Mosaic Video Editor

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.3.0

Overview

This skill appears to be a legitimate Mosaic API helper, but it asks for persistent API-key access and can affect billing, social accounts, public posts, and uploaded media.

Install only if you are comfortable giving the skill a Mosaic API key with authority over your Mosaic account. Prefer a session-scoped or limited token if available, confirm the exact social account/post/agent before any publish, update, delete, or disconnect action, review plan and auto-top-up costs before approving billing changes, and only use trusted webhook URLs and media you are authorized to upload.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/docs-endpoints.md (reported line 52)May include surrounding context.

md

- [`POST /social/{platform}/connect`](https://docs.mosaic.so/api/social/post-social-platform-connect)
- [`GET /social/{platform}/status`](https://docs.mosaic.so/api/social/get-social-platform-status)
- [`DELETE /social/{platform}/remove`](https://docs.mosaic.so/api/social/delete-social-platform-remove)
- [`POST /social/post`](https://docs.mosaic.so/api/social/post-social-post)
- [`GET /social/post/{post_id}`](https://docs.mosaic.so/api/social/get-social-post)
- [`GET /social/post/track/{tracking_id}`](https://docs.mosaic.so/api/social/get-social-post-track)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/docs-endpoints.md (reported line 57)May include surrounding context.

md

- [`GET /social/post/{post_id}`](https://docs.mosaic.so/api/social/get-social-post)
- [`GET /social/post/track/{tracking_id}`](https://docs.mosaic.so/api/social/get-social-post-track)
- [`PATCH /social/post/{post_id}`](https://docs.mosaic.so/api/social/patch-social-post)
- [`DELETE /social/post/{post_id}`](https://docs.mosaic.so/api/social/delete-social-post)

## Asset management

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

This endpoint disconnects a social platform account, which is a state-changing action against an external integration. In a skill designed for autonomous API use, exposing destructive operations without guardrails or confirmation can enable parameter abuse, causing account disruption or service interruption if the wrong platform is targeted.

Content

Scanner excerpt · workflows/social-publishing.md (reported line 35)May include surrounding context.

Disconnect a platform

text

DELETE /social/{platform}/remove

Docs

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

Deleting a social post is a destructive external action and can remove published content from a user's public presence. In this skill's context, the risk is elevated because the same workflow supports publishing and account management, so an agent with broad access could delete arbitrary posts if identifiers are supplied or inferred without adequate confirmation and scope checks.

Content

Scanner excerpt · workflows/social-publishing.md (reported line 62)May include surrounding context.

md

## Update / delete a post

- `PATCH /social/post/{post_id}` — [Docs](https://docs.mosaic.so/api/social/patch-social-post)
- `DELETE /social/post/{post_id}` — [Docs](https://docs.mosaic.so/api/social/delete-social-post)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description is broad enough to match generic requests about social media posting or account management, which can cause the agent to invoke this skill outside a narrowly Mosaic-specific context. That increases the chance of unnecessary access to Mosaic-linked publishing and account actions, especially if the user did not explicitly intend to use Mosaic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to store the Mosaic API key in the environment for future sessions without warning the user about persistence, reuse, or sensitivity of the credential. Persisting a long-lived API token can expand the blast radius if the environment is shared, logged, or later accessed by other skills or users.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

1. **Check the environment first.** If `MOSAIC_API_KEY` is already set (e.g. via the one-click setup at [edit.mosaic.so](https://edit.mosaic.so)), use it directly.
2. If the key is not in the environment, ask the user for it. Direct them to [edit.mosaic.so/automations?tab=api](https://edit.mosaic.so/automations?tab=api) to generate one using the one-click setup for OpenClaw or Claude Code.
3. Store the key as `MOSAIC_API_KEY` in your environment for future sessions.
4. Validate with `GET https://api.mosaic.so/whoami` using header `Authorization: Bearer $MOSAIC_API_KEY`.

## HTTP conventions

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · nodes/silence-removal.md (reported line 5)May include surrounding context.

md

**Node type ID:** `a22d0b93-2bbf-479d-8efd-d446163982e8`

Automatically removes awkward pauses, long gaps, and dead air from your video to make pacing tighter and more engaging. Analyzes audio to detect silence and trims it out. Especially useful for podcasts, commentary, educational content, and talking-head videos.

To get the full list of configurable parameters, call `GET /node_type/a22d0b93-2bbf-479d-8efd-d446163982e8`.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow directs the agent to perform financially impactful actions such as plan upgrades and enabling auto top-ups, then resume work, without requiring explicit user confirmation immediately before each billing-changing API call or presenting a clear cost warning. In an agentic context, especially when triggered by a blocked run, this can lead to unintended charges, automatic recurring purchases, or social-engineering-style nudging into payment flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation exposes a destructive POST /agent/{agent_id}/delete operation without any warning, confirmation guidance, or mention of irreversibility. In an agent skill context, this increases the chance that an automated agent or user will invoke deletion casually or in response to ambiguous prompts, causing unintended loss of reusable video workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill instructs users to provide a callback_url webhook endpoint but does not warn that run status and possibly job metadata or output references will be transmitted to an external URL. In an agent skill that can process user-provided videos and automate workflows, silently encouraging webhook use increases the risk of unintended data disclosure to third-party endpoints controlled by the user, integrator, or an attacker who can influence configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow describes connecting external social accounts and publishing videos directly, but it provides no warning that these actions can affect real third-party accounts or create public-facing posts. In an agent skill context, this increases the chance of unintended or unauthorized posting because a caller may trigger high-impact external actions without explicit user awareness or confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow instructs users to upload files to a returned signed URL but does not warn that the content is being transmitted to remote storage outside the local environment. For a skill handling user-provided video, audio, and image assets, this omission can cause users or downstream agents to send sensitive media or embedded metadata to third-party infrastructure without informed consent or review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.