ClawHub
Back to skill

Security audit

Social Poster

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it can publish social posts through a third-party service using a hardcoded shared API key and broad triggers without a clear confirmation guard.

Review before installing. Use this only if you are comfortable with user-provided post text being sent to the VibePost Replit endpoint and potentially published. The publisher should remove the hardcoded shared API key, move authentication to user-specific secrets, narrow triggers, and require explicit confirmation of the exact post and platform before sending.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/post.mjs:20
Finding

Hard-Coded Shared API Credential

Content
View full analysis

Vulnerability Details

File Location: scripts/post.mjs, lines 20–27
Vulnerability Type: Hard-coded reusable API secret
Risk Level: High

Vulnerable Code

js
const API_KEY = 'quack_5c6786fb7ac8f08c638d5db176d60b12b906b78ac63d21cf';
const url = 'https://vibepost-jpaulgrayson.replit.app/api/quack/post';

const res = await fetch(url, {
  method: 'POST',
  headers: {
    'x-quack-api-key': API_KEY,
    'Content-Type': 'application/json',
  },

Technical Analysis

A live-looking, reusable API key is embedded directly in distributable source code and sent in the x-quack-api-key header to a third-party Replit-hosted endpoint. Anyone who can access the Skill package can extract this credential without executing the script.

Sending user-supplied post text to the documented VibePost endpoint is necessary for the Skill's declared social-posting function. Embedding and distributing a shared credential is not necessary, however, and violates least-privilege and secure secret-management principles. The shared key also prevents reliable attribution and isolation between users.

Attack Path

  1. Obtain or inspect the distributed Skill package.
  2. Open scripts/post.mjs and extract the API key from line 20.
  3. Construct an independent HTTP request to the documented endpoint.
  4. Place the extracted key in the x-quack-api-key header.
  5. Submit attacker-controlled text and platform values.
  6. If the server accepts the shared credential, perform posting operations or consume service resources outside the intended Skill workflow.

Impact Assessment

Successful exploitation may permit unauthorized posting, impersonation, quota consumption, service abuse, and loss of accountability between Skill users. The accessible scope is limited to the permissions granted to the exposed API key and the operations accepted by the remote endpoint; the audited source does not establish any broader system pr ...[truncated 285 chars]

Remediation
View remediation

Remediation Suggestions

  1. Revoke and rotate the exposed API key immediately.
  2. Remove the credential from source code and repository history.
  3. Obtain a user-specific credential from a protected environment variable or secret manager at runtime.
  4. Fail safely with a clear error when no credential is configured; do not provide a shared fallback key.
  5. Issue narrowly scoped, short-lived credentials where supported.
  6. Enforce per-user authorization, posting limits, rate limits, auditing, and credential revocation on the backend.
  7. Prevent recurrence with secret-scanning checks in version control and CI.
  8. Avoid logging credentials or including them in error messages.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill documents network-capable behavior but declares no explicit tool scope or permissions boundary. In an agent environment, that increases the chance of unintended or unauthorized outbound requests, especially since this skill can publish content to an external service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger phrases are broad enough that ordinary conversation about tweeting or sharing updates could invoke this skill unintentionally. Because the skill performs an external publishing action, accidental invocation could cause unauthorized or embarrassing posts to be sent to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description explains posting mechanics but does not prominently warn that using the skill will publish content to an external social media service. In this context, missing user-facing warning is dangerous because the consequence is irreversible outbound publication, reputational harm, and possible disclosure of sensitive information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script transmits user-provided post content to an external third-party API endpoint but does not clearly disclose that data will leave the local environment or identify the recipient to the user at runtime. In a skill intended for automated posting, this creates a meaningful privacy and trust risk because operators may assume the tool posts directly to the target platform rather than relaying content through an intermediary service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The documentation explicitly states that the API key is configured in the script, which is a concrete implementation claim. However, the rest of the file only documents a command invocation and header usage, with no evidence in this file that a key is actually embedded, making the documentation potentially misleading about how authentication is handled.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.