ClawHub
Back to skill

Security audit

Content Generator - Articles, Social Posts, Videos & Images from Any Topic or URL

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real GenerateBot API guide, but it under-scopes high-impact publishing and deletion actions that can run through connected accounts.

Review this before installing if you use connected social or CMS accounts. Treat publishing, scheduling, content deletion, RSS clearing, and template deletion as actions that should require explicit confirmation with the exact target and destination, even though the skill text presents many of them as free operations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (33)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
|--------|----------|---------|------|
| Search content | POST /agents/news-aggregator | 10 | sync |
| Fetch RSS feeds | POST /rss | 0 | sync |
| Manage RSS feeds | GET/PUT/DELETE /rss | 0 | sync |
| Generate from URL | POST /pipelines (content-analyzer) | 100 | async |
| Generate from topic | POST /pipelines (topic-to-content) | 100 | async |
| Generate scripts | POST /pipelines (script-generator) | 15 | async |
Confidence
96% confidence
Finding
The quick-reference table includes account-modifying and destructive RSS management operations, including DELETE, without any embedded safety gating. In a skill intended for broad content workflows, exposing destructive endpoints this early increases the risk that an agent will invoke them from loosely phrased management requests.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| List runs | GET /pipelines | 0 | sync |
| Save content | POST /content | 0 | sync |
| List content | GET /content | 0 | sync |
| Get/Update/Delete | GET/PATCH/DELETE /content/{id} | 0 | sync |
| Check credits | GET /credits | 0 | sync |
| Credit transactions | GET /credits/transactions | 0 | sync |
Confidence
97% confidence
Finding
The quick-reference table advertises DELETE /content/{id} alongside normal CRUD operations without guardrails. That makes accidental or unauthorized deletion easier in an agentic environment where natural-language requests may be interpreted too broadly.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- Input: `{ "feedUrls": ["https://example.com/feed.xml"] }` (max 50)
- Requires an existing business profile

**DELETE /api/v1/rss** - Clear all saved feed URLs (requires `rss:write` scope)

---
Confidence
98% confidence
Finding
DELETE /api/v1/rss clears all saved feed URLs, making it an account-wide destructive action. Without strict confirmation and preview requirements, an attacker or ambiguous prompt could cause loss of saved sourcing configuration and disrupt content workflows.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**PATCH /api/v1/content/{id}** - Update (title, contentData, tags, notes, status)

**DELETE /api/v1/content/{id}** - Delete

---
Confidence
97% confidence
Finding
DELETE /api/v1/content/{id} is a state-changing destructive operation documented without user-safety controls. In a skill that broadly handles content workflows, this increases the chance of accidental deletion of stored content from prompt confusion or parameter tampering.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| CMS publish history | GET /cms/history | 0 |
| Create template | POST /templates | 0 |
| List templates | GET /templates | 0 |
| Get/Update/Delete | GET/PATCH/DELETE /templates/{id} | 0 |
| Render template | POST /templates/{id}/render | 20 |
| Enrich with links | POST /enrich/internal-links | 20 |
| Enrich with images | POST /enrich/images | 20 |
Confidence
95% confidence
Finding
The publish quick-reference exposes template deletion adjacent to benign template actions, but gives no indication that deletion is destructive or confirmation-gated. This weakens user intent verification and can lead to loss of reusable assets.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**PATCH /api/v1/templates/{id}** - Update (name, description, category, canvasJson, templateMetadata, isActive)

