ClawHub
Back to skill

Security audit

Buffer API

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a real Buffer API helper, but it uses a powerful account key and can create, edit, reorder, or delete social posts without enough safety guidance.

Install only if you are comfortable giving the agent Buffer account authority. Prefer BUFFER_API_KEY or a secret manager instead of --key, require explicit confirmation before edits/deletes/reordering, and only verify media URLs from trusted public hosting domains.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/buffer_graphql.py:51
Finding

Buffer API key exposure through command-line arguments

Content
View full analysis
/cmdline`. - Shell command history. - CI/CD job output and orchestration metadata. - Agent tool-call logs, terminal recording, and execution telemetry. - Process monitoring or endpoint-management software. The script does not print the key itself, but accepting it as a command-line argument undermines that protection because the operating environment may record the complete invocation before the script starts. Sending the API key in the HTTPS `Authorization` header to the fixed official Buffer endpoint is necessary for the declared functionality. The vulnerability is the optional command-line secret transport mechanism, not the authenticated network request. ### Attack Path 1. A user or agent follows the documented example and invokes the helper with `--key `. 2. The operating system, shell, CI system, or agent runtime records or exposes the process command line. 3. Another local user, monitoring service, log reader, or compromised process obtains the API key. 4. The attacker submits authenticated requests to the Buffer GraphQL API using the stolen key. 5. The attacker performs any accou ...[truncated 844 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/media-and-metadata.md:12
Finding

Unsafe shell-based verification of attacker-controlled media URLs

Content
View full analysis
| head -1 ``` Expect `HTTP/1.1 200 OK` (or `204 No Content`). ``` ### Technical Analysis The Skill instructs an agent to interpolate a media URL into a shell command without requiring validation, quoting, or argument termination. If the URL originates from an untrusted user and an automated agent performs textual substitution, shell metacharacters may be interpreted as commands. For example, an input containing command separators, substitutions, redirections, or newlines could change the meaning of the documented command if inserted directly. Quoting alone would reduce shell injection risk but would not address URL-based network attacks. The instruction also permits arbitrary destinations. An attacker could provide a URL targeting: - Loopback services. - Private network addresses. - Link-local or cloud instance metadata endpoints. - Internal hostnames resolved by the agent's DNS environment. - A public endpoint that redirects to an internal destination. The resulting `curl` request would originate from the agent host rather than the attacker's system. This can provide network reachability that the attacker does not possess directly. Media availability verification is relevant to the Skill's functionality, but unrestricted shell execution and internal-address access are not required. ### Attack Path #### Shell-injection path 1. An attacker supplies a crafted string as the purported public me ...[truncated 1645 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documents use of environment secrets and outbound network access to Buffer, but it does not declare any explicit tool scope, permissions, or allowed-tools boundaries. In agent environments, this can cause over-broad execution authority, making it easier for the skill to access secrets or send data externally without clear policy enforcement or user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill includes deletePost as a normal management operation but provides no guidance to require user confirmation, preview the target post, or constrain deletion to clearly authorized workflows. In an agent context, this increases the risk of accidental or prompt-induced destructive actions against scheduled or existing social content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md
- `post` QUERY (not `getPost`): Buffer has NO `getPost` field; the arg is `input: { id }`.
- **urllib / non-ASCII bodies:** if you are writing Python, `urllib.request` throws
  `UnicodeEncodeError: 'latin-1'` on a non-ASCII char (e.g. an em dash) in a JSON body —
  use `requests.post(..., json=...)` for non-ASCII payloads. This is a real, repeated gotcha.
- **JSON-LD/latin-1 hardware:** run scripted API calls with a healthy interpreter
  (`env -u PYTHONPATH python3` on the Hermes box).
- **Auth is Bearer only.** The legacy REST (`api.bufferapp.com/1/`) is RETIRED

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file lists state-changing and destructive operations such as deletePost and deletePostTemplate as available mutations, but it does not warn that these actions can remove user content or otherwise affect account data. Under the markdown-specific warning criterion, documentation should disclose behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.