ClawHub
Back to skill

Security audit

IMC Publish

Security checks for vulnerabilities and agentic risk

Overview

The publishing workflow is mostly disclosed and confirmation-gated, but the built-in updater can replace installed skill code from a moving GitHub branch without integrity checks.

Review before installing if you are comfortable giving this skill a workspace publishing key and authority to upload media and publish after confirmation. Prefer the platform-managed updater instead of the built-in update command, and require a clear preview plus explicit yes before any confirm or post action.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The script includes a self-update command that downloads a remote tarball from GitHub and overwrites the local skill directory. Even though it performs basic archive path checks, it does not verify a signed release, pinned commit, or trusted checksum before replacing executable code, creating a software supply-chain risk.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The README states the skill 'triggers automatically on publish-related requests,' which is broad enough that normal conversation about publishing could invoke the skill unexpectedly. Because this skill can post to external social channels using a configured API key, unintended invocation could lead to accidental posting workflows, disclosure of draft content to a third-party service, or user confusion about why external actions were initiated.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The manifest description includes very broad trigger phrases such as "publish", "post to", and common platform names, which can cause the skill to activate on ordinary conversation that merely mentions social media rather than clearly requesting publication. In a skill that can perform external side effects against connected accounts, over-broad activation increases the risk of unintended draft creation or posting workflow initiation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The update path performs a network download and then copies the unpacked contents over the existing installation with no interactive confirmation and no authenticity verification beyond archive shape checks. A compromised upstream repository, network trust failure, or accidental invocation could replace local code and persist malicious behavior.

Session Persistence

Medium
Category
Rogue Agent
Content
set -euo pipefail
SRC="$(cd "$(dirname "$0")" && pwd)"
DEST="$HOME/.claude/skills/imc-publish"
mkdir -p "$HOME/.claude/skills"
rm -rf "$DEST"
cp -r "$SRC" "$DEST"
rm -f "$DEST/install.sh" "$DEST/uninstall.sh"
Confidence
75% confidence
Finding
The installer persists code into ~/.claude/skills/imc-publish, making the skill available in future agent sessions. While persistence is the intended behavior of a skill installer, it still changes the user's long-lived agent environment and could be abused if the copied skill contents are later found to be unsafe or altered.

Self-Modification

High
Category
Rogue Agent
Content
post --caption C --platforms a,b [...]   One-call publish (trusted keys only)
  status <post_id>                         Check publish status (per-platform results)
  list [--limit N]                         Recent posts from this workspace
  update                                   Update this skill to the latest version
"""
from __future__ import annotations
Confidence
90% confidence
Finding
Advertising an update capability in the command list corresponds to real self-modifying behavior elsewhere in the file. In this skill context, remote code download and local overwrite are higher risk because the core purpose is publishing content, not managing software lifecycle, so self-modification is not essential to mission functionality.

Self-Modification

High
Category
Rogue Agent
Content
listing.add_argument("--limit", default=20)
    listing.set_defaults(fn=cmd_list)

    sub.add_parser("update", help="update this skill to the latest version").set_defaults(fn=cmd_update)

    parser.add_argument("--version", action="version", version=f"imc-publish {__version__}")
Confidence
90% confidence
Finding
The parser exposes an update subcommand that triggers code replacement of the installed skill. Because it is directly invokable by users or calling agents, it expands the attack surface and can be abused to introduce untrusted code if the update source is compromised.

Self-Modification

High
Category
Rogue Agent
Content
print(json.dumps(data, ensure_ascii=False, indent=2))


# --- self-update --------------------------------------------------------------

SKILL_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
Confidence
93% confidence
Finding
The self-update section implements local self-modification by downloading and copying new files into the skill directory. Self-modifying behavior is dangerous because it can convert a normally constrained client into a persistence or supply-chain compromise vector if the source repository or transport trust is subverted.

Static analysis

No suspicious patterns detected.