Social Media Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 1.1.0

Overview

This skill is a coherent social media manager, but it can publish or schedule public posts without clearly documented previews, confirmations, platform scope, or install-version pinning.

Review this skill before installing if you plan to let an agent publish on your behalf. Use a pinned, trusted installer version where possible, avoid running installation with elevated privileges, and require a preview plus explicit approval for each post, scheduled post, target platform, and account.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:13

Finding

Execution of an Unpinned Third-Party Package During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 13-17
Vulnerability Type: Supply-chain exposure through a mutable package version
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Installation

```bash
npx clawhub@latest install social-media-manager

text

### Technical Analysis

The documented installation command uses `npx` to retrieve and execute the `clawhub` npm package identified by the mutable `@latest` tag. Because neither an exact package version nor an integrity hash is specified, the code executed by this command can change after the Skill has been reviewed.

This artifact does not contain evidence that the referenced package is currently malicious. However, the installation mechanism creates a supply-chain trust boundary: compromise of the package, its maintainer account, or the configured npm registry could cause users to execute attacker-controlled code. Package lifecycle hooks or the CLI entry point may run with the permissions of the user invoking `npx`.

### Attack Path

1. An attacker compromises the `clawhub` npm package, its publisher credentials, or the registry path from which it is resolved.
2. The attacker publishes a modified release and causes it to become the version referenced by `@latest`.
3. A user follows the installation instructions and runs:
   `npx clawhub@latest install social-media-manager`.
4. `npx` downloads the mutable package release and executes its CLI or applicable lifecycle behavior.
5. The attacker-controlled code runs locally with the invoking user's privileges.

### Impact Assessment

Successful exploitation could provide arbitrary code execution under the account running the installation command. Depending on that account's privileges and environment, the malicious package could access user-readable files, environment variables, authentication material, project data, or network resources, and could modify files writable by that us
...[truncated 270 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version, for example clawhub@X.Y.Z.
2. Verify the package against an expected integrity digest before execution.
3. Document the trusted npm registry and package publisher so package resolution cannot silently use an unintended source.
4. Use a lockfile or another reproducible installation mechanism where supported.
5. Review package lifecycle scripts and CLI entry points before recommending execution.
6. Run installation with a non-privileged account and avoid sudo or administrator execution.
7. Consider separating package download from execution so users can inspect and verify the resolved artifact first.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to run npx clawhub@latest install social-media-manager, which fetches and executes the latest published package version at install time rather than a pinned, reviewed version. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users may execute untrusted code simply by following the documented installation step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises multi-platform posting and scheduled publishing to external services without any warning, confirmation step, or explanation that user-provided content may be transmitted to third-party platforms. This creates a real risk of unintended disclosure, accidental posting, or users triggering external actions without understanding the consequences, especially in an agentic context where commands may be executed on the user's behalf.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README description is written in Chinese only and does not indicate that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The description and all user-facing instructions are presented only in Chinese, with no indication that users can choose another language or that the tool is intentionally limited to a Chinese-only locale. This can violate language/locale policy when a skill imposes a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.