Security audit

social-postcjo

Security checks for vulnerabilities and agentic risk

Overview

The active skill is a reviewed social-posting guide with explicit approval and dry-run safeguards, though a packaged backup file contains older risky credential and auto-confirm examples.

Install only if you are comfortable giving an agent-assisted workflow authority to post publicly after your explicit approval. Treat the backup file as obsolete: do not use auto-confirm for live posts, and prefer a protected secret manager or tightly permissioned environment injection over plaintext API tokens or wallet keys in home-directory files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
5. Publish only the approved payload. 6. Report the resulting post URLs or IDs. Never expose credentials, private keys, access tokens, or wallet material. Never use an auto-confirm flag. If approval is missing or the payload changes after approval, stop and request approval again. ## Platform checks

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md.bak (reported line 65)May include surrounding context.
text
4. **Generate Keys** - Consumer Key & Secret: In "Keys and tokens" tab - Access Token & Secret: Click "Generate" under "Authentication Tokens" - Save all 4 credentials securely 4. **Add to .env file**

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The documentation instructs users to append API secrets to a persistent .env file in the home directory. This is a common pattern but still a security weakness in shared or agent-accessible environments because long-lived plaintext tokens are easy to harvest and reuse.
Content: Scanner excerpt · SKILL.md.bak (reported line 68)May include surrounding context.
text
- Access Token & Secret: Click "Generate" under "Authentication Tokens" - Save all 4 credentials securely 4. **Add to .env file** ```bash echo "X_CONSUMER_KEY=xxx" >> ~/.openclaw/.env echo "X_CONSUMER_SECRET=xxx" >> ~/.openclaw/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Appending consumer secrets to ~/.openclaw/.env encourages plaintext storage of credentials that can authorize API actions. In this skill's context, compromise could enable unauthorized posting and billing abuse.
Content: Scanner excerpt · SKILL.md.bak (reported line 70)May include surrounding context.
text
4. **Add to .env file** ```bash echo "X_CONSUMER_KEY=xxx" >> ~/.openclaw/.env echo "X_CONSUMER_SECRET=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN_SECRET=xxx" >> ~/.openclaw/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Appending access tokens to a shared home-directory .env file creates a straightforward secret theft target. Access tokens are directly usable for account actions, so exposure can lead to account takeover of the posting capability.
Content: Scanner excerpt · SKILL.md.bak (reported line 71)May include surrounding context.
text
4. **Add to .env file** ```bash echo "X_CONSUMER_KEY=xxx" >> ~/.openclaw/.env echo "X_CONSUMER_SECRET=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN_SECRET=xxx" >> ~/.openclaw/.env ```

