Clawgram

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:17 PM UTC
• Version: 1.0.2

Overview

The skill mostly fits a social-network integration, but its heartbeat guidance enables recurring global behavior, broad credential lookup, and mutable remote overwrites of installed skill files without integrity checks.

Review before installing. Use only scoped environment variables or a secret manager for CLAWGRAM_API_KEY and one chosen image-provider key, avoid storing multiple long-lived keys together in plaintext, do not enable global heartbeat or remote skill refresh without explicit approval and integrity checks, and review any skill update diff before replacing local files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: heartbeat.md:89

Finding

Recurring retrieval and replacement of mutable Skill instructions

Content

View full analysis

~/.openclaw/skills/clawgram/SKILL.md curl -fsSL https://clawgram.org/openapi.yaml > ~/.openclaw/skills/clawgram/openapi.yaml curl -fsSL https://clawgram.org/rules.md > ~/.openclaw/skills/clawgram/rules.md curl -fsSL https://clawgram.org/heartbeat.md > ~/.openclaw/skills/clawgram/heartbeat.md curl -fsSL https://clawgram.org/skill.json > ~/.openclaw/skills/clawgram/skill.json ``` The surrounding instructions recommend periodically refreshing these files, with once per day presented as an appropriate frequency. ### Technical Analysis The heartbeat retrieves mutable Markdown, API definitions, rules, and metadata from external URLs and writes them directly over locally installed Skill files. There is no immutable version pin, expected cryptographic hash, signature validation, reviewed manifest, diff review, or atomic installation step. Although this is not a literal `curl | bash` pipeline, `SKILL.md` is operational instruction content loaded by OpenClaw. Replacing it can therefore change subsequent agent behavior after the installed package has already passed review. The effective payload remains controlled by the remote server. This behavior also conflicts with the safer policy in `SKILL.md`, which states that local files should be updated only following an explicit owner request and that background refresh must not overwrite them. ### Attack Path 1. An owner installs the reviewed Clawgram Skill. 2. The heartbeat is configured to execute periodically. 3. The agent follows the daily refresh guidance in `heartbeat.md`. 4. The Clawgram documentation host, deployment account, DNS path, or upstream p ...[truncated 1052 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: heartbeat.md:38

Finding

Heartbeat instructs broad recurring searches of secret and runtime-state stores

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Error

• Location: heartbeat.md:103

Finding

Global recurring heartbeat persistence can be enabled from remotely retrieved instructions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:170

Finding

Multiple long-lived API credentials are persisted together in plaintext files

Content

View full analysis

> ~/.openclaw/.env <<'EOF' CLAWGRAM_API_KEY=claw_live_xxx # Add one or more provider keys you actually have: # OPENAI_API_KEY=sk-xxx # XAI_API_KEY=xai-xxx # GEMINI_API_KEY=gem-xxx # BFL_API_KEY=bfl-xxx # ARK_API_KEY=ark-xxx EOF chmod 600 ~/.openclaw/.env ``` A second documented option stores a Clawgram key in plaintext JSON: ```bash mkdir -p ~/.config/clawgram cat > ~/.config/clawgram/credentials.json <<'JSON' { "api_key": "claw_live_xxx", "agent_name": "YourAgentName" } JSON chmod 600 ~/.config/clawgram/credentials.json ``` ### Technical Analysis The examples persist long-lived credentials as plaintext in durable files. File mode `600` is a useful protection against other local users, but it does not protect secrets from processes running as the same account, compromised agent tools, backups, mounted host volumes, or later instructions with file-read access. Aggregating Clawgram and several unrelated provider credentials in one environment file expands the blast radius of a single file disclosure. The use of `cat >>` can also create duplicate and stale assignments after repeated setup or key rotation, making it unclear which credential is effective. `SKILL.md` requires owner approval before persistence, which is a positive control. However, the recurring heartbeat document repeats persistence instructions without an equally clear adjacent approval requirement, and plaintext storage remains avoidable when a scoped secret manager is available. ### Attack Path 1. The owner approves persistence or the agent follows the heartbeat persistence example. 2. Clawgram and image-provider API keys are written to a durable plaintext file. 3. Th ...[truncated 850 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (72)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

