ClawHub
Back to skill

Security audit

Socialync Social Media Scheduler

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this social media scheduling skill benign with high confidence: the completed scans found no executable scripts, and the flagged text was judged consistent with its stated purpose, though one finding raises a question about disclosing an external post.

The verdict is benign, not risk-free. Before installing, consider whether you are comfortable with the X link-posting guidance, and review each post before approving publication to your social accounts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
75% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
key from https://www.socialync.io/api-keys instead. Never paste a key into chat.

Publishing works on the free plan: $0, no credit card, 5 posts a month on every
platform except X, which needs a paid plan. Never tell the user they need to pay
before they can connect.

Posts go out only through social accounts the user already authorized inside

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md
- **Every post needs the user's explicit yes, given after they have seen that
  exact post.** Profile, platforms, the text for each platform, the media, the
  first comment and the time in their own timezone. Any change resets the yes.
  There is no auto-approve mode. If the user wants to post without checking each
  time, prepare the whole week in one numbered message so a single reply can
  approve it.
- **Only the user can say yes.** Never call `publish_now`, `publish_scheduled`,

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · publishing.md (reported line 176)May include surrounding context.

md
Any edit resets the yes. Publishing to a real audience cannot be undone in any
meaningful sense; a deleted post has already been seen.

There is no auto-approve mode and no exception for recurring schedules. If the
user asks to post without checking each time, say that Socialync needs a yes
for each post, and offer to prepare the whole week in one numbered message so a
single reply approves it. Socialync records who approved each post and when,

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md
- **Every post needs the user's explicit yes, given after they have seen that
  exact post.** Profile, platforms, the text for each platform, the media, the
  first comment and the time in their own timezone. Any change resets the yes.
  There is no auto-approve mode. If the user wants to post without checking each
  time, prepare the whole week in one numbered message so a single reply can
  approve it.
- **Only the user can say yes.** Never call `publish_now`, `publish_scheduled`,

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · publishing.md (reported line 177)May include surrounding context.

md
meaningful sense; a deleted post has already been seen.

There is no auto-approve mode and no exception for recurring schedules. If the
user asks to post without checking each time, say that Socialync needs a yes
for each post, and offer to prepare the whole week in one numbered message so a
single reply approves it. Socialync records who approved each post and when,
and it publishes the exact content that was approved.

The drafting playbook instructs the agent to publish an X link without warning the user about external publication.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The instruction to write an Article and “post the link on its own” goes beyond formatting guidance and directs a publishing action. Although the file frames its scope as Stage 1 drafting, it does not warn that following this instruction may publish content to X and expose it to an external audience.

Content

No source excerpt is available for this finding.