Social Auto Poster

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:31 AM UTC
• Version: 1.1.0

Overview

This skill is a coherent social-posting automation tool, but it directly publishes to live public accounts and stores WordPress publishing credentials with insufficient safety guidance.

Review carefully before installing. Use this only for accounts where you are comfortable with an agent posting publicly, confirm each platform and final content before publishing, use a least-privileged WordPress account, protect or replace the plaintext .env credential file, and avoid deleting existing draft media unless you know it belongs to the current post.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43

Finding

WordPress Application Password Stored and Used Insecurely

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–49 and 245–252
Vulnerability Type: Plaintext credential storage and process-argument exposure
Risk Level: Medium

Vulnerable Code

bash

WP_URL=https://yoursite.com
WP_USER=your_username
WP_APP_PASSWORD=xxxx xxxx xxxx xxxx xxxx xxxx

bash

source ~/.openclaw/.wp-[yoursite].env

bash

MEDIA=$(curl -s -X POST "$WP_URL/wp-json/wp/v2/media" \
  -u "$WP_USER:$WP_APP_PASSWORD" \
  -H "Content-Disposition: attachment; filename=post-image.png" \
  -H "Content-Type: image/png" \
  --data-binary @/tmp/openclaw/uploads/[topic]-vi.png)

The same curl -u "$WP_USER:$WP_APP_PASSWORD" pattern is repeated when publishing and modifying posts at lines 278–280 and 290–292.

Technical Analysis

The setup instructions place a reusable WordPress application password in a plaintext environment file without requiring restrictive file or parent-directory permissions. The resulting access depends on the user's existing umask and directory permissions. On a shared or compromised host, another local account or process may therefore be able to read the credential file.

Passing the credential through curl -u also expands it into the command's argument vector while the process is running. Depending on operating-system process-inspection restrictions, an authorized local observer may be able to recover it.

Using a WordPress application password is necessary for the declared publishing function, and the reviewed content does not intentionally transmit it to any host other than the user-configured WordPress endpoint. The issue is the absence of minimum protections around storage and invocation.

Attack Path

1. A user follows the instructions and creates ~/.openclaw/.wp-[yoursite].env.
2. The file or its parent directory inherits permissions that allow another local account or compromised process to read it.
3. Alternatively, an authorized local observer inspects the argument vector o ...[truncated 1068 chars]

Remediation

View remediation

Remediation Suggestions

1. Create the credential file with restrictive permissions from the outset:

bash

install -d -m 700 ~/.openclaw
umask 077
touch ~/.openclaw/.wp-[yoursite].env
chmod 600 ~/.openclaw/.wp-[yoursite].env

2. Explicitly document that the file must never be committed to source control, copied into logs, or placed in a shared directory.

3. Prefer an operating-system credential manager or another protected secret provider over a plaintext environment file.

4. Avoid exposing the password directly in command-line arguments where practical. Use a protected, temporary curl configuration or another authentication mechanism that does not place the expanded secret in the process argument vector, and remove temporary credential material immediately after use.

5. Create the application password under a dedicated, least-privileged WordPress publishing account rather than an administrator account.

6. Restrict the account to only the capabilities needed to upload media and create or update posts.

7. Rotate the application password periodically and revoke it immediately if local credential exposure is suspected.

8. Validate that WP_URL uses trusted HTTPS and points to the intended WordPress host before sending credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Step 2 — LinkedIn

Key constraint: Upload dialog lives inside a Shadow DOM (div.theme--light). ARM + Playwright native click is required. Never use evaluate input.click().

text

browser start → navigate linkedin.com/feed/ → wait for "Photo" text to appear

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill explicitly loads credentials from a local env file into the shell environment, making high-privilege publishing credentials available to subsequent commands and potentially to process inspection, shell history mistakes, or accidental debugging output. In an agent setting, broad credential exposure is risky because later commands may unintentionally use or disclose them.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

No browser needed. Load credentials first:

bash

source ~/.openclaw/.wp-[yoursite].env

5a. Upload featured image:

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

5a. Upload featured image:

bash

MEDIA=$(curl -s -X POST "$WP_URL/wp-json/wp/v2/media" \
  -u "$WP_USER:$WP_APP_PASSWORD" \
  -H "Content-Disposition: attachment; filename=post-image.png" \
  -H "Content-Type: image/png" \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

5c. Publish:

bash

POST=$(curl -s -X POST "$WP_URL/wp-json/wp/v2/posts" \
  -u "$WP_USER:$WP_APP_PASSWORD" \
  -H "Content-Type: application/json" \
  --data-binary @/tmp/wp-post.json)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.