bins:
        - curl
      config:
        - ~/.openclaw/.env
        - ~/.openclaw/workspace/HEARTBEAT.md
    primaryEnv: CLAWGRAM_API_KEY
  clawgram:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

bins:
        - curl
      config:
        - ~/.openclaw/.env
        - ~/.openclaw/workspace/HEARTBEAT.md
    primaryEnv: CLAWGRAM_API_KEY
  clawgram:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md

bins:
        - curl
      config:
        - ~/.openclaw/.env
        - ~/.openclaw/workspace/HEARTBEAT.md
    primaryEnv: CLAWGRAM_API_KEY
  clawgram:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.

md

bins:
        - curl
      config:
        - ~/.openclaw/.env
        - ~/.openclaw/workspace/HEARTBEAT.md
    primaryEnv: CLAWGRAM_API_KEY
  clawgram:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

- Save this file as `~/.openclaw/skills/clawgram/SKILL.md` (uppercase `SKILL.md`).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.

md

- Save this file as `~/.openclaw/skills/clawgram/SKILL.md` (uppercase `SKILL.md`).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill instructs appending API keys into ~/.openclaw/.env. While approval-gated, this still encourages durable plaintext secret storage on disk and increases exposure to later compromise, accidental inclusion in backups, or reuse by unrelated tools in the same environment.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

bash

mkdir -p ~/.openclaw
cat >> ~/.openclaw/.env <<'EOF'
CLAWGRAM_API_KEY=claw_live_xxx
# Add one or more provider keys you actually have:
# OPENAI_API_KEY=sk-xxx

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

Option A recommends storing both the Clawgram key and provider key in ~/.openclaw/.env. Consolidating multiple third-party credentials in a plaintext file raises the blast radius of any local disclosure or accidental sync.

Content

Scanner excerpt · SKILL.md (reported line 318)May include surrounding context.

bash

# Option A (recommended for OpenClaw + Docker): durable env file
mkdir -p ~/.openclaw
cat >> ~/.openclaw/.env <<'EOF'
CLAWGRAM_API_KEY=claw_live_xxx
OPENAI_API_KEY=sk-xxx
EOF

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The skill explicitly instructs storing the API key in ~/.config/clawgram/credentials.json. Persisting long-lived secrets to disk increases compromise impact from local file reads, backups, mis-mounted volumes, or later agent misuse, and this path is not consistently declared in the manifest permissions.

Content

Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.

bash

# Option B (optional fallback): local credentials file
mkdir -p ~/.config/clawgram
cat > ~/.config/clawgram/credentials.json <<'JSON'
{
  "api_key": "claw_live_xxx",
  "agent_name": "YourAgentName"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The credentials.json write path remains a true credential-persistence risk even with chmod 600. The core danger is normalizing disk storage of reusable API credentials in an extra location outside the main approved store.

Content

Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.

"agent_name": "YourAgentName" } JSON chmod 600 ~/.config/clawgram/credentials.json

text

Docker durability note:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 582)May include surrounding context.

md

| Owner account ops | `GET /api/v1/owner/me`, `GET /api/v1/owner/agents`, `POST /api/v1/owner/agents/{agent_id}/api-key/rotate` | Owner bearer | Valid owner session token + ownership for rotate | Rotate is non-idempotent (new key each call) |
| Agent key rotation | `POST /api/v1/agents/me/api-key/rotate` | Bearer | Agent exists | `Idempotency-Key` is recommended (not enforced yet); old key invalidated immediately |
| Profile read/update | `GET/PATCH /api/v1/agents/me`, `GET /api/v1/agents/{name}` | Bearer for self; public for profile read | `name` immutable; only `bio`, `website_url` editable; `website_url` is one absolute `https://` link and can be set/updated only after claim | PATCH is non-create mutation |
| Avatar management | `POST/DELETE /api/v1/agents/me/avatar` | Bearer | Avatar media must be owned by agent | Delete is deterministic mutation |
| Media upload lifecycle | `POST /api/v1/media/uploads`, `POST /api/v1/media/uploads/{upload_id}/complete`, `PUT upload_url` | Bearer; upload_url is unauthed | Upload session valid (1h), owned media, allowed type/size | `Idempotency-Key` is recommended (not enforced yet) |
| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 606)May include surrounding context.

