ClawHub
Back to skill

Security audit

content-pipeline

Security checks for vulnerabilities and agentic risk

Overview

The skill is an openly described content automation pipeline, but it can automatically publish to social platforms without review, which deserves careful user review before installation.

Install only if you want an agent to run an end-to-end content pipeline that may publish to social accounts. Use stage-by-stage mode, review generated content and destination accounts before publishing, and avoid --auto or --skip-review unless you have separate safeguards around social posting.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description is very broad and can match ordinary content-related requests, increasing the chance the agent invokes a workflow that includes drafting, design, and publishing when the user did not explicitly ask for all of those actions. In this skill's context, that broad trigger surface is more dangerous because later stages can cause external side effects such as publication to social platforms.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The --auto mode enables autonomous execution of the full multi-stage workflow, including planning, writing, design, publishing, and tracking, with limited evidence of mandatory human intervention. While automation itself is not inherently malicious, in this context it materially increases risk because a single invocation can cascade into external posting and event-file propagation across stages.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
## Options

- `--auto` — Auto-execute all stages
- `--step <plan|write|design|publish|track>` — Execute specific stage only
- `--topic <topic>` — Specify content topic
- `--skip-review` — Proceed without approval at each stage (risky)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The --skip-review option allows the workflow to proceed without approval at each stage, removing human checkpoints before content is generated, transformed, and ultimately published. In this skill, that autonomy is especially risky because the pipeline culminates in social publishing, so mistakes or manipulated upstream inputs can directly lead to unauthorized or harmful external actions.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md
- `--auto` — Auto-execute all stages
- `--step <plan|write|design|publish|track>` — Execute specific stage only
- `--topic <topic>` — Specify content topic
- `--skip-review` — Proceed without approval at each stage (risky)

## Execution Flow

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation describes auto-publishing to Instagram/SNS as part of the normal pipeline but does not present a strong, explicit warning that this performs an external action on behalf of the user. In context, this is more dangerous because the same skill also supports automatic progression through prior stages, making unintended public posting and reputational harm more plausible.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.