ClawHub
Back to skill

Security audit

Bluesky

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Bluesky command-line skill that can read and change a user's Bluesky account, with expected local session storage and setup behavior.

Install only if you want an agent-accessible Bluesky CLI that can post publicly and change your account state. Use a Bluesky app password, revoke it from Bluesky settings if needed, consider setting BSKY_CONFIRM_MUTATIONS=1 for confirmation prompts, and review targets carefully before delete, follow, block, mute, repost, or similar actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill clearly instructs the agent to use shell commands, read local auth state via `bsky whoami`, and rely on files such as `~/.config/bsky/config.json`, yet it declares no permissions. This creates a transparency and least-privilege problem: users and platforms may underestimate the skill's ability to access environment state, local files, and execute commands affecting an authenticated social-media account.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding
The declared description understates the full behavior of the skill by omitting authentication/session management and additional account-mutating functions such as delete and quote-post. This mismatch can mislead users or policy enforcement into approving a skill that has broader and more sensitive capabilities than advertised, especially because it operates on a live social account with persistent session storage.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The create-thread command can publish multiple posts sequentially and may fail partway through, leaving a partially published thread that cannot be atomically rolled back. In an agent setting, this is risky because a single invocation can cause unintended, irreversible public actions before an error is detected.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
# delete
    del_p = subparsers.add_parser("delete", aliases=["del", "rm"], help="Delete a post")
    del_p.add_argument("post_id", help="Post ID or URL")
    del_p.add_argument("--yes", action="store_true", help="Skip confirmation prompt")

    # profile
    profile_p = subparsers.add_parser("profile", help="Show profile")
Confidence
78% confidence
Finding
Skip confirmation

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
# repost
    repost_p = subparsers.add_parser("repost", aliases=["boost", "rt"], help="Repost")
    repost_p.add_argument("uri", help="Post URI or URL to repost")
    repost_p.add_argument("--yes", action="store_true", help="Skip confirmation prompt")

    # unrepost
    unrepost_p = subparsers.add_parser(
Confidence
70% confidence
Finding
Skip confirmation

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
)
    unrepost_p.add_argument("uri", help="Post URI or URL to unrepost")
    unrepost_p.add_argument(
        "--yes", action="store_true", help="Skip confirmation prompt"
    )

    # follow
Confidence
68% confidence
Finding
Skip confirmation

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
# follow
    follow_p = subparsers.add_parser("follow", help="Follow a user")
    follow_p.add_argument("handle", help="Handle to follow")
    follow_p.add_argument("--yes", action="store_true", help="Skip confirmation prompt")

    # unfollow
    unfollow_p = subparsers.add_parser("unfollow", help="Unfollow a user")
Confidence
72% confidence
Finding
Skip confirmation

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
unfollow_p = subparsers.add_parser("unfollow", help="Unfollow a user")
    unfollow_p.add_argument("handle", help="Handle to unfollow")
    unfollow_p.add_argument(
        "--yes", action="store_true", help="Skip confirmation prompt"
    )

    # block
Confidence
72% confidence
Finding
Skip confirmation

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
# block
    block_p = subparsers.add_parser("block", help="Block a user")
    block_p.add_argument("handle", help="Handle to block")
    block_p.add_argument("--yes", action="store_true", help="Skip confirmation prompt")

    # unblock
    unblock_p = subparsers.add_parser("unblock", help="Unblock a user")
Confidence
83% confidence
Finding
Skip confirmation

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
unblock_p = subparsers.add_parser("unblock", help="Unblock a user")
    unblock_p.add_argument("handle", help="Handle to unblock")
    unblock_p.add_argument(
        "--yes", action="store_true", help="Skip confirmation prompt"
    )

    # mute
Confidence
68% confidence
Finding
Skip confirmation

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
# mute
    mute_p = subparsers.add_parser("mute", help="Mute a user")
    mute_p.add_argument("handle", help="Handle to mute")
    mute_p.add_argument("--yes", action="store_true", help="Skip confirmation prompt")

    # unmute
    unmute_p = subparsers.add_parser("unmute", help="Unmute a user")
Confidence
72% confidence
Finding
Skip confirmation

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
# unmute
    unmute_p = subparsers.add_parser("unmute", help="Unmute a user")
    unmute_p.add_argument("handle", help="Handle to unmute")
    unmute_p.add_argument("--yes", action="store_true", help="Skip confirmation prompt")

    # stats
    stats_p = subparsers.add_parser("stats", help="Show account stats")
Confidence
66% confidence
Finding
Skip confirmation

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.