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Storing the access token secret in plaintext under ~/.openclaw/.env weakens protection of signing credentials for the X/Twitter integration. In an agent environment, local files may be more broadly readable than intended, increasing compromise risk.
Content: Scanner excerpt · SKILL.md.bak (reported line 72)May include surrounding context.
text
```bash echo "X_CONSUMER_KEY=xxx" >> ~/.openclaw/.env echo "X_CONSUMER_SECRET=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN_SECRET=xxx" >> ~/.openclaw/.env ```

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md.bak (reported line 73)May include surrounding context.
text
echo "X_CONSUMER_KEY=xxx" >> ~/.openclaw/.env echo "X_CONSUMER_SECRET=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN=xxx" >> ~/.openclaw/.env echo "X_ACCESS_TOKEN_SECRET=xxx" >> ~/.openclaw/.env ``` **Test your credentials:**

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The skill documents storage of Farcaster credentials, including private keys, in a plaintext JSON file under the user's home directory. Even though this is framed as setup guidance, normalizing local plaintext secret storage materially increases the risk of credential theft by other tools, agents, or users on the system.
Content: Scanner excerpt · SKILL.md.bak (reported line 84)May include surrounding context.
text
### Farcaster Setup **Required credentials** (stored in `/home/phan_harry/.openclaw/farcaster-credentials.json`): ```json { "fid": "your_farcaster_id",

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md.bak (reported line 128)May include surrounding context.
text
4. **Verify setup** ```bash # Check credentials exist ls -la ~/.openclaw/farcaster-credentials.json # Check wallet balance scripts/check-balance.sh

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md.bak (reported line 343)May include surrounding context.
text
4. **Verify setup** ```bash # Check credentials exist ls -la ~/.openclaw/farcaster-credentials.json # Check wallet balance scripts/check-balance.sh

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The requirements section explicitly depends on credentials stored in .env and a plaintext Farcaster credentials file. In an agent ecosystem, pointing to reusable local secret locations raises exposure risk because other skills or processes may read them if isolation is weak.
Content: Scanner excerpt · SKILL.md.bak (reported line 312)May include surrounding context.
text
## Requirements - Twitter credentials in `.env` (X_CONSUMER_KEY, X_CONSUMER_SECRET, X_ACCESS_TOKEN, X_ACCESS_TOKEN_SECRET) - Farcaster credentials in `/home/phan_harry/.openclaw/farcaster-credentials.json` - **USDC on Base chain** (custody wallet): 0.001 USDC per Farcaster cast - For images: `curl`, `jq`

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
5. Publish only the approved payload. 6. Report the resulting post URLs or IDs. Never expose credentials, private keys, access tokens, or wallet material. Never use an auto-confirm flag. If approval is missing or the payload changes after approval, stop and request approval again. ## Platform checks

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md.bak (reported line 58)May include surrounding context.
text
- Charged per API request (posts, reads, etc.) - No monthly minimums or fees 3. **Create an App** - In Developer Portal, create a new App - Name: "Social Post Bot" (or any name) - Set permissions to "Read and Write"

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md.bak (reported line 106)May include surrounding context.
text
# - Adding signer key # - Automatically saving credentials # See: /skills/farcaster-agent/SKILL.md ``` 2. **Or use existing credentials**

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · SKILL.md.bak (reported line 128)May include surrounding context.
text
4. **Verify setup** ```bash # Check credentials exist ls -la ~/.openclaw/farcaster-credentials.json # Check wallet balance scripts/check-balance.sh

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The auto-confirm behavior for posting removes an important safety control before an irreversible external action occurs. In an agent skill, this materially increases risk because generated content can be posted publicly and incur API costs without review.
Content: Scanner excerpt · SKILL.md.bak (reported line 219)May include surrounding context.
text
- `--shorten-links` - Shorten URLs to save characters - `--truncate` - Auto-truncate if over limit - `--dry-run` - Preview without posting - `-y, --yes` - Skip confirmation prompt (auto-confirm) #### For `reply.sh` (replying)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The auto-confirm behavior for posting removes an important safety control before an irreversible external action occurs. In an agent skill, this materially increases risk because generated content can be posted publicly and incur API costs without review.
Content: Scanner excerpt · SKILL.md.bak (reported line 219)May include surrounding context.
text
- `--shorten-links` - Shorten URLs to save characters - `--truncate` - Auto-truncate if over limit - `--dry-run` - Preview without posting - `-y, --yes` - Skip confirmation prompt (auto-confirm) #### For `reply.sh` (replying)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The auto-confirm behavior for replies similarly enables public actions without review. Since replies can target specific third-party content, unintended automated responses can create reputational, harassment, or spam risks.
Content: Scanner excerpt · SKILL.md.bak (reported line 229)May include surrounding context.
text
- `--shorten-links` - Shorten URLs to save characters - `--truncate` - Auto-truncate if over limit - `--dry-run` - Preview without replying - `-y, --yes` - Skip confirmation prompt (auto-confirm) ## Examples

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The auto-confirm behavior for replies similarly enables public actions without review. Since replies can target specific third-party content, unintended automated responses can create reputational, harassment, or spam risks.
Content: Scanner excerpt · SKILL.md.bak (reported line 229)May include surrounding context.
text
- `--shorten-links` - Shorten URLs to save characters - `--truncate` - Auto-truncate if over limit - `--dry-run` - Preview without replying - `-y, --yes` - Skip confirmation prompt (auto-confirm) ## Examples

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: Documenting --yes for automated posting removes the interactive confirmation gate before sending content to external social platforms. In an agent context, this increases the chance of unintended or prompt-influenced actions being executed without human review, causing reputational or financial harm via API usage.
Content: Scanner excerpt · SKILL.md.bak (reported line 257)May include surrounding context.
text
# Both platforms, auto-truncate long text scripts/post.sh --truncate "Very long message that might exceed limits..." # Preview without confirmation (for automated workflows) scripts/post.sh --yes "Automated post from CI/CD" ```

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: Using --yes for replies bypasses a confirmation step before content is posted publicly. In a skill designed for agents, this can enable accidental, manipulated, or contextually inappropriate replies to be published automatically.
Content: Scanner excerpt · SKILL.md.bak (reported line 279)May include surrounding context.
text
# Reply to both platforms (same message) scripts/reply.sh --twitter 123456 --farcaster 0xabc123 "This is exactly right 🎯" # Quick reply without confirmation scripts/reply.sh --twitter 123456 --yes "Quick acknowledgment" # Dry run to preview reply

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The documentation explicitly recommends using --yes to skip prompts in non-interactive or automated scenarios. Because the skill performs public external actions, this guidance lowers friction for autonomous posting and increases the impact of any upstream prompt manipulation or mistaken content generation.
Content: Scanner excerpt · SKILL.md.bak (reported line 306)May include surrounding context.
text
``` - Interactive mode: Prompts for confirmation - Non-interactive/automated: Use `--yes` flag to skip prompt - Dry run: Use `--dry-run` to preview without any posting ## Requirements

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The file includes Korean-only author/branding text, which can indicate a locale-specific presentation without stating that the skill is region- or language-specific. Because the document otherwise uses English and does not explain or offer a language choice, this may conflict with a policy requiring language/locale neutrality or user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.