ClawHub
Back to skill

Security audit

Social Media Scheduler — Publish, Cross-Post & Auto-Post via ReplyNodes for OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

ReplyNodes is a clearly scoped social publishing skill that uses browser authorization and requires explicit confirmation before posting or scheduling.

Install only from an explicit reviewed tag or trusted marketplace entry. Expect the skill to connect to ReplyNodes, store a scoped session in secure storage, and publish only after you approve a named prepared run; revoke the ReplyNodes session if you uninstall or no longer want the connection.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Unpinned Dependencies

Low
Category
Supply Chain
Content
example-package>=1.2.3
Confidence
98% confidence
Finding
The dependency is specified with a lower bound only (>=1.2.3), which allows future unreviewed versions to be installed. This can introduce supply-chain risk through breaking changes or a compromised upstream release, especially in automated or reproducible build contexts.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
tests/fixtures/injected-secret/README.md:5