ClawHub
Back to skill

Security audit

antwork

Security checks for vulnerabilities and agentic risk

Overview

The skill provides a clearly disclosed social-media integration with user-controlled publishing and confirmation before deletion.

Review the OAuth permissions, select the intended workspace and accounts, and upload only media you intend Antwork to store or publish. A request to publish or schedule authorizes that action. This review covered the complete bundled skill instructions, not the remote service's implementation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

The skill needs the Antwork MCP server connected. It is a remote server with OAuth — there is no API key to paste.

sh
mcporter config add antwork --url https://api.antwork.io/mcp --auth oauth

Complete the browser prompt and you are connected. A free account is enough: two connected social accounts, no monthly post limit (each account has a per-platform daily cap over a rolling 24 hours, returned as dailyPostCap by get_post_context), and no plan gate on MCP access. Sign up and connect your social accounts at https://antwork.io.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
## 1. Resolve the workspace and the account first

`workspace_id` is optional on every tool and auto-resolves when the user has exactly one workspace. If they have several and no default, call `set_default_workspace` once — do not thread `workspace_id` through every later call, and do not ask the user the same question every turn.

`create_post` targets **one account** via `account_id`. Call `list_social_accounts` for the target account's id and check its `tokenHealthStatus`. If it reads `expired` or `needs_reconnection`, stop and surface the `reauthUrl` — a post against a dead account fails at publish time, not at draft time.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
pts: `text`, `account_id`, `hashtags`, `goal`, `scheduled_for`, `campaign_id`, `user_tags`, `pinterest_board_id`, `platform_options`, `variants`, `workspace_id`. Media is **not** a create-time field: add it afterwards with `add_media`, which attaches to every post in `attach_to_post_ids` in one call. TikTok and YouTube need a video, Instagram and Pinterest an image or video, so ask for media in the same turn as the draft. A local file: `add_media(upload={}, attach_to_post_ids=[...])`, then one `curl -X PUT --data-binary @<file>` to the returned `uploadUrl` (the reply says what was attached). A public URL: `add_media(url=..., attach_to_post_ids=[...])`. Something already in the library: `add_media(media_urls=[...], attach_to_post_ids=[...])`. If neither works, give the user the post's `mediaUrl` from the `create_post` result: it opens the post in the Antwork composer with the media picker open. TikTok's audience is the user's choice, not yours: point them to the post's `settingsUrl`. Pa