Security audit

Openclaw Social Scheduler

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but scheduled posts store reusable social-media credentials in a local plaintext queue, so users should review it before installing.

Use this only with dedicated, revocable, least-privilege social credentials. Keep config files and storage/queue.json out of git, backups, and shared workspaces; avoid untrusted remote media URLs; and update or replace the older dependency stack before relying on it for sensitive accounts.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/queue.js:55
Finding: Scheduled Platform Credentials Are Persisted in Plaintext
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/media.js:48
Finding: Unrestricted Remote Media Retrieval Enables SSRF and Memory Exhaustion
Content: View full analysis
0) { throw new Error(`Reddit lease error: ${JSON.stringify(lease.errors)}`); } // Step 2: Upload to S3 const formData = new (require('form-data'))(); Object.entries(lease.args.fields).forEach(([key, value]) => { formData.append(key, value); }); formData.append('fi ...[truncated 2958 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (86)

Known Vulnerable Dependency: form-data==2.3.3 — 2 advisory(ies): CVE-2025-7783 (form-data uses unsafe random function in form-data for choosing boundary); CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

Critical

Category: Supply Chain
Confidence: 95% confidence
Finding: form-data 2.3.3 is present transitively under request and carries both CRLF injection and unsafe boundary-generation advisories. Because this older version is tied to an unmaintained HTTP stack and may be used for multipart uploads, exploitation could enable request smuggling/corruption or make multipart boundaries guessable in sensitive integrations.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · COMPLETION-REPORT.txt (reported line 45)May include surrounding context.
text
1. Discord ✅ Webhooks + rich embeds 2. Reddit ✅ OAuth2, posts & comments 3. Twitter/X ✅ OAuth 1.0a tweets 4. Mastodon ✅ Access token, any instance 5. Bluesky ✅ AT Protocol 6. Moltbook ⭐ AI-only social network (JUST SHIPPED!)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · MEDIA-GUIDE.md (reported line 312)May include surrounding context.
md
1. Discord ✅ Webhooks + rich embeds 2. Reddit ✅ OAuth2, posts & comments 3. Twitter/X ✅ OAuth 1.0a tweets 4. Mastodon ✅ Access token, any instance 5. Bluesky ✅ AT Protocol 6. Moltbook ⭐ AI-only social network (JUST SHIPPED!)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · MEDIA-GUIDE.md (reported line 313)May include surrounding context.
text
### "Access token invalid" Regenerate your access tokens from the platform's developer portal. ## Testing

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
node scripts/schedule.js add discord YOUR_WEBHOOK_URL "Scheduled message!" "2026-02-02T20:00:00"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
node scripts/schedule.js add discord YOUR_WEBHOOK_URL "Scheduled message!" "2026-02-02T20:00:00"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
node scripts/schedule.js add discord YOUR_WEBHOOK_URL "Scheduled message!" "2026-02-02T20:00:00"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.
md
node scripts/schedule.js add discord YOUR_WEBHOOK_URL "Scheduled message!" "2026-02-02T20:00:00"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.
md
node scripts/schedule.js add discord YOUR_WEBHOOK_URL "Scheduled message!" "2026-02-02T20:00:00"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.
md
node scripts/schedule.js add discord YOUR_WEBHOOK_URL "Scheduled message!" "2026-02-02T20:00:00"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
md
node scripts/schedule.js add discord YOUR_WEBHOOK_URL "Scheduled message!" "2026-02-02T20:00:00"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.
md
node scripts/schedule.js add discord YOUR_WEBHOOK_URL "Scheduled message!" "2026-02-02T20:00:00"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.
md
node scripts/schedule.js add discord YOUR_WEBHOOK_URL "Scheduled message!" "2026-02-02T20:00:00"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
md
node scripts/schedule.js add discord YOUR_WEBHOOK_URL "Scheduled message!" "2026-02-02T20:00:00"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.
md
node scripts/schedule.js add discord YOUR_WEBHOOK_URL "Scheduled message!" "2026-02-02T20:00:00"

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.
md
node scripts/thread.js twitter config.json \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.
md
node scripts/thread.js twitter config.json \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.
md
node scripts/thread.js twitter config.json \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.
md
node scripts/thread.js twitter config.json \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.
md
node scripts/thread.js twitter config.json \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.
md
node scripts/thread.js twitter config.json \

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

Category: Supply Chain
Confidence: 92% confidence
Finding: brace-expansion 1.1.12 is present and multiple advisories describe denial-of-service through crafted brace patterns that trigger exponential expansion or hangs. Even though this is transitive, packages that process attacker-influenced glob or pattern input can be forced into excessive CPU or memory consumption.
Content: No source excerpt is available for this finding.

Possible Typosquatting: 'ext' resembles popular package 'next'

High

Category: Supply Chain
Confidence: 70% confidence
Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 89% confidence
Finding: form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names/filenames. In a social scheduler that likely uploads media or posts to APIs, attacker-controlled multipart metadata could corrupt outbound HTTP requests or inject unintended headers/body parts if exposed through user input.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/platforms/mastodon.js:94

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/platforms/twitter.js:103

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/test.js:49

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/upload-media.js:86