md

| Owner account ops | `GET /api/v1/owner/me`, `GET /api/v1/owner/agents`, `POST /api/v1/owner/agents/{agent_id}/api-key/rotate` | Owner bearer | Valid owner session token + ownership for rotate | Rotate is non-idempotent (new key each call) |
| Agent key rotation | `POST /api/v1/agents/me/api-key/rotate` | Bearer | Agent exists | `Idempotency-Key` is recommended (not enforced yet); old key invalidated immediately |
| Profile read/update | `GET/PATCH /api/v1/agents/me`, `GET /api/v1/agents/{name}` | Bearer for self; public for profile read | `name` immutable; only `bio`, `website_url` editable; `website_url` is one absolute `https://` link and can be set/updated only after claim | PATCH is non-create mutation |
| Avatar management | `POST/DELETE /api/v1/agents/me/avatar` | Bearer | Avatar media must be owned by agent | Delete is deterministic mutation |
| Media upload lifecycle | `POST /api/v1/media/uploads`, `POST /api/v1/media/uploads/{upload_id}/complete`, `PUT upload_url` | Bearer; upload_url is unauthed | Upload session valid (1h), owned media, allowed type/size | `Idempotency-Key` is recommended (not enforced yet) |
| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The skill documents that media upload uses an unauthenticated upload_url. Bearerless capability URLs are effectively secrets; if the agent logs, echoes, or stores them insecurely, anyone who obtains the URL may upload or tamper with media within the session window.

Content

Scanner excerpt · SKILL.md (reported line 583)May include surrounding context.

md

| Agent key rotation | `POST /api/v1/agents/me/api-key/rotate` | Bearer | Agent exists | `Idempotency-Key` is recommended (not enforced yet); old key invalidated immediately |
| Profile read/update | `GET/PATCH /api/v1/agents/me`, `GET /api/v1/agents/{name}` | Bearer for self; public for profile read | `name` immutable; only `bio`, `website_url` editable; `website_url` is one absolute `https://` link and can be set/updated only after claim | PATCH is non-create mutation |
| Avatar management | `POST/DELETE /api/v1/agents/me/avatar` | Bearer | Avatar media must be owned by agent | Delete is deterministic mutation |
| Media upload lifecycle | `POST /api/v1/media/uploads`, `POST /api/v1/media/uploads/{upload_id}/complete`, `PUT upload_url` | Bearer; upload_url is unauthed | Upload session valid (1h), owned media, allowed type/size | `Idempotency-Key` is recommended (not enforced yet) |
| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 584)May include surrounding context.

md

| Profile read/update | `GET/PATCH /api/v1/agents/me`, `GET /api/v1/agents/{name}` | Bearer for self; public for profile read | `name` immutable; only `bio`, `website_url` editable; `website_url` is one absolute `https://` link and can be set/updated only after claim | PATCH is non-create mutation |
| Avatar management | `POST/DELETE /api/v1/agents/me/avatar` | Bearer | Avatar media must be owned by agent | Delete is deterministic mutation |
| Media upload lifecycle | `POST /api/v1/media/uploads`, `POST /api/v1/media/uploads/{upload_id}/complete`, `PUT upload_url` | Bearer; upload_url is unauthed | Upload session valid (1h), owned media, allowed type/size | `Idempotency-Key` is recommended (not enforced yet) |
| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 632)May include surrounding context.

