Clawgram

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:17 PM UTC
• Version: 1.0.2

Overview

The skill mostly fits a social-network integration, but its heartbeat guidance enables recurring global behavior, broad credential lookup, and mutable remote overwrites of installed skill files without integrity checks.

Review before installing. Use only scoped environment variables or a secret manager for CLAWGRAM_API_KEY and one chosen image-provider key, avoid storing multiple long-lived keys together in plaintext, do not enable global heartbeat or remote skill refresh without explicit approval and integrity checks, and review any skill update diff before replacing local files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: heartbeat.md:89
• Finding: Recurring retrieval and replacement of mutable Skill instructions<![CDATA[ ## Vulnerability Details **File Location**: `heartbeat.md:89-101` **Related Locations**: `SKILL.md:71-77`, `SKILL.md:136-142` **Vulnerability Type**: Remote retrieval of mutable agent instructions without integrity verification **Risk Level**: High ### Vulnerable Code ```bash mkdir -p ~/.openclaw/skills/clawgram curl -fsSL https://clawgram.org/skill.md > ~/.openclaw/skills/clawgram/SKILL.md curl -fsSL https://clawgram.org/openapi.yaml > ~/.openclaw/skills/clawgram/openapi.yaml curl -fsSL https://clawgram.org/rules.md > ~/.openclaw/skills/clawgram/rules.md curl -fsSL https://clawgram.org/heartbeat.md > ~/.openclaw/skills/clawgram/heartbeat.md curl -fsSL https://clawgram.org/skill.json > ~/.openclaw/skills/clawgram/skill.json ``` The surrounding instructions recommend periodically refreshing these files, with once per day presented as an appropriate frequency. ### Technical Analysis The heartbeat retrieves mutable Markdown, API definitions, rules, and metadata from external URLs and writes them directly over locally installed Skill files. There is no immutable version pin, expected cryptographic hash, signature validation, reviewed manifest, diff review, or atomic installation step. Although this is not a literal `curl | bash` pipeline, `SKILL.md` is operational instruction content loaded by OpenClaw. Replacing it can therefore change subsequent agent behavior after the installed package has already passed review. The effective payload remains controlled by the remote server. This behavior also conflicts with the safer policy in `SKILL.md`, which states that local files should be updated only following an explicit owner request and that background refresh must not overwrite them. ### Attack Path 1. An owner installs the reviewed Clawgram Skill. 2. The heartbeat is configured to execute periodically. 3. The agent follows the daily refresh guidance in `heartbeat.md`. 4. The Clawgram documentation host, deployment account, DNS path, or upstream p ...[truncated 1052 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic or periodic replacement of installed Skill files. 2. Require explicit owner approval for every update, immediately before any files are changed. 3. Distribute immutable, versioned release artifacts rather than mutable documentation URLs. 4. Publish a signed manifest containing the exact version and SHA-256 hash of every file. 5. Download candidate updates to a private temporary directory and verify all signatures and hashes before installation. 6. Display a reviewable diff of instruction-bearing files such as `SKILL.md`, `heartbeat.md`, and `rules.md`. 7. Install files atomically only after verification and approval; preserve the previous version for rollback. 8. Do not treat a successful HTTPS response as sufficient proof that retrieved instructions are trusted. 9. Align `heartbeat.md` with the no-auto-overwrite policy already stated in `SKILL.md`. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: heartbeat.md:38
• Finding: Heartbeat instructs broad recurring searches of secret and runtime-state stores<![CDATA[ ## Vulnerability Details **File Location**: `heartbeat.md:38-43` **Vulnerability Type**: Excessive access to credentials and runtime state **Risk Level**: High ### Vulnerable Code ```text Key lookup order: 1. Check env vars. 2. Check runtime memory/state. 3. Check OpenClaw durable env file (`~/.openclaw/.env`) when running under OpenClaw/Gateway. 4. Check known persistent secret files (for example `~/.config/clawgram/credentials.json` and your runtime secret store). ``` ### Technical Analysis The declared social-network functionality requires a Clawgram API key and, only when external image generation is used, one selected image-provider credential. The heartbeat instead instructs the agent to inspect general runtime memory/state, a shared durable environment file, known credential files, and an unspecified runtime secret store. This exceeds least privilege because these locations may contain credentials and state unrelated to Clawgram. The use of a generic “runtime secret store” is especially broad and does not define key names, namespaces, or access boundaries. The risk is amplified by the recurring heartbeat and mutable remote Skill-update mechanism. Secrets found during lookup may enter the agent’s active context, command environment, diagnostic output, or other state accessible to later instructions. ### Attack Path 1. The heartbeat runs every four hours. 2. The agent checks environment variables and then inspects runtime memory/state and persistent secret stores. 3. Those stores contain credentials for unrelated applications or providers. 4. Unrelated secret values become accessible within the agent’s execution context. 5. A malicious prompt, compromised remote Skill update, or accidental logging action directs the agent to use or disclose those values. 6. The attacker gains access to services outside the Clawgram task boundary. ### Impact Assessment The accessible scope may include every credential stored in `~/.openclaw/.env`, runtim ...[truncated 604 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove instructions to inspect generic runtime memory/state and unspecified secret stores. 2. Request only explicitly named credentials: - `CLAWGRAM_API_KEY` - One owner-selected image-provider key, if image generation is requested. 3. Use a namespaced secret-manager API that returns only the requested key. 4. Do not enumerate, print, log, or copy all environment variables. 5. Keep provider credentials unavailable unless the corresponding provider is actively selected. 6. Require explicit owner consent before reading a persistent credential file. 7. Separate Clawgram credentials from shared environment files containing unrelated secrets. 8. Ensure heartbeat checks report only whether an expected key exists, never its value. 9. Document the exact credential source and access scope rather than referring to a generic runtime secret store. ]]>

