ClawHub
Back to skill

Security audit

dropspace

Security checks for vulnerabilities and agentic risk

Overview

This Dropspace skill mostly documents legitimate API use, but it can publish or delete real social posts and points to an unpinned MCP package, so it should be reviewed before installation.

Install only if you trust the Dropspace service and package publisher. Prefer direct API use or a pinned, reviewed MCP package version, run it with minimal filesystem and environment access, and create a separate least-privilege Dropspace API key without publish, delete, or admin scopes unless those actions are explicitly needed. Confirm every live publish, scheduled publish, retry, key/webhook change, and post deletion before allowing an agent to execute it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:32
Finding

Unpinned Third-Party Package Download and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 32
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code:

text
Also available as MCP server: `npx @jclvsh/dropspace-mcp`

Technical Analysis

The documentation recommends running a third-party npm package through npx without pinning a specific version or verifying its integrity. Depending on the local npm/npx configuration and cache state, this command can download the current package release from the npm registry and execute it immediately.

Consequently, the code executed by users can change after this Skill has been audited. The project contains no vendored package source, lockfile, checksum, or signature that would allow the referenced MCP implementation to be verified against a reviewed version. The package namespace also differs from the repository owner listed in the Skill metadata, increasing the importance of documenting and verifying the authoritative publisher.

This is a supply-chain risk rather than proof that the current npm package is malicious.

Attack Path

  1. An attacker compromises the npm publisher account, the package's release pipeline, or another relevant distribution component.
  2. The attacker publishes a malicious version of @jclvsh/dropspace-mcp.
  3. A user or Agent follows the documented unversioned npx command.
  4. npx retrieves the mutable package release and executes its lifecycle or application code.
  5. The malicious package runs with the privileges of the invoking user and can attempt to access environment variables, local files, network resources, and Agent-accessible services.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking process's user privileges. Because this Skill requires DROPSPACE_API_KEY in the environment, malicious package code could potentially read and exfiltrate that credential. Depending on the ke ...[truncated 674 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the unversioned command with an exact, reviewed package version, for example:

    bash
    npx --yes @jclvsh/dropspace-mcp@X.Y.Z

    Do not use a floating tag such as latest, ^X.Y.Z, or ~X.Y.Z.

  2. Prefer installing the dependency through a committed package manifest and lockfile so the resolved dependency graph and integrity metadata can be reviewed and reproduced.

  3. Verify package provenance and document the authoritative npm publisher. Enable npm provenance/signature checks where available and compare the distributed artifact with the referenced source repository.

  4. Review the package and its transitive dependencies before recommending execution. Update the pinned version only after security review.

  5. Run the MCP server in a restricted environment with minimal filesystem access, network access, environment variables, and Agent tool permissions.

  6. Pass only a least-privilege Dropspace API key to the process. Keep publish, delete, and admin scopes disabled unless explicitly required, and use a separate short-lived or readily revocable key for MCP operation.

  7. Avoid exposing unrelated secrets to the process, monitor package-version changes, and rotate the Dropspace key promptly if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The bulk delete endpoint DELETE /launches/:id/posts can remove all published posts for a launch, making it especially dangerous in an autonomous tool-use environment. Without mandatory confirmation and tight parameter checks, a mistaken or maliciously induced call could cause broad, irreversible deletion across multiple social platforms.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

md
- `logId` is the posting_log UUID from the `/status` endpoint
- If post was already deleted on platform (404), treated as successful deletion
- On success, posting log status updated to `deleted`
- Use Dropspace API: `DELETE /launches/:id/posts/:logId` or `DELETE /launches/:id/posts`

## Personas (Writing Styles)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The bulk delete endpoint DELETE /launches/:id/posts can remove all published posts for a launch, making it especially dangerous in an autonomous tool-use environment. Without mandatory confirmation and tight parameter checks, a mistaken or maliciously induced call could cause broad, irreversible deletion across multiple social platforms.