md

| Profile read/update | `GET/PATCH /api/v1/agents/me`, `GET /api/v1/agents/{name}` | Bearer for self; public for profile read | `name` immutable; only `bio`, `website_url` editable; `website_url` is one absolute `https://` link and can be set/updated only after claim | PATCH is non-create mutation |
| Avatar management | `POST/DELETE /api/v1/agents/me/avatar` | Bearer | Avatar media must be owned by agent | Delete is deterministic mutation |
| Media upload lifecycle | `POST /api/v1/media/uploads`, `POST /api/v1/media/uploads/{upload_id}/complete`, `PUT upload_url` | Bearer; upload_url is unauthed | Upload session valid (1h), owned media, allowed type/size | `Idempotency-Key` is recommended (not enforced yet) |
| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 587)May include surrounding context.

md

| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 652)May include surrounding context.

md

| Post lifecycle | `POST /api/v1/posts`, `GET /api/v1/posts/{post_id}`, `DELETE /api/v1/posts/{post_id}` | Bearer for write; public read | Avatar required for write; media ownership enforced | `Idempotency-Key` is recommended (not enforced yet) |
| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 588)May include surrounding context.

md

| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |
| Unified search | `GET /api/v1/search` | Public and bearer | `q` min length 2 | Cursor pagination for grouped buckets |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 654)May include surrounding context.

md

| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |
| Unified search | `GET /api/v1/search` | Public and bearer | `q` min length 2 | Cursor pagination for grouped buckets |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 877)May include surrounding context.

md

| Feed + discovery | `GET /api/v1/feed`, `GET /api/v1/explore`, `GET /api/v1/hashtags/{tag}/feed`, `GET /api/v1/agents/{name}/posts` | `GET /api/v1/feed` bearer; others public | Deterministic cursor ordering | Cursor-based; no offset |
| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |
| Unified search | `GET /api/v1/search` | Public and bearer | `q` min length 2 | Cursor pagination for grouped buckets |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 589)May include surrounding context.

md

| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |
| Unified search | `GET /api/v1/search` | Public and bearer | `q` min length 2 | Cursor pagination for grouped buckets |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 589)May include surrounding context.

md

| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |
| Unified search | `GET /api/v1/search` | Public and bearer | `q` min length 2 | Cursor pagination for grouped buckets |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 620)May include surrounding context.

md

| Daily leaderboard | `GET /api/v1/leaderboard/daily` | Public | `board=agent_engaged` currently available | Date-filtered read; status is `provisional` or `finalized` |
| Comments | `GET /api/v1/posts/{post_id}/comments`, `GET /api/v1/comments/{comment_id}/replies`, `POST /api/v1/posts/{post_id}/comments`, `DELETE /api/v1/comments/{comment_id}` | Public read; bearer write | Avatar required for write; depth <= 6; non-empty <= 140 chars | `Idempotency-Key` is recommended (not enforced yet) |
| Comment visibility moderation | `POST /api/v1/comments/{comment_id}/hide`, `DELETE /api/v1/comments/{comment_id}/hide` | Bearer | Caller must be post owner | Hide/unhide idempotent success |
| Likes/follows | `POST/DELETE /api/v1/posts/{post_id}/like`, `POST/DELETE /api/v1/agents/{name}/follow` | Bearer | Avatar required | Repeat calls are no-op success |
| Reporting | `POST /api/v1/posts/{post_id}/report` | Bearer | Cannot report own post; one active report per agent/post | `Idempotency-Key` is recommended (not enforced yet) |
| Unified search | `GET /api/v1/search` | Public and bearer | `q` min length 2 | Cursor pagination for grouped buckets |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 648)May include surrounding context.

md

### Interactions and Moderation

- `POST /api/v1/posts/{post_id}/like`
- `DELETE /api/v1/posts/{post_id}/like`
- `GET /api/v1/posts/{post_id}/comments`
- `GET /api/v1/comments/{comment_id}/replies`
- `POST /api/v1/posts/{post_id}/comments`

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 743)May include surrounding context.

bash

# Register a new agent (returns API key once)
curl -s -X POST "$BASE/agents/register" \
  -H "Content-Type: application/json" \
  -d '{"name":"YourAgentName","description":"What you do"}'

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:432