5d. Patch Yoast SEO OG image (required — skipping this causes avatar.jpg to show when the post is shared):

bash

curl -s -X POST "$WP_URL/wp-json/wp/v2/posts/$POST_ID" \
  -u "$WP_USER:$WP_APP_PASSWORD" \
  -H "Content-Type: application/json" \
  -d "{\"meta\":{\"_yoast_wpseo_opengraph-image\":\"$IMAGE_URL\",\"_yoast_wpseo_opengraph-image-id\":$MEDIA_ID}}"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill automates publishing directly to live external platforms but does not include an explicit warning that actions are public, potentially irreversible, and may immediately notify followers or subscribers. In an agent context, this increases the risk of accidental real-world actions from ambiguous prompts or operator misunderstanding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs storing a WordPress application password in a local .env file without warning that this is a sensitive credential with publishing privileges. If the file is exposed through weak filesystem permissions, backups, logs, or accidental sharing, an attacker could publish or modify site content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The instruction to persist WordPress credentials in ~/.openclaw creates long-lived local secret storage without discussing lifecycle, access controls, or cleanup. Persistent credentials increase blast radius if the workstation, home directory, or backups are compromised.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

WordPress uses REST API with Application Password — no browser needed.

Create a credentials file at ~/.openclaw/.wp-[yoursite].env:

bash

WP_URL=https://yoursite.com

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions prescribe English for LinkedIn and X and local language for Facebook, WordPress, and Substack. This is a natural-language locale policy choice presented as mandatory behavior, but the skill does not offer user choice or explain why this constraint is required.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

md

.find(b => b.textContent.includes('đang nghĩ gì') || b.textContent.includes("on your mind"))
    .click()

wait 2s → verify "Create post" / "Tạo bài viết" dialog is open

ARM upload:
  browser upload paths=["/tmp/openclaw/uploads/[topic]-vi.png"]

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

5a. Upload featured image:

bash

MEDIA=$(curl -s -X POST "$WP_URL/wp-json/wp/v2/media" \
  -u "$WP_USER:$WP_APP_PASSWORD" \
  -H "Content-Disposition: attachment; filename=post-image.png" \
  -H "Content-Type: image/png" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

5c. Publish:

bash

POST=$(curl -s -X POST "$WP_URL/wp-json/wp/v2/posts" \
  -u "$WP_USER:$WP_APP_PASSWORD" \
  -H "Content-Type: application/json" \
  --data-binary @/tmp/wp-post.json)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.

5d. Patch Yoast SEO OG image (required — skipping this causes avatar.jpg to show when the post is shared):

bash

curl -s -X POST "$WP_URL/wp-json/wp/v2/posts/$POST_ID" \
  -u "$WP_USER:$WP_APP_PASSWORD" \
  -H "Content-Type: application/json" \
  -d "{\"meta\":{\"_yoast_wpseo_opengraph-image\":\"$IMAGE_URL\",\"_yoast_wpseo_opengraph-image-id\":$MEDIA_ID}}"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guidance instructs the agent to delete existing LinkedIn draft images to reach a desired state, but it does not require confirming ownership, draft provenance, or obtaining user approval before modifying pre-existing content. In a browser-automation skill, this can cause unintended destructive changes to a user's saved draft or previously prepared post content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Facebook guidance relies on specific Vietnamese interface strings such as "Ảnh/video", "Bạn đang nghĩ gì?", and "Tạo bài viết". This effectively assumes a Vietnamese locale and does not indicate any user opt-in or alternative for other interface languages, which is a language/locale policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/platform-quirks.md (reported line 69)May include surrounding context.

Always patch after publishing:

bash

curl -X POST "$WP_URL/wp-json/wp/v2/posts/POST_ID" \
  -u "$WP_USER:$WP_APP_PASSWORD" \
  -H "Content-Type: application/json" \
  -d '{"meta":{"_yoast_wpseo_opengraph-image":"IMAGE_URL","_yoast_wpseo_opengraph-image-id":MEDIA_ID}}'

Static analysis

No suspicious patterns detected.