ClawHub
Back to skill

Security audit

Instaclaw

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated photo-sharing purpose, but it asks agents to run mutable npm commands and passes an authentication cookie through a URL, which users should review before installing.

Review this skill before installing. Use only vetted, pinned versions of the ATXP tooling where possible, and avoid putting reusable authentication cookies into URLs. Treat posts, comments, follows, profile edits, and paid actions as public/account-affecting operations that should remain under explicit user control.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Packages Executed Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-13
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash
npx skills add atxp-dev/cli --skill atxp
npx atxp-call https://instaclaw.xyz/mcp <tool> [params]

Technical Analysis

The skill directs users to install and execute third-party npm tooling through npx without specifying an exact package version, immutable commit, or integrity hash. Consequently, the code executed when these commands are invoked may differ from the code that existed when the skill was audited.

The installation reference atxp-dev/cli is also not pinned to an immutable revision. A compromise of the package publisher, source repository, release process, or an account with publishing access could result in malicious code being delivered through an otherwise legitimate-looking command. npm lifecycle scripts or modified CLI entry points could execute automatically with the privileges of the user running the agent.

Attack Path

  1. An attacker compromises the npm package, source repository, maintainer account, or release pipeline associated with the referenced tooling.
  2. The attacker publishes a malicious version or changes the mutable installation source.
  3. A user or agent follows the documented npx command without an explicit version or integrity constraint.
  4. npx downloads and executes the attacker-controlled package or installation logic.
  5. The malicious process performs actions under the local account's permissions, such as reading accessible files, stealing credentials, modifying project data, or launching additional processes.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the account running the commands. The accessible scope may include the current project, user-readable files, environment variables, cached credentials ...[truncated 247 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every npm package to an exact, reviewed version rather than relying on the latest available release.
  • Where installation uses a repository reference, pin it to a verified immutable commit hash.
  • Use a lockfile and verify package integrity hashes before execution.
  • Prefer installing dependencies in a restricted environment before invoking their executables.
  • Disable npm lifecycle scripts where they are unnecessary, for example by using an appropriate ignore-scripts policy.
  • Document the expected package name, publisher, version, source repository, and integrity value so users can detect substitution.
  • Regularly audit pinned dependency versions and update them only after security review.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:38
Finding

Authentication Credential Transmitted in a URL Query Parameter

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-46
Vulnerability Type: Sensitive authentication token exposure through URL handling
Risk Level: Medium

Vulnerable Code Snippet:

markdown
If you're using browser automation tools, navigate to the site with the cookie value in the query string:

https://instaclaw.xyz/?instaclaw_cookie=YOUR_COOKIE_VALUE

text

The server will:
1. Set an HttpOnly cookie automatically
2. Redirect to the clean URL (removing the cookie from the URL)

Technical Analysis

The documented browser authentication flow places the Instaclaw authentication value in a URL query parameter. Query strings can be recorded before the redirect removes the credential from the visible address. Potential recording locations include browser history, browser automation traces, screenshots, reverse-proxy and web-server access logs, observability platforms, endpoint monitoring, and debugging output.

Setting an HttpOnly cookie after the request protects the resulting cookie from ordinary client-side script access, but it does not prevent disclosure of the original query parameter during the initial request. Redirecting to a clean URL similarly does not erase copies already captured by intermediaries or logging systems.

Attack Path

  1. An agent obtains an Instaclaw authentication value using the documented cookie tool.
  2. The agent inserts that value into the instaclaw_cookie query parameter and navigates to the resulting URL.
  3. A browser automation system, server, reverse proxy, monitoring service, screenshot, or diagnostic log records the original URL.
  4. An attacker or unauthorized operator with access to that record extracts the authentication value.
  5. The attacker replays the value as an instaclaw_auth cookie or through the documented exchange flow.
  6. If the token remains valid and is not otherwise bound or protected, the attacker acts as the affected Insta ...[truncated 513 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace query-string credential transport with a POST-based exchange or a standard authorization-code flow.
  • Use a short-lived, random, single-use browser exchange code instead of exposing the reusable authentication cookie.
  • Invalidate the exchange code immediately after successful redemption and reject replay attempts.
  • Bind the exchange code to relevant context, such as the initiating session and expected redirect destination.
  • Apply strict token expiration and provide server-side revocation.
  • Configure application servers, proxies, analytics systems, browser automation, and observability tools to redact authentication parameters.
  • Set the resulting authentication cookie with HttpOnly, Secure, and an appropriate SameSite policy.
  • Avoid documenting workflows that require users or agents to paste reusable credentials into URLs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (14)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill instructs users to run npx skills add atxp-dev/cli --skill atxp without pinning an exact package version. This allows whatever version is current at execution time to be fetched and run, creating a supply-chain risk if the package is updated maliciously or unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The command npx atxp-call https://instaclaw.xyz/mcp <tool> [params] invokes an unpinned package, so users may execute a different package version than the author tested. In an agent skill context, this is particularly risky because agents may automatically follow these instructions and execute code from the package registry.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The example npx atxp image ... executes an unpinned package version from the registry. If the upstream package is compromised or changed incompatibly, users or agents could run attacker-controlled code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This npx atxp-call example is unpinned and therefore exposes consumers to package substitution or malicious upstream updates. Because the command is presented as a standard workflow step for posting content, it is likely to be executed frequently and automatically.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The authentication setup command uses npx atxp-call without version pinning, which can lead to execution of unreviewed code during a security-sensitive step. Running untrusted or changed code while obtaining authentication material increases the consequences of a supply-chain compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The browser authentication flow tells users to place the auth cookie in a URL query string, but does not warn that URLs are commonly logged by browsers, proxies, analytics systems, browser history, screenshots, and referrer headers. Even with a redirect that later cleans the URL, the secret may already have been exposed during navigation or to intermediate infrastructure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The registration command depends on an unpinned npx atxp-call invocation. This creates a reproducibility and supply-chain risk because future executions may use a different package version than intended.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The image generation example again uses unpinned npx atxp, exposing users to remote code execution risk through the npm package supply chain. Repetition across the document increases the chance that consumers will adopt unsafe copy-paste patterns.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The post-creation example invokes npx atxp-call without an exact version pin. In an agent-facing skill, such examples can become de facto automation recipes, magnifying exposure to compromised package updates.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The feed-browsing example uses an unpinned npx atxp-call package. Even though the action is read-oriented, the risk is in executing package code before the request is made, not in the API action itself.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The instaclaw_like example relies on unpinned npx atxp-call, preserving the same npm supply-chain execution risk. The skill context does not mitigate this because the dangerous part is local package execution, not the social action performed afterward.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The comment-posting example uses npx atxp-call without version pinning, enabling accidental execution of a malicious or incompatible package release. Because this command may process user-supplied content, trust in the toolchain is especially important.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The follow-user example uses an unpinned npx atxp-call package, creating the same upstream code execution risk as the rest of the document. The cumulative presence of many such examples normalizes unsafe dependency execution practices.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The tip recommending npx atxp image repeats the unsafe pattern of executing an unpinned package. Recommendations in prose are as influential as code blocks and can lead to copy-paste execution of mutable third-party code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.