests, a vulnerable HTTP client increases the chance of server-side request forgery, credential leakage, or tampering with request handling if untrusted input influences destinations or config.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

form-data 4.0.5 is reported vulnerable to CRLF injection via unescaped multipart field names/filenames. If this skill ever uploads files or constructs multipart requests using attacker-influenced metadata, an attacker may be able to inject crafted headers or manipulate request structure, potentially leading to request smuggling-like effects or downstream abuse.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The package allows installation of an axios version identified by the scanner as having multiple known security advisories, including SSRF/proxy-bypass and prototype-pollution-related issues. If the skill uses axios for outbound requests, these flaws could enable request redirection, credential leakage, response tampering, or abuse of network trust boundaries depending on how HTTP input is handled.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to run npx clawhub@latest install linkedin-post-generator, which pulls and executes the latest version of a remote package at install time rather than a pinned, reviewed version. If the upstream package is compromised or a malicious update is published, users could execute attacker-controlled code simply by following the installation instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that payment is handled automatically using an embedded merchant key and notes only a --test flag, but it does not prominently warn that normal usage may trigger real charges. This creates a significant risk of unexpected financial transactions and reduces informed user consent, especially because users may treat a content-generation CLI as harmless to try.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill advertises environment-variable-based capabilities (SKILLPAY_MERCHANT_KEY, OPENCLAW_GATEWAY_TOKEN) but declares no explicit tool scope or permissions. That creates an authorization and transparency gap: a user or platform may treat the skill as simple content generation while it can access sensitive runtime configuration and potentially trigger authenticated behaviors.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The code is configured to communicate with an external billing service (api.skillpay.me). External transmission is not inherently unsafe, but in this case it is security-relevant because the skill's stated purpose does not mention payment processing, and the transmission involves billing operations and credentials. The mismatch between advertised function and actual data flow makes the behavior more dangerous.

Content

Scanner excerpt · index.js (reported line 14)May include surrounding context.

js

// Configuration
const CONFIG = {
  skillpay_api: 'https://api.skillpay.me/v1',
  merchant_key: process.env.SKILLPAY_MERCHANT_KEY || 'sk_91fff75ae2a7a71f8eceadcbcd816e24d57e58d9d04ccca45f0b3856af130aea',
  price_per_use: 0.002,
  currency: 'USDT',

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill spawns an external CLI (openclaw) to process user-controlled prompt content. For a simple LinkedIn post generator, invoking a subprocess materially expands the attack surface, introduces dependency on local executables and PATH trust, and is not clearly disclosed by the skill description. In this context, the capability is more dangerous because it allows unexpected local code execution paths in an otherwise content-generation skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill sends user-provided topic content to a local HTTP agent endpoint without explicit disclosure. Even though the destination is localhost, this still transmits potentially sensitive user input to another service boundary, and localhost services may be privileged, developer-only, or differently secured than the skill runtime. The context makes this concerning because users would reasonably expect local text generation, not hidden forwarding to another service.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · index.js (reported line 104)May include surrounding context.

js

return parseAgentResponse(result);
  } catch (cliError) {
    try {
      const response = await axios.post('http://localhost:18789/api/agent/run', {
        agentId: 'sloan',
        prompt: prompt,
        stream: false

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill performs billing and charge operations even though the manifest describes only LinkedIn post generation. Hidden monetization behavior is dangerous because users and host platforms may not expect outbound payment requests or balance deductions, creating consent, trust, and abuse risks. The context increases severity because charging is embedded in normal execution rather than clearly separated as an explicit purchase flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The payment request transmits a merchant credential and even includes a hardcoded fallback secret in source. Embedded or silently transmitted credentials are dangerous because they can be extracted from the package, reused for unauthorized charges, and expose the merchant account to fraud or abuse. In this skill context, there is no clear disclosure or secure secret handling boundary, making misuse more likely.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Because axios depends on this package, any authenticated outbound request that follows redirects could accidentally disclose bearer tokens or API keys to an attacker-controlled host if redirect targets are not tightly controlled.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency is specified with a caret range (^1.6.0), which permits automatic installation of newer minor and patch releases rather than a fully fixed version. In a skill that may be installed and executed in different environments, this reduces supply-chain determinism and can unintentionally pull in vulnerable or behavior-changing releases, as reflected by the separate vulnerable-dependency finding for axios.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json

"author": "Matt",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0"
  },
  "engines": {
    "node": ">=18.0.0"