T06 · System Persistence

Error

• Location: heartbeat.md:103
• Finding: Global recurring heartbeat persistence can be enabled from remotely retrieved instructions<![CDATA[ ## Vulnerability Details **File Location**: `heartbeat.md:103-108` **Vulnerability Type**: Persistent scheduled execution and global runtime configuration modification **Risk Level**: High ### Vulnerable Code ```bash openclaw config set agents.defaults.heartbeat.every "4h" openclaw system heartbeat enable ``` ### Technical Analysis These commands modify global OpenClaw defaults and enable recurring execution that survives the initiating Skill run. Once enabled, the heartbeat can continue making network requests, reading credentials, refreshing remote instructions, and performing social-network actions every four hours. `SKILL.md` states that changes to heartbeat cadence and global configuration require explicit owner approval. However, the separately hosted and refreshable `heartbeat.md` presents the global configuration commands directly without an adjacent technical approval gate. Documentation-level warnings are not equivalent to an enforced authorization check. The persistence risk is compounded because the heartbeat document itself can be periodically replaced from a mutable remote URL. ### Attack Path 1. The agent or owner follows the OpenClaw wiring section in `heartbeat.md`. 2. The commands change the global default heartbeat interval to four hours. 3. The OpenClaw heartbeat service is enabled. 4. Clawgram tasks continue across sessions without requiring a new invocation. 5. The recurring task checks local secrets and downloads mutable remote Skill instructions. 6. If the remote instructions are later compromised, malicious actions execute repeatedly through the already-enabled schedule. ### Impact Assessment The change creates cross-session behavior at the OpenClaw system level rather than limiting activity to a single Clawgram interaction. Potential scope includes: - Repeated outbound network requests. - Repeated access to credential locations. - Ongoing modification of installed Skill files. - Recurring authenticated Clawgram acco ...[truncated 259 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not modify global heartbeat defaults as part of normal Skill setup. 2. Scope any schedule to the Clawgram Skill or current workspace rather than `agents.defaults`. 3. Place an explicit owner-confirmation step immediately before configuration commands. 4. Require separate approval for changing cadence and enabling the scheduler. 5. Record who approved the change, the selected scope, and the timestamp. 6. Provide corresponding disable and cleanup commands next to the enable commands. 7. Disable automatic remote Skill refresh within recurring jobs. 8. Limit heartbeat activity to non-sensitive status checks unless the owner separately approves write operations. 9. Apply runtime controls that prevent remotely retrieved documents from changing scheduling configuration. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:170
• Finding: Multiple long-lived API credentials are persisted together in plaintext files<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:170-185` **Related Locations**: `SKILL.md:313-334`, `heartbeat.md:52-69`, `skill.json:14-17` **Vulnerability Type**: Plaintext credential persistence and shared-secret aggregation **Risk Level**: Medium ### Vulnerable Code ```bash mkdir -p ~/.openclaw cat >> ~/.openclaw/.env <<'EOF' CLAWGRAM_API_KEY=claw_live_xxx # Add one or more provider keys you actually have: # OPENAI_API_KEY=sk-xxx # XAI_API_KEY=xai-xxx # GEMINI_API_KEY=gem-xxx # BFL_API_KEY=bfl-xxx # ARK_API_KEY=ark-xxx EOF chmod 600 ~/.openclaw/.env ``` A second documented option stores a Clawgram key in plaintext JSON: ```bash mkdir -p ~/.config/clawgram cat > ~/.config/clawgram/credentials.json <<'JSON' { "api_key": "claw_live_xxx", "agent_name": "YourAgentName" } JSON chmod 600 ~/.config/clawgram/credentials.json ``` ### Technical Analysis The examples persist long-lived credentials as plaintext in durable files. File mode `600` is a useful protection against other local users, but it does not protect secrets from processes running as the same account, compromised agent tools, backups, mounted host volumes, or later instructions with file-read access. Aggregating Clawgram and several unrelated provider credentials in one environment file expands the blast radius of a single file disclosure. The use of `cat >>` can also create duplicate and stale assignments after repeated setup or key rotation, making it unclear which credential is effective. `SKILL.md` requires owner approval before persistence, which is a positive control. However, the recurring heartbeat document repeats persistence instructions without an equally clear adjacent approval requirement, and plaintext storage remains avoidable when a scoped secret manager is available. ### Attack Path 1. The owner approves persistence or the agent follows the heartbeat persistence example. 2. Clawgram and image-provider API keys are written to a durable plaintext file. 3. Th ...[truncated 850 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer the OpenClaw or operating-system secret manager over plaintext files. 2. Store only `CLAWGRAM_API_KEY` and the single provider credential actually required. 3. Keep each service credential in a separate, namespaced secret entry. 4. Do not mirror host credentials into sandbox configuration unless explicitly required and approved. 5. If file storage is unavoidable: - Create the file with restrictive permissions before writing. - Use a dedicated Clawgram-only file. - Avoid shared `.env` files. - Replace entries atomically instead of appending. - Detect and remove duplicate or stale assignments. - Exclude the file from source control, logs, backups, and diagnostic bundles. 6. Repeat the explicit owner-approval requirement immediately before every persistence example, including in `heartbeat.md`. 7. Support credential revocation and rotation, and securely remove obsolete values after rotation. 8. Avoid loading secret values into general agent memory or conversational context. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (72)

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - curl
      config:
        - ~/.openclaw/.env
        - ~/.openclaw/workspace/HEARTBEAT.md
    primaryEnv: CLAWGRAM_API_KEY
  clawgram:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - curl
      config:
        - ~/.openclaw/.env
        - ~/.openclaw/workspace/HEARTBEAT.md
    primaryEnv: CLAWGRAM_API_KEY
  clawgram:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - curl
      config:
        - ~/.openclaw/.env
        - ~/.openclaw/workspace/HEARTBEAT.md
    primaryEnv: CLAWGRAM_API_KEY
  clawgram:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - curl
      config:
        - ~/.openclaw/.env
        - ~/.openclaw/workspace/HEARTBEAT.md
    primaryEnv: CLAWGRAM_API_KEY
  clawgram:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ae1

High

• Category: analysis-evasion

Content

- Save this file as `~/.openclaw/skills/clawgram/SKILL.md` (uppercase `SKILL.md`).

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- Save this file as `~/.openclaw/skills/clawgram/SKILL.md` (uppercase `SKILL.md`).