**DELETE /api/v1/templates/{id}** - Delete template

**POST /api/v1/templates/{id}/render** (20 credits) - Render template to image
```json
Confidence
97% confidence
Finding
DELETE /api/v1/templates/{id} permanently removes a template and is documented without any safety interlock. Because templates are reusable workflow assets, accidental or manipulated deletion can disrupt content production and require re-creation of design work.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
Partial updates. Send only the fields to change (`name`, `category`, `canvasJson`, `templateMetadata`, `isActive`).

#### DELETE /templates/{id} -- Delete Template

Returns `{ "success": true, "data": { "deleted": true } }`.
Confidence
96% confidence
Finding
The standalone delete-template reference reinforces destructive capability without contextual warnings or confirmation requirements. Repetition of unsafe delete guidance across the skill increases the probability that an agent will treat deletion as a routine operation rather than a guarded action.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
|--------|----------|---------|------|
| Search content | POST /agents/news-aggregator | 10 | sync |
| Fetch RSS feeds | POST /rss | 0 | sync |
| Manage RSS feeds | GET/PUT/DELETE /rss | 0 | sync |
| Generate from URL | POST /pipelines (content-analyzer) | 100 | async |
| Generate from topic | POST /pipelines (topic-to-content) | 100 | async |
| Generate scripts | POST /pipelines (script-generator) | 15 | async |
Confidence
86% confidence
Finding
The quick reference advertises GET/PUT/DELETE management of RSS feeds, including a bulk DELETE capability, without any safety conditions or confirmation requirements. In an LLM-controlled tool environment, destructive endpoints are especially dangerous because vague user phrasing or prompt injection can be translated into state-changing actions affecting all saved feeds.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| List runs | GET /pipelines | 0 | sync |
| Save content | POST /content | 0 | sync |
| List content | GET /content | 0 | sync |
| Get/Update/Delete | GET/PATCH/DELETE /content/{id} | 0 | sync |
| Check credits | GET /credits | 0 | sync |
| Credit transactions | GET /credits/transactions | 0 | sync |
Confidence
83% confidence
Finding
The skill surfaces delete capability for content items directly in the quick reference, but provides no constraints, confirmation steps, or anti-abuse guidance. Because content records may contain drafts or publishing assets, a mistaken or manipulated invocation could permanently remove valuable user data.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
- Input: `{ "feedUrls": ["https://example.com/feed.xml"] }` (max 50)
- Requires an existing business profile

**DELETE /api/v1/rss** - Clear all saved feed URLs (requires `rss:write` scope)

---
Confidence
93% confidence
Finding
The endpoint DELETE /api/v1/rss clears all saved feed URLs, making it a bulk destructive operation with outsized blast radius. Given this skill's role in content sourcing, accidental or malicious invocation could erase a user's configured feed set and disrupt downstream workflows.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**PATCH /api/v1/content/{id}** - Update (title, contentData, tags, notes, status)

**DELETE /api/v1/content/{id}** - Delete

---
Confidence
87% confidence
Finding
DELETE /api/v1/content/{id} enables permanent removal of stored content and is documented without guardrails. In the context of an AI skill that manages drafts and publishing assets, unauthorized or accidental deletion can cause direct data loss and workflow disruption.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| CMS publish history | GET /cms/history | 0 |
| Create template | POST /templates | 0 |
| List templates | GET /templates | 0 |
| Get/Update/Delete | GET/PATCH/DELETE /templates/{id} | 0 |
| Render template | POST /templates/{id}/render | 20 |
| Enrich with links | POST /enrich/internal-links | 20 |
| Enrich with images | POST /enrich/images | 20 |
Confidence
90% confidence
Finding
The skill exposes destructive and high-impact mutating operations, including delete, post, publish, patch, and render endpoints, without documenting approval gates, parameter restrictions, or user-confirmation requirements. This creates a tool-parameter abuse risk where ambiguous or attacker-influenced prompts could cause unintended deletion of templates or unwanted publication to external systems.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
**PATCH /api/v1/templates/{id}** - Update (name, description, category, canvasJson, templateMetadata, isActive)

**DELETE /api/v1/templates/{id}** - Delete template

**POST /api/v1/templates/{id}/render** (20 credits) - Render template to image
```json
Confidence
94% confidence
Finding
The explicit DELETE /api/v1/templates/{id} endpoint enables irreversible state changes, yet the skill text does not mention any confirmation flow, ownership verification, or safeguards against deleting the wrong template. In a multi-step content workflow skill, this is dangerous because users or prompt-injected content could steer the agent into destructive actions using only a template ID.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
Partial updates. Send only the fields to change (`name`, `category`, `canvasJson`, `templateMetadata`, `isActive`).

