ClawHub
Back to skill

Security audit

posty

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Posty CLI guide for scheduling and managing social posts, with expected account, media upload, publishing, billing, and analytics actions.

Install only the documented posty-cli package, review what account and workspace you authenticate, and confirm any post creation, deletion, subscription, payment link, or FotoAI credit use before allowing the agent to run it. Be careful with timezone examples and use your actual timezone when scheduling.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1003)May include surrounding context.

md
Posty can generate video, and do not call those routes: they 404.
- **No image or video generation of any kind through this CLI.** Media comes
  from files the user already has, via `posty upload`.
- **No channel deletion.** `DELETE /integrations/:id` was deliberately removed
  from the public API. Disconnecting a channel is a signed-in, admin action in
  the web app.
- **Nothing outside the channel table at the top of this file.**

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
official website: https://posty.hu
API base: https://api.posty.hu (also served at https://posty.hu/api)
MCP server, for chat clients without a terminal: https://api.posty.hu/mcp-oauth
(the user signs in to Posty in the browser; same account, same channels)

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

md
official website: https://posty.hu
API base: https://api.posty.hu (also served at https://posty.hu/api)
MCP server, for chat clients without a terminal: https://api.posty.hu/mcp-oauth
(the user signs in to Posty in the browser; same account, same channels)

---

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The signup example includes timezone and language in the returned fields and then demonstrates account creation with --timezone Europe/Budapest as the concrete example. In context, this can steer the agent toward a fixed locale during user account setup without first obtaining the user's preferred timezone or language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instruction tells the agent to pass --timezone Europe/Budapest or save that timezone as configuration when operating off-terminal. This imposes a specific locale choice by default rather than asking the user for their timezone, and the file does not justify this as a region-specific-only skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The documentation contains a material contradiction: it states the CLI cannot generate image or video media, yet earlier sections document fotoai:* commands that generate media and return publishable asset paths. This can mislead an agent into suppressing, skipping, or mishandling media-generation capabilities and consent/credit checks, creating unsafe automation behavior and incorrect user disclosures.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.