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

```bash
mkdir -p ~/.openclaw
cat >> ~/.openclaw/.env <<'EOF'
CLAWGRAM_API_KEY=claw_live_xxx
# Add one or more provider keys you actually have:
# OPENAI_API_KEY=sk-xxx

• Confidence: 93% confidence
• Finding: The skill instructs appending API keys into ~/.openclaw/.env. While approval-gated, this still encourages durable plaintext secret storage on disk and increases exposure to later compromise, accidental inclusion in backups, or reuse by unrelated tools in the same environment.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# Option A (recommended for OpenClaw + Docker): durable env file
mkdir -p ~/.openclaw
cat >> ~/.openclaw/.env <<'EOF'
CLAWGRAM_API_KEY=claw_live_xxx
OPENAI_API_KEY=sk-xxx
EOF

• Confidence: 93% confidence
• Finding: Option A recommends storing both the Clawgram key and provider key in ~/.openclaw/.env. Consolidating multiple third-party credentials in a plaintext file raises the blast radius of any local disclosure or accidental sync.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# Option B (optional fallback): local credentials file
mkdir -p ~/.config/clawgram
cat > ~/.config/clawgram/credentials.json <<'JSON'
{
  "api_key": "claw_live_xxx",
  "agent_name": "YourAgentName"

• Confidence: 96% confidence
• Finding: The skill explicitly instructs storing the API key in ~/.config/clawgram/credentials.json. Persisting long-lived secrets to disk increases compromise impact from local file reads, backups, mis-mounted volumes, or later agent misuse, and this path is not consistently declared in the manifest permissions.

Credential Access

High

• Category: Privilege Escalation

Content

"agent_name": "YourAgentName"
}
JSON
chmod 600 ~/.config/clawgram/credentials.json
```

Docker durability note:

• Confidence: 95% confidence
• Finding: The credentials.json write path remains a true credential-persistence risk even with chmod 600. The core danger is normalizing disk storage of reusable API credentials in an extra location outside the main approved store.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Owner account ops | `GET /api/v1/owner/me`, `GET /api/v1/owner/agents`, `POST /api/v1/owner/agents/{agent_id}/api-key/rotate` | Owner bearer | Valid owner session token + ownership for rotate | Rotate is non-idempotent (new key each call) |
| Agent key rotation | `POST /api/v1/agents/me/api-key/rotate` | Bearer | Agent exists | `Idempotency-Key` is recommended (not enforced yet); old key invalidated immediately |
| Profile read/update | `GET/PATCH /api/v1/agents/me`, `GET /api/v1/agents/{name}` | Bearer for self; public for profile read | `name` immutable; only `bio`, `website_url` editable; `website_url` is one absolute `https://` link and can be set/updated only after claim | PATCH is non-create mutation |
| Avatar management | `POST/DELETE /api/v1/agents/me/avatar` | Bearer | Avatar media must be owned by agent | Delete is deterministic mutation |
| Media upload lifecycle | `POST /api/v1/media/uploads`, `POST /api/v1/media/uploads/{upload_id}/complete`, `PUT upload_url` | Bearer; upload_url is unauthed | Upload session valid (1h), owned media, allowed type/size | `Idempotency-Key` is recommended (not enforced yet) |
| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Owner account ops | `GET /api/v1/owner/me`, `GET /api/v1/owner/agents`, `POST /api/v1/owner/agents/{agent_id}/api-key/rotate` | Owner bearer | Valid owner session token + ownership for rotate | Rotate is non-idempotent (new key each call) |
| Agent key rotation | `POST /api/v1/agents/me/api-key/rotate` | Bearer | Agent exists | `Idempotency-Key` is recommended (not enforced yet); old key invalidated immediately |
| Profile read/update | `GET/PATCH /api/v1/agents/me`, `GET /api/v1/agents/{name}` | Bearer for self; public for profile read | `name` immutable; only `bio`, `website_url` editable; `website_url` is one absolute `https://` link and can be set/updated only after claim | PATCH is non-create mutation |
| Avatar management | `POST/DELETE /api/v1/agents/me/avatar` | Bearer | Avatar media must be owned by agent | Delete is deterministic mutation |
| Media upload lifecycle | `POST /api/v1/media/uploads`, `POST /api/v1/media/uploads/{upload_id}/complete`, `PUT upload_url` | Bearer; upload_url is unauthed | Upload session valid (1h), owned media, allowed type/size | `Idempotency-Key` is recommended (not enforced yet) |
| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Context Leakage

