ClawHub
Back to skill

Security audit

Phy Post Forensics

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local social-media post analyzer whose behavior matches its stated purpose, with privacy cautions around the post text users choose to process or export.

Installers should treat this as a local analysis tool and only provide posts they are allowed to analyze. Be careful with private drafts, confidential campaigns, or third-party personal data, especially when using JSON output because it includes short text previews from the input posts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Script Fetching

High
Category
Supply Chain
Content
### Reddit
```bash
# Use Reddit user history API
curl "https://www.reddit.com/user/USERNAME/submitted.json?limit=100" | python3 -c "
import json, sys
data = json.load(sys.stdin)
posts = [{'text': p['data']['title'] + ' ' + p['data'].get('selftext', ''),
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly instructs users to export and process social-media post text, engagement metrics, and platform data without any privacy warning, data-minimization guidance, or note about handling third-party/personal information. While the omission is not an exploit by itself, it can lead users to ingest sensitive or regulated data into local workflows or downstream tooling without understanding the privacy implications.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The tool includes user-supplied post content in its human-readable report, which can expose sensitive or proprietary text to anyone who views logs, terminal history, shared screenshots, or downstream report storage. In this context, the script is explicitly designed to process potentially private social media drafts and historical posts, so echoing content back without warning or redaction creates a real confidentiality risk even though it is not code execution.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The JSON output exports text previews derived from input posts, which makes accidental data disclosure more likely because JSON is commonly ingested into logs, pipelines, dashboards, and artifact storage. Since this skill is a data-processing CLI intended for batch analysis, the structured export increases the chance that sensitive text is propagated beyond the original operator without explicit consent or disclosure.

Static analysis

No suspicious patterns detected.