ClawHub
Back to skill

Security audit

Buffer Publisher

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Buffer publishing helper, but it includes an off-scope authenticated account query that retrieves unnecessary email/account data.

Install only if you intend agents to publish or schedule posts to the listed Buffer-connected social channels. Remove or avoid the Get Connected Channels example as written, especially the email field, and keep Buffer API responses and bearer tokens out of logs and shared transcripts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Note
Location
SKILL.md:193
Finding

Unnecessary Retrieval of Buffer Account Email

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 193–199
Vulnerability Type: Excessive Personal Data Retrieval
Risk Level: Low

Vulnerable Code

bash
curl -s -X POST \
  -H "Authorization: Bearer $BUFFER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ account { id name email channels { id name service } } }"}' \
  https://api.buffer.com/graphql

Technical Analysis

The documented “Get Connected Channels” operation requests the Buffer account's email field even though discovering connected channels only requires channel identifiers, names, and service types. This violates data-minimization principles by retrieving personally identifiable information unrelated to the stated operation.

The request is sent to the declared official Buffer API rather than an unrelated third party. However, the returned email address can still enter terminal output, automation logs, agent context, or other response-capture systems. The API credential itself is referenced through an external secret manager and is not hard-coded in the project.

Attack Path

  1. An operator or agent follows the documented channel-discovery procedure.
  2. The command authenticates to Buffer using the account owner's bearer token.
  3. Buffer returns the account ID, name, email address, and channel information.
  4. The complete response may be captured in terminal output, agent context, CI logs, or automation telemetry.
  5. Anyone with access to those records may obtain the account email even though it was unnecessary for channel discovery.

Impact Assessment

Exploitation does not grant additional Buffer privileges, system access, or code execution. The scope is limited to unnecessary disclosure of the authenticated Buffer account's email address to systems or people capable of viewing captured command output. The practical impact is a low-severity privacy and information-exposure risk.

Remediation
View remediation

Remediation Suggestions

Apply data minimization by removing the account email and other unnecessary account metadata from the GraphQL selection set:

bash
curl -s -X POST \
  -H "Authorization: Bearer $BUFFER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ account { channels { id name service } } }"}' \
  https://api.buffer.com/graphql

Additionally:

  • Avoid logging complete API responses unless required for debugging.
  • Redact account metadata from diagnostic and automation logs.
  • Restrict access to logs containing authenticated API responses.
  • Document only the minimum GraphQL fields required for each operation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document explicitly states reading/querying is out of scope, yet later provides concrete instructions to perform authenticated read operations. This contradiction can mislead downstream agents into performing unintended data-access actions and undermines scope-based safety controls that rely on the skill description being accurate.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
## Credentials
- API key: `op://OpenClaw/Buffer API Credentials/credential`
- API base: `https://api.buffer.com/graphql`
- Auth header: `Authorization: Bearer <key>`

## Connected Channels

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
## Credentials
- API key: `op://OpenClaw/Buffer API Credentials/credential`
- API base: `https://api.buffer.com/graphql`
- Auth header: `Authorization: Bearer <key>`

## Connected Channels

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md
## Credentials
- API key: `op://OpenClaw/Buffer API Credentials/credential`
- API base: `https://api.buffer.com/graphql`
- Auth header: `Authorization: Bearer <key>`

## Connected Channels

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

md
## Credentials
- API key: `op://OpenClaw/Buffer API Credentials/credential`
- API base: `https://api.buffer.com/graphql`
- Auth header: `Authorization: Bearer <key>`

## Connected Channels

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is described as publish-only, but it documents a GraphQL query that retrieves account metadata including email and channel information, plus schema introspection guidance. This expands the skill's effective capability from write-only publishing to authenticated data retrieval, increasing the risk of unnecessary data exposure and misuse of the Buffer credential beyond the stated scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This example sends an authenticated external request that retrieves account ID, name, email, and channel data from Buffer. While external transmission is expected for publishing, this particular request performs unnecessary data collection for a publish-only skill and could expose account metadata if used broadly or logged.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

Get Connected Channels

bash
curl -s -X POST \
  -H "Authorization: Bearer $BUFFER_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query": "{ account { id name email channels { id name service } } }"}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This endpoint use is part of the account/channel query example, which performs authenticated retrieval of account metadata rather than publishing. In context, the danger is not the destination URL itself but that the skill enables off-scope data access through external requests using a privileged token.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

-H "Authorization: Bearer $BUFFER_KEY"
-H "Content-Type: application/json"
-d '{"query": "{ account { id name email channels { id name service } } }"}'
https://api.buffer.com/graphql

text

## Twitter/X Threads via Buffer

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

md
- Always include `-H "Content-Type: application/json"` in curl calls

4. **Using the legacy v1 API base URL**
   - ❌ `https://api.bufferapp.com/1/` → returns 500, dead endpoint
   - ✅ `https://api.buffer.com/graphql`

5. **Including `CoreApiError` in the error fragment**

Static analysis

No suspicious patterns detected.