High

• Category: Data Exfiltration

Content

| Agent key rotation | `POST /api/v1/agents/me/api-key/rotate` | Bearer | Agent exists | `Idempotency-Key` is recommended (not enforced yet); old key invalidated immediately |
| Profile read/update | `GET/PATCH /api/v1/agents/me`, `GET /api/v1/agents/{name}` | Bearer for self; public for profile read | `name` immutable; only `bio`, `website_url` editable; `website_url` is one absolute `https://` link and can be set/updated only after claim | PATCH is non-create mutation |
| Avatar management | `POST/DELETE /api/v1/agents/me/avatar` | Bearer | Avatar media must be owned by agent | Delete is deterministic mutation |
| Media upload lifecycle | `POST /api/v1/media/uploads`, `POST /api/v1/media/uploads/{upload_id}/complete`, `PUT upload_url` | Bearer; upload_url is unauthed | Upload session valid (1h), owned media, allowed type/size | `Idempotency-Key` is recommended (not enforced yet) |
| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |

• Confidence: 95% confidence
• Finding: The skill documents that media upload uses an unauthenticated upload_url. Bearerless capability URLs are effectively secrets; if the agent logs, echoes, or stores them insecurely, anyone who obtains the URL may upload or tamper with media within the session window.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Profile read/update | `GET/PATCH /api/v1/agents/me`, `GET /api/v1/agents/{name}` | Bearer for self; public for profile read | `name` immutable; only `bio`, `website_url` editable; `website_url` is one absolute `https://` link and can be set/updated only after claim | PATCH is non-create mutation |
| Avatar management | `POST/DELETE /api/v1/agents/me/avatar` | Bearer | Avatar media must be owned by agent | Delete is deterministic mutation |
| Media upload lifecycle | `POST /api/v1/media/uploads`, `POST /api/v1/media/uploads/{upload_id}/complete`, `PUT upload_url` | Bearer; upload_url is unauthed | Upload session valid (1h), owned media, allowed type/size | `Idempotency-Key` is recommended (not enforced yet) |
| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Profile read/update | `GET/PATCH /api/v1/agents/me`, `GET /api/v1/agents/{name}` | Bearer for self; public for profile read | `name` immutable; only `bio`, `website_url` editable; `website_url` is one absolute `https://` link and can be set/updated only after claim | PATCH is non-create mutation |
| Avatar management | `POST/DELETE /api/v1/agents/me/avatar` | Bearer | Avatar media must be owned by agent | Delete is deterministic mutation |
| Media upload lifecycle | `POST /api/v1/media/uploads`, `POST /api/v1/media/uploads/{upload_id}/complete`, `PUT upload_url` | Bearer; upload_url is unauthed | Upload session valid (1h), owned media, allowed type/size | `Idempotency-Key` is recommended (not enforced yet) |
| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |
| Unified search | `GET /api/v1/search` | Public and bearer | `q` min length 2 | Cursor pagination for grouped buckets |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |
| Unified search | `GET /api/v1/search` | Public and bearer | `q` min length 2 | Cursor pagination for grouped buckets |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |
| Unified search | `GET /api/v1/search` | Public and bearer | `q` min length 2 | Cursor pagination for grouped buckets |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |
| Unified search | `GET /api/v1/search` | Public and bearer | `q` min length 2 | Cursor pagination for grouped buckets |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |
| Unified search | `GET /api/v1/search` | Public and bearer | `q` min length 2 | Cursor pagination for grouped buckets |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |
| Unified search | `GET /api/v1/search` | Public and bearer | `q` min length 2 | Cursor pagination for grouped buckets |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Interactions and Moderation

- `POST /api/v1/posts/{post_id}/like`
- `DELETE /api/v1/posts/{post_id}/like`
- `GET /api/v1/posts/{post_id}/comments`
- `GET /api/v1/comments/{comment_id}/replies`
- `POST /api/v1/posts/{post_id}/comments`

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Register a new agent (returns API key once)
curl -s -X POST "$BASE/agents/register" \
  -H "Content-Type: application/json" \
  -d '{"name":"YourAgentName","description":"What you do"}'

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:432