ClawHub
Back to skill

Security audit

Bluesky API

Security checks for vulnerabilities and agentic risk

Overview

The Bluesky skill mostly matches its stated purpose, but its posting instructions contain a credential-handling mismatch that could expose or accidentally post an app password.

Review the posting command before installing or using this skill. Use a Bluesky app password, not a main password, and do not pass the app password as a positional command-line argument. Prefer a corrected version where the quick reference matches the script and credentials are supplied only through a secure environment or config path.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code chunk implements only posting to Bluesky. While posting is included in the declared description, the broader declared purpose claims additional capabilities—reading, searching, and monitoring Bluesky accounts—that are not represented in this code. This is a description-to-behavior mismatch because the supplied code has a narrower actual purpose than the declared description. There are no obvious unrelated or undeclared dangerous capabilities beyond authentication and posting, which are supporting details for the posting function.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description is broader than the actual code behavior. The script supports only a read operation for a single profile's recent feed. It does not implement searching, posting, or any monitoring/persistent watching functionality. There are no undeclared harmful capabilities, but the declared purpose materially overstates what this code chunk does.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md
BSKY_APP_PASSWORD=xxxx-xxxx-xxxx-xxxx ./scripts/bsky-post.sh alice.bsky.social "Hello from OpenClaw!"

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

md
BSKY_APP_PASSWORD=xxxx-xxxx-xxxx-xxxx ./scripts/bsky-post.sh alice.bsky.social "Hello from OpenClaw!"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

md
### Auth Token Expiry

Access tokens expire. If you get a 401, re-authenticate by calling `createSession` again. Do not cache tokens for more than a few minutes.

---

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.

This returns a session with accessJwt and did.

curl Example

bash
# Always use env vars — never interpolate credentials directly into shell strings

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

}

text

#### curl Example

```bash
curl -s -X POST "https://bsky.social/xrpc/com.atproto.repo.createRecord" \

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

For heartbeat use, store the latest seen timestamp and compare on each check:

bash
# Use a user-owned state dir, not world-readable /tmp
LAST_SEEN_FILE="${XDG_STATE_HOME:-$HOME/.local/state}/bsky-monitor-${HANDLE}.txt"
mkdir -p "$(dirname "$LAST_SEEN_FILE")"
HANDLE="alice.bsky.social"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This is a real documentation-induced security issue: the quick reference normalizes insecure secret handling despite earlier text warning against it. In the context of a skill intended to be copied and reused, unsafe examples materially increase the chance that app passwords are exposed to local users, logs, or monitoring systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bsky-post.sh (reported line 40)May include surrounding context.

sh
fi

# Step 1: Authenticate
SESSION=$(curl -sf -X POST "https://bsky.social/xrpc/com.atproto.server.createSession" \
  -H "Content-Type: application/json" \
  -d "{\"identifier\": $(printf '%s' "$HANDLE" | jq -Rs .), \"password\": $(printf '%s' "$APP_PASSWORD" | jq -Rs .)}") || {
  echo "Error: authentication failed for '${HANDLE}'" >&2

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bsky-post.sh (reported line 60)May include surrounding context.

sh
# Step 2: Create the post
TIMESTAMP=$(date -u +%Y-%m-%dT%H:%M:%S.000Z)

RESULT=$(curl -sf -X POST "https://bsky.social/xrpc/com.atproto.repo.createRecord" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "{

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The quick reference contradicts earlier safer guidance by documenting ./scripts/bsky-post.sh <handle> <app_password> <text>, which encourages passing a secret on the command line. Command-line arguments are often exposed via shell history, process listings, audit logs, and telemetry, making credential disclosure more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.