ClawHub
Back to skill

Security audit

Social Media Assistant (via post-bridge.com)

Security checks across malware telemetry and agentic risk

Overview

This skill appears legitimate, but it gives an agent broad social-media posting and deletion power without clear approval safeguards.

Install only if you are comfortable letting an agent act through your connected Post Bridge social accounts. Set your own operating rule that the agent must show the target accounts, caption, media, timing, and action type, then get explicit approval before posting, scheduling, editing, syncing analytics, or deleting anything. Keep the API key out of shared logs and rotate it if exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill documents a destructive DELETE operation for scheduled posts but provides no guidance to require explicit user confirmation, preview the target post, or verify intent before execution. In an autonomous agent context, this increases the risk of accidental or manipulated deletion of legitimate scheduled content.

Missing User Warnings

Low
Confidence
72% confidence
Finding
The skill description emphasizes autonomous social media management and analytics across multiple connected platforms without warning that it can access account identifiers, post metadata, and performance data. This omission can mislead users about the breadth of cross-platform data exposure, especially when used by autonomous agents.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.