#### DELETE /templates/{id} -- Delete Template

Returns `{ "success": true, "data": { "deleted": true } }`.
Confidence
89% confidence
Finding
Exposing a DELETE operation in a skill without guardrails enables tool parameter abuse: an attacker or confused user could cause deletion of arbitrary templates by supplying or influencing a template ID. Because the action is destructive and appears to succeed synchronously, the risk is higher than a read-only or reversible operation.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The top-level description is extremely broad and overlaps with common requests like writing, publishing, and automating content workflows. This can cause over-invocation of the skill and accidental triggering of external actions in contexts where the user did not clearly request GenerateBot or consent to third-party processing.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill advertises social publishing, CMS publishing, and workflow automation from the first description line, but does not prominently warn that these actions can post externally or modify persistent data. In an agent setting, missing up-front warnings materially increases the risk of unintended publication or destructive actions from ambiguous user prompts.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The documentation exposes a destructive DELETE operation for saved RSS feeds without requiring explicit confirmation guidance in the skill instructions. In agent-mediated use, that omission can turn ambiguous cleanup or management requests into irreversible account-wide deletion of saved sources.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill includes a Reddit reply generation capability that is outside the core stated purpose of content generation, publishing, and design workflows. Expanding capability scope without clear justification increases the chance of unintended social-engagement actions and broadens the attack surface for prompt-triggered misuse.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill description includes broad triggers like 'write a blog post', 'generate SEO content', 'research trending topics', and 'fetch news', which overlap with many generic user requests and can cause the agent to invoke this skill when the user did not specifically intend to use GenerateBot. In this context, the skill can send user prompts, URLs, and content to an external API and consume credits, so overbroad routing increases the risk of unintended data disclosure and unnecessary side effects.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation exposes destructive operations such as clearing all saved RSS feeds without any warning, confirmation guidance, or recovery notice. In an agentic setting, omission of guardrails around destructive endpoints can lead to accidental mass deletion of user data if the model misinterprets a request or is prompt-injected into performing cleanup actions.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill description contains broad triggers such as generating content, publishing to social media or CMS, and automating workflows, which can cause the skill to activate for common user requests without clearly establishing that external side effects may occur. In a publishing skill, overbroad activation increases the chance of unintended posting, account use, or escalation into connected external systems.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation describes direct posting and publishing capabilities to social media and CMS accounts but does not provide user-facing warnings that these actions have real external side effects. In this context, the absence of warnings is especially dangerous because the skill can publish, schedule, and cross-post content to connected accounts, creating a high risk of accidental unauthorized actions or reputational damage.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explains rendering behavior but does not warn that rendering uploads output to a CDN and causes external retrieval/processing of user-supplied image URLs and text content. This matters because users may unknowingly send proprietary images, sensitive text, or internal URLs to a third-party service during rendering.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill documents a destructive DELETE endpoint without instructing the agent to obtain explicit user confirmation or warn that deletion is irreversible. In an agent setting, this increases the risk of accidental or prompt-induced deletion of user assets, especially because template IDs can be acted on directly once discovered.

External Transmission

Medium
Category
Data Exfiltration
Content
**Step 1: Create**
```bash
curl -X POST https://generatebot.com/api/v1/templates \
  -H "Authorization: Bearer GENERATEBOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
generatebot-core/SKILL.md:20

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
generatebot-publish/SKILL.md:20

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
generatebot-templates/SKILL.md:20

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
generatebot-video/SKILL.md:20

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
generatebot-workflows/SKILL.md:20

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:20