ClawHub
Back to skill

Security audit

Itinerary Carousel Post Topaz

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent with its stated Instagram carousel purpose, but it can publish public posts, push and delete GitHub-hosted assets, send images to third-party services, and handles tokens in risky ways without clear approval gates.

Install only if you are comfortable giving the agent control over an Instagram account, a GitHub repo used for public image hosting, and Topaz image processing. Before use, add a required preview and approval step, remove or make tabiji.ai branding optional, avoid access_token in URLs, use a per-run temp directory, and delete only files created by the current run.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:99
Finding

Mandatory Promotional Content Injection into User-Published Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:147
Finding

Instagram Access Token Exposed in URL Query Strings

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:157
Finding

Overbroad Cleanup Commands Can Delete Unrelated Carousel Assets

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

  1. Cleanup hosted images — after publish is confirmed, delete the images from the tabiji repo and push:
bash
cd /path/to/tabiji/repo
git rm img/instagram/slide-*.jpg
git commit -m "cleanup: remove instagram carousel images after publish"
git push

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

text
Also clean up local temp files:
```bash
rm -rf /tmp/ig-carousel/

Output: Instagram post URL

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

text
Also clean up local temp files:
```bash
rm -rf /tmp/ig-carousel/

Output: Instagram post URL

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill sends locally stored images to Topaz Labs and later submits content to Facebook/Instagram using credential-backed API calls, but it does not disclose those third-party transfers to the user. This is dangerous because operators may unknowingly transmit copyrighted, sensitive, or regulated content to external vendors and perform actions under privileged accounts.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The synchronous Topaz enhancement request uploads a local image file to a third-party API using an API key from the macOS Keychain. That behavior is central to the feature, but it is still a real security/privacy concern because it transmits data off-device under stored credentials without any embedded consent or policy guardrails.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
TOPAZ_API_KEY=$(security find-generic-password -s "topaz-api-key" -w)

curl --request POST \
  --url https://api.topazlabs.com/image/v1/enhance \
  --header "X-API-Key: ${TOPAZ_API_KEY}" \
  --header 'accept: image/jpeg' \
  --header 'content-type: multipart/form-data' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The async submission endpoint also uploads local images to Topaz, creating the same third-party exposure as the sync path. The presence of both paths increases the chance data will be transmitted externally even if one code path fails, which strengthens the need for explicit controls and disclosure.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

bash
# Async: submit
RESPONSE=$(curl -s --request POST \
  --url https://api.topazlabs.com/image/v1/enhance/async \
  --header "X-API-Key: ${TOPAZ_API_KEY}" \
  --header 'content-type: multipart/form-data' \
  --form 'model=Low Resolution V2' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
# Poll status until Completed
while true; do
  STATUS=$(curl -s --header "X-API-Key: ${TOPAZ_API_KEY}" \
    "https://api.topazlabs.com/image/v1/status/${PROCESS_ID}" | jq -r '.status')
  [ "$STATUS" = "Completed" ] && break
  sleep 3
done

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This step downloads processed image data from Topaz, confirming that user-selected images are transmitted through an external service. While the API call itself is expected for the workflow, it is still a genuine external data-transfer surface with privacy, compliance, and content-rights implications if users are not informed.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

done

Download result

curl -s --header "X-API-Key: ${TOPAZ_API_KEY}"
"https://api.topazlabs.com/image/v1/download/${PROCESS_ID}"
--output "/tmp/ig-carousel/${slug}-enhanced.jpg"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This download call retrieves processed content from Topaz and is part of the same third-party processing flow. Although it does not newly expose data, it confirms reliance on an external service for handling user content, which remains a real concern when not clearly disclosed or approved.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

Download result

curl -s --header "X-API-Key: ${TOPAZ_API_KEY}"
"https://api.topazlabs.com/image/v1/download/${PROCESS_ID}"
--output "/tmp/ig-carousel/${slug}-enhanced.jpg"

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill automates publication to Instagram and temporarily hosts generated images on a public GitHub URL, but it does not require an explicit user confirmation or warning before making content public. This creates a real risk of unintended disclosure, accidental publishing, or exposing copyrighted/private images to a public endpoint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.