Security audit

postroom

Security checks for vulnerabilities and agentic risk

Overview

The skill supports social publishing with explicit preview approval and safeguards appropriate to its purpose.

Connecting gives Postroom access to the workspace and permissions you approve. Use social.read for inspection alone, authorize writing only when needed, and review every publishing preview. Credentials belong in the browser-based OAuth flow. This review covers the instruction file, not the remote service's implementation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
sk the operator to configure the native OpenClaw MCP client:

sh
openclaw mcp set postroom '{"url":"https://social.notacompanynameyet.com/mcp","transport":"streamable-http","auth":"oauth","oauth":{"scope":"social.read social.write"}}' openclaw mcp login postroom openclaw mcp probe postroom --json

The operator signs into Postroom and approves scopes in the browser. Never collect passwords, cookies, API keys or OAuth codes in chat. Keep credentials in the host's OAuth store. Do not overwrite an existing server definition without checking it. For a read-only connection request only social.read. Use a private, operator-controlled agent session; do not expose an operator's workspace to unrelated chat users.

Discover tools rather than fabricating host-prefixed names. Postroom names begin with yet_. If tools are missing, explain the connection state and stop before claiming success.

Inspect

Call yet_profile and yet_accounts; read yet_brand when drafting. Use only the signed-in w

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
openclaw mcp probe postroom --json

text
The operator signs into Postroom and approves scopes in the browser. Never collect passwords, cookies, API keys or OAuth codes in chat. Keep credentials in the host's OAuth store. Do not overwrite an existing server definition without checking it. For a read-only connection request only social.read. Use a private, operator-controlled agent session; do not expose an operator's workspace to unrelated chat users. Discover tools rather than fabricating host-prefixed names. Postroom names begin with yet_. If tools are missing, explain the connection state and stop before claiming success.

Static analysis