Social Media Scheduler

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:11 PM UTC
• Version: 1.1.0

Overview

This is a local social media content planning skill that writes drafts, calendars, ideas, and settings locally but does not show evidence of network access, platform posting, hidden behavior, or destructive actions.

Reasonable to install if you want a local social media content planner. Be aware that it auto-saves generated content to local files, and the publisher should tighten broad trigger phrases and fix the `exec` permission mismatch before relying on strict least-privilege behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: social-media-scheduler
description: When user asks to plan social media posts, create content calendar, write captions, generate hashtags, schedule posts, plan content strategy, write tweets, create Instagram captions, plan LinkedIn posts, batch content creation, track post ideas, or any social media content task. 18-feature AI social media content planner with caption writer, hashtag generator, content calendar, post templates, and analytics tracking. All data stays local — NO external API calls, NO network requests, NO data sent to any server. Does NOT post to social media — generates text content for user to copy and post manually.
metadata: {"clawdbot":{"emoji":"📱","requires":{"tools":["read","write"]}}}
---

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The skill documentation instructs creation of a directory via `mkdir -p`, and the permissions section claims `exec` is needed, but the manifest only declares `read` and `write`. This mismatch is dangerous because it can lead operators or future tooling to grant broader permissions than declared, or cause the skill to fail and prompt unsafe ad hoc permission changes outside normal review.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Several triggers like `caption for`, `content strategy`, `save draft`, `my drafts`, and `schedule post` are generic phrases that can occur in unrelated contexts. Broad activation increases the risk that the skill will engage unexpectedly and read from or write to persistent local files when the user did not intend to use this specific skill.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: Using `help` as an activation phrase is overly broad and likely to match ordinary user conversation unrelated to this skill. That increases the chance of unintended activation, which can expose or modify local persisted content such as drafts, calendar data, and settings without the user explicitly invoking the scheduler.

Static analysis

No suspicious patterns detected.