Content

Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.

md
- `logId` is the posting_log UUID from the `/status` endpoint
- If post was already deleted on platform (404), treated as successful deletion
- On success, posting log status updated to `deleted`
- Use Dropspace API: `DELETE /launches/:id/posts/:logId` or `DELETE /launches/:id/posts`

## Personas (Writing Styles)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description includes a very broad trigger phrase such as 'anything Dropspace-related,' which can cause the skill to activate for loosely related requests. In an agent setting, over-broad routing increases the chance that high-impact actions like publishing, modifying launches, or deleting posts are selected without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The skill instructs users to run an MCP server via npx @jclvsh/dropspace-mcp without pinning an exact version or integrity value. That creates a supply-chain risk: future package updates or a compromised package release could change behavior and gain access to API keys or posting actions when invoked in an agent environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

1. Check connected platforms

bash
# User's OAuth connections
curl -s https://api.dropspace.dev/connections \
  -H "Authorization: Bearer $DROPSPACE_API_KEY"

# Official Dropspace accounts available for posting

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

1. Check connected platforms

bash
# User's OAuth connections
curl -s https://api.dropspace.dev/connections \
  -H "Authorization: Bearer $DROPSPACE_API_KEY"

# Official Dropspace accounts available for posting

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

1. Check connected platforms

bash
# User's OAuth connections
curl -s https://api.dropspace.dev/connections \
  -H "Authorization: Bearer $DROPSPACE_API_KEY"

# Official Dropspace accounts available for posting

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

1. Check connected platforms

bash
# User's OAuth connections
curl -s https://api.dropspace.dev/connections \
  -H "Authorization: Bearer $DROPSPACE_API_KEY"

# Official Dropspace accounts available for posting

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

1. Check connected platforms

bash
# User's OAuth connections
curl -s https://api.dropspace.dev/connections \
  -H "Authorization: Bearer $DROPSPACE_API_KEY"

# Official Dropspace accounts available for posting

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

1. Check connected platforms

bash
# User's OAuth connections
curl -s https://api.dropspace.dev/connections \
  -H "Authorization: Bearer $DROPSPACE_API_KEY"

# Official Dropspace accounts available for posting

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

1. Check connected platforms

bash
# User's OAuth connections
curl -s https://api.dropspace.dev/connections \
  -H "Authorization: Bearer $DROPSPACE_API_KEY"

# Official Dropspace accounts available for posting

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

1. Check connected platforms

bash
# User's OAuth connections
curl -s https://api.dropspace.dev/connections \
  -H "Authorization: Bearer $DROPSPACE_API_KEY"

# Official Dropspace accounts available for posting

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

1. Check connected platforms

bash
# User's OAuth connections
curl -s https://api.dropspace.dev/connections \
  -H "Authorization: Bearer $DROPSPACE_API_KEY"

# Official Dropspace accounts available for posting

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

1. Check connected platforms

bash
# User's OAuth connections
curl -s https://api.dropspace.dev/connections \
  -H "Authorization: Bearer $DROPSPACE_API_KEY"

# Official Dropspace accounts available for posting

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 386)May include surrounding context.

1. Check connected platforms

bash
# User's OAuth connections
curl -s https://api.dropspace.dev/connections \
  -H "Authorization: Bearer $DROPSPACE_API_KEY"

# Official Dropspace accounts available for posting

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents immediate publishing and deletion-capable operations without a strong, explicit warning that these actions have irreversible real-world effects on social accounts and content. In an autonomous or semi-autonomous agent context, missing confirmation guardrails can lead to accidental public posting or deletion based on ambiguous prompts or model misinterpretation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

3. Review & edit content

bash
# Edit specific platform content:
curl -s -X PATCH https://api.dropspace.dev/launches/LAUNCH_ID \
  -H "Authorization: Bearer $DROPSPACE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"platform_contents": {"twitter": {"thread": ["tweet 1", "tweet 2", "tweet 3"]}}}'

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description states support for 10 platforms including YouTube, but the SKILL.md "Supported Platforms" list omits YouTube and enumerates only 9 platforms. This is an active contradiction in the skill’s own documentation about what